History

Revert "Version Packages (#1171)"

This reverts commit a7d46033743b29fba1fcb142258ca0e809178d37.

Rhys Sullivan committed 4 months ago

Commit 26b46dc1 parent 4600a2166 files · +127 −384Browse files

Unified · Split

66 files
  1. .changeset/cimd-org-redirect-uri.md +12 −0
  2. .changeset/desktop-background-service-consent-seam.md +5 −0
  3. .changeset/desktop-sidecar-auth-token-dash.md +5 −0
  4. .changeset/graphql-valid-selections.md +9 −0
  5. .changeset/update-available-notifications.md +8 −0
  6. apps/cli/CHANGELOG.md +0 −18
  7. apps/cli/package.json +1 −1
  8. apps/cloud/CHANGELOG.md +0 −22
  9. apps/cloud/package.json +1 −1
  10. apps/desktop/CHANGELOG.md +0 −6
  11. apps/desktop/package.json +1 −1
  12. apps/host-selfhost/CHANGELOG.md +0 −20
  13. apps/host-selfhost/package.json +1 −1
  14. bun.lock +29 −29
  15. e2e/AGENTS.md +1 −1
  16. e2e/CHANGELOG.md +0 −13
  17. e2e/package.json +1 −1
  18. examples/all-plugins/CHANGELOG.md +0 −15
  19. examples/all-plugins/package.json +1 −1
  20. examples/docs-sdk-quickstart/CHANGELOG.md +0 −8
  21. examples/docs-sdk-quickstart/package.json +1 −1
  22. packages/core/api/CHANGELOG.md +0 −22
  23. packages/core/api/package.json +1 −1
  24. packages/core/cli/CHANGELOG.md +0 −7
  25. packages/core/cli/package.json +1 −1
  26. packages/core/config/CHANGELOG.md +0 −7
  27. packages/core/config/package.json +1 −1
  28. packages/core/execution/CHANGELOG.md +0 −8
  29. packages/core/execution/package.json +1 −1
  30. packages/core/sdk/CHANGELOG.md +0 −2
  31. packages/core/sdk/package.json +1 −1
  32. packages/core/vite-plugin/CHANGELOG.md +0 −7
  33. packages/core/vite-plugin/package.json +1 −1
  34. packages/hosts/cloudflare/CHANGELOG.md +0 −10
  35. packages/hosts/cloudflare/package.json +1 −1
  36. packages/kernel/core/CHANGELOG.md +0 −2
  37. packages/kernel/core/package.json +1 −1
  38. packages/kernel/runtime-quickjs/CHANGELOG.md +0 −7
  39. packages/kernel/runtime-quickjs/package.json +1 −1
  40. packages/plugins/desktop-settings/CHANGELOG.md +0 −7
  41. packages/plugins/desktop-settings/package.json +1 −1
  42. packages/plugins/encrypted-secrets/CHANGELOG.md +0 −7
  43. packages/plugins/encrypted-secrets/package.json +1 −1
  44. packages/plugins/example/CHANGELOG.md +0 −7
  45. packages/plugins/example/package.json +1 −1
  46. packages/plugins/file-secrets/CHANGELOG.md +0 −7
  47. packages/plugins/file-secrets/package.json +1 −1
  48. packages/plugins/google/CHANGELOG.md +0 −10
  49. packages/plugins/google/package.json +1 −1
  50. packages/plugins/graphql/CHANGELOG.md +0 −16
  51. packages/plugins/graphql/package.json +1 −1
  52. packages/plugins/keychain/CHANGELOG.md +0 −7
  53. packages/plugins/keychain/package.json +1 −1
  54. packages/plugins/mcp/CHANGELOG.md +0 −10
  55. packages/plugins/mcp/package.json +1 −1
  56. packages/plugins/microsoft/CHANGELOG.md +0 −10
  57. packages/plugins/microsoft/package.json +1 −1
  58. packages/plugins/onepassword/CHANGELOG.md +0 −9
  59. packages/plugins/onepassword/package.json +1 −1
  60. packages/plugins/openapi/CHANGELOG.md +0 −10
  61. packages/plugins/openapi/package.json +1 −1
  62. packages/plugins/toolkits/CHANGELOG.md +0 −9
  63. packages/plugins/toolkits/package.json +1 −1
  64. packages/react/CHANGELOG.md +0 −12
  65. packages/react/package.json +1 −1
  66. vision.md +29 −30
.changeset/cimd-org-redirect-uri.md+12−0
@@ -0,0 +1,12 @@
1---
2"@executor-js/api": patch
3---
4
5Fix OAuth "Mismatching redirect URI" for org-scoped client-id metadata documents
6
7Org-scoped client-id metadata documents registered their callback as
8`redirect_uri` with an `executor_org` query param, but the client always sends
9the bare callback and the org is carried in the OAuth `state`. Providers that
10compare `redirect_uri` as an exact string (such as PostHog) rejected the
11authorize request. Org targets now keep their distinct `client_id` URL but
12register the same bare callback `redirect_uri` as every other target.
.changeset/desktop-background-service-consent-seam.md+5−0
@@ -0,0 +1,5 @@
1---
2"executor": patch
3---
4
5Add a test seam to skip the first-run "keep Executor running in the background?" consent dialog under automation, matching the existing `confirmResetState` seam. Set `EXECUTOR_TEST_AUTO_CONFIRM_BACKGROUND_SERVICE=1` to keep the background service or any other value to decline. When the variable is unset the dialog is shown exactly as before. Native dialogs cannot be answered from CDP or Playwright, so a packaged first-run boot under automation previously blocked at this prompt with no way to proceed.
.changeset/desktop-sidecar-auth-token-dash.md+5−0
@@ -0,0 +1,5 @@
1---
2"executor": patch
3---
4
5Fix the desktop app failing to start its local server when the generated auth token begins with a dash. The token is `randomBytes(32).toString("base64url")`, which can start with "-", and the packaged app passed it to the bundled CLI as a separate argument (`--auth-token`, then the token). The CLI then read the leading-dash token as an unknown flag, printed its help, and exited, so the desktop showed a fatal "local Executor server crashed during startup" dialog. This was persistent (the token is saved) and cross-platform, affecting roughly 1 in 64 fresh installs. The token is now passed in the combined `--auth-token=<value>` form so a leading dash is treated as the value.
.changeset/graphql-valid-selections.md+9−0
@@ -0,0 +1,9 @@
1---
2"@executor-js/plugin-graphql": patch
3---
4
5Fix the GraphQL plugin generating invalid operations against large schemas, and make field selection caller-controlled instead of a baked-in guess.
6
7Previously each tool froze a recursive, depth- and count-bounded selection at sync time. Against a rich schema (GitLab) this produced invalid GraphQL (composite fields with no sub-selection, nested fields missing required arguments) so every call over a rich return type failed, and the arbitrary bound silently truncated which fields came back.
8
9Generated tools now default to selecting only scalar/enum leaf fields of the return type (always valid, always within a server's query-complexity budget), and expose an optional `select` input carrying a GraphQL selection set so a caller can request nested or list data per call (including supplying nested required arguments). Fixes #1146.
.changeset/update-available-notifications.md+8−0
@@ -0,0 +1,8 @@
1---
2"executor": minor
3"@executor-js/desktop": minor
4"@executor-js/api": minor
5"@executor-js/react": minor
6---
7
8Notify when a newer Executor is published. The CLI now prints an "update available" line under its ready banner, and the web shell's sidebar update card works for real (a new `/v1/app/npm/dist-tags` endpoint backs it). In the desktop app the card shows a native "Restart to update" action wired to the in-app updater instead of the npm command. The check is best-effort and offline-safe, and can be disabled with `EXECUTOR_DISABLE_UPDATE_CHECK`.
apps/cli/CHANGELOG.md+0−18
@@ -1,23 +1,5 @@
1# executor1# executor
2 2
3## 2.0.0
4
5### Minor Changes
6
7- [#1182](https://github.com/RhysSullivan/executor/pull/1182) [`b6c8968`](https://github.com/RhysSullivan/executor/commit/b6c8968c2a3dd3cf8d8b2fa5ecdbd2a1f9cad4f2) Thanks [@RhysSullivan](https://github.com/RhysSullivan)! - Notify when a newer Executor is published. The CLI now prints an "update available" line under its ready banner, and the web shell's sidebar update card works for real (a new `/v1/app/npm/dist-tags` endpoint backs it). In the desktop app the card shows a native "Restart to update" action wired to the in-app updater instead of the npm command. The check is best-effort and offline-safe, and can be disabled with `EXECUTOR_DISABLE_UPDATE_CHECK`.
8
9### Patch Changes
10
11- [#1170](https://github.com/RhysSullivan/executor/pull/1170) [`0de0106`](https://github.com/RhysSullivan/executor/commit/0de0106771aa8997db72f0ce3a619ac4920ccfcd) Thanks [@RhysSullivan](https://github.com/RhysSullivan)! - Add a test seam to skip the first-run "keep Executor running in the background?" consent dialog under automation, matching the existing `confirmResetState` seam. Set `EXECUTOR_TEST_AUTO_CONFIRM_BACKGROUND_SERVICE=1` to keep the background service or any other value to decline. When the variable is unset the dialog is shown exactly as before. Native dialogs cannot be answered from CDP or Playwright, so a packaged first-run boot under automation previously blocked at this prompt with no way to proceed.
12
13- [#1169](https://github.com/RhysSullivan/executor/pull/1169) [`94647f1`](https://github.com/RhysSullivan/executor/commit/94647f1fc33e57d2eb159f929f95d9e9f6ad60cd) Thanks [@RhysSullivan](https://github.com/RhysSullivan)! - Fix the desktop app failing to start its local server when the generated auth token begins with a dash. The token is `randomBytes(32).toString("base64url")`, which can start with "-", and the packaged app passed it to the bundled CLI as a separate argument (`--auth-token`, then the token). The CLI then read the leading-dash token as an unknown flag, printed its help, and exited, so the desktop showed a fatal "local Executor server crashed during startup" dialog. This was persistent (the token is saved) and cross-platform, affecting roughly 1 in 64 fresh installs. The token is now passed in the combined `--auth-token=<value>` form so a leading dash is treated as the value.
14
15- Updated dependencies [[`fd29abe`](https://github.com/RhysSullivan/executor/commit/fd29abe23a329e8e8c50ce185bfc23f58a5348d0), [`b6c8968`](https://github.com/RhysSullivan/executor/commit/b6c8968c2a3dd3cf8d8b2fa5ecdbd2a1f9cad4f2)]:
16 - @executor-js/api@1.5.0
17 - @executor-js/local@1.4.4
18 - @executor-js/sdk@2.0.0
19 - @executor-js/runtime-quickjs@2.0.0
20
21## 1.5.223## 1.5.22
22 4
23### Patch Changes5### Patch Changes
apps/cli/package.json+1−1
@@ -1,6 +1,6 @@
1{1{
2 "name": "executor",2 "name": "executor",
3 "version": "2.0.0",3 "version": "1.5.22",
4 "private": true,4 "private": true,
5 "bin": {5 "bin": {
6 "executor": "./bin/executor.ts"6 "executor": "./bin/executor.ts"
apps/cloud/CHANGELOG.md+0−22
@@ -1,27 +1,5 @@
1# @executor-js/cloud1# @executor-js/cloud
2 2
3## 1.4.41
4
5### Patch Changes
6
7- Updated dependencies [[`fd29abe`](https://github.com/RhysSullivan/executor/commit/fd29abe23a329e8e8c50ce185bfc23f58a5348d0), [`cc94666`](https://github.com/RhysSullivan/executor/commit/cc94666fa6adf5a0c7ceb667b3797334020327b1), [`b6c8968`](https://github.com/RhysSullivan/executor/commit/b6c8968c2a3dd3cf8d8b2fa5ecdbd2a1f9cad4f2)]:
8 - @executor-js/api@1.5.0
9 - @executor-js/plugin-graphql@2.0.0
10 - @executor-js/react@1.5.0
11 - @executor-js/cloudflare@0.0.22
12 - @executor-js/plugin-google@2.0.0
13 - @executor-js/plugin-mcp@2.0.0
14 - @executor-js/plugin-microsoft@2.0.0
15 - @executor-js/plugin-openapi@2.0.0
16 - @executor-js/plugin-toolkits@2.0.0
17 - @executor-js/plugin-workos-vault@0.0.2
18 - @executor-js/runtime-dynamic-worker@1.4.4
19 - @executor-js/sdk@2.0.0
20 - @executor-js/runtime-quickjs@2.0.0
21 - @executor-js/execution@2.0.0
22 - @executor-js/vite-plugin@0.0.40
23 - @executor-js/host-mcp@1.4.4
24
25## 1.4.403## 1.4.40
26 4
27### Patch Changes5### Patch Changes
apps/cloud/package.json+1−1
@@ -1,6 +1,6 @@
1{1{
2 "name": "@executor-js/cloud",2 "name": "@executor-js/cloud",
3 "version": "1.4.41",3 "version": "1.4.40",
4 "private": true,4 "private": true,
5 "type": "module",5 "type": "module",
6 "scripts": {6 "scripts": {
apps/desktop/CHANGELOG.md+0−6
@@ -1,11 +1,5 @@
1# @executor-js/desktop1# @executor-js/desktop
2 2
3## 2.0.0
4
5### Minor Changes
6
7- [#1182](https://github.com/RhysSullivan/executor/pull/1182) [`b6c8968`](https://github.com/RhysSullivan/executor/commit/b6c8968c2a3dd3cf8d8b2fa5ecdbd2a1f9cad4f2) Thanks [@RhysSullivan](https://github.com/RhysSullivan)! - Notify when a newer Executor is published. The CLI now prints an "update available" line under its ready banner, and the web shell's sidebar update card works for real (a new `/v1/app/npm/dist-tags` endpoint backs it). In the desktop app the card shows a native "Restart to update" action wired to the in-app updater instead of the npm command. The check is best-effort and offline-safe, and can be disabled with `EXECUTOR_DISABLE_UPDATE_CHECK`.
8
9## 1.5.223## 1.5.22
10 4
11## 1.5.215## 1.5.21
apps/desktop/package.json+1−1
@@ -1,6 +1,6 @@
1{1{
2 "name": "@executor-js/desktop",2 "name": "@executor-js/desktop",
3 "version": "2.0.0",3 "version": "1.5.22",
4 "private": true,4 "private": true,
5 "homepage": "https://github.com/RhysSullivan/executor",5 "homepage": "https://github.com/RhysSullivan/executor",
6 "license": "MIT",6 "license": "MIT",
apps/host-selfhost/CHANGELOG.md+0−20
@@ -1,25 +1,5 @@
1# @executor-js/host-selfhost1# @executor-js/host-selfhost
2 2
3## 0.0.22
4
5### Patch Changes
6
7- Updated dependencies [[`fd29abe`](https://github.com/RhysSullivan/executor/commit/fd29abe23a329e8e8c50ce185bfc23f58a5348d0), [`cc94666`](https://github.com/RhysSullivan/executor/commit/cc94666fa6adf5a0c7ceb667b3797334020327b1), [`b6c8968`](https://github.com/RhysSullivan/executor/commit/b6c8968c2a3dd3cf8d8b2fa5ecdbd2a1f9cad4f2)]:
8 - @executor-js/api@1.5.0
9 - @executor-js/plugin-graphql@2.0.0
10 - @executor-js/react@1.5.0
11 - @executor-js/plugin-google@2.0.0
12 - @executor-js/plugin-mcp@2.0.0
13 - @executor-js/plugin-microsoft@2.0.0
14 - @executor-js/plugin-openapi@2.0.0
15 - @executor-js/plugin-toolkits@2.0.0
16 - @executor-js/app@1.4.4
17 - @executor-js/sdk@2.0.0
18 - @executor-js/runtime-quickjs@2.0.0
19 - @executor-js/execution@2.0.0
20 - @executor-js/host-mcp@1.4.4
21 - @executor-js/plugin-encrypted-secrets@0.0.22
22
23## 0.0.213## 0.0.21
24 4
25### Patch Changes5### Patch Changes
apps/host-selfhost/package.json+1−1
@@ -1,6 +1,6 @@
1{1{
2 "name": "@executor-js/host-selfhost",2 "name": "@executor-js/host-selfhost",
3 "version": "0.0.22",3 "version": "0.0.21",
4 "private": true,4 "private": true,
5 "type": "module",5 "type": "module",
6 "exports": {6 "exports": {
bun.lock+29−29
@@ -30,7 +30,7 @@ · 29 unmodified lines
30 },30 },
31 "apps/cli": {31 "apps/cli": {
32 "name": "executor",32 "name": "executor",
33 "version": "2.0.0",33 "version": "1.5.22",
34 "bin": {34 "bin": {
35 "executor": "./bin/executor.ts",35 "executor": "./bin/executor.ts",
36 },36 },
@@ -55,7 +55,7 @@ · 18 unmodified lines
55 },55 },
56 "apps/cloud": {56 "apps/cloud": {
57 "name": "@executor-js/cloud",57 "name": "@executor-js/cloud",
58 "version": "1.4.41",58 "version": "1.4.40",
59 "dependencies": {59 "dependencies": {
60 "@cloudflare/vite-plugin": "^1.31.1",60 "@cloudflare/vite-plugin": "^1.31.1",
61 "@effect/atom-react": "catalog:",61 "@effect/atom-react": "catalog:",
@@ -126,7 +126,7 @@ · 64 unmodified lines
126 },126 },
127 "apps/desktop": {127 "apps/desktop": {
128 "name": "@executor-js/desktop",128 "name": "@executor-js/desktop",
129 "version": "2.0.0",129 "version": "1.5.22",
130 "dependencies": {130 "dependencies": {
131 "@sentry/bun": "^10.57.0",131 "@sentry/bun": "^10.57.0",
132 "@sentry/electron": "^7.13.0",132 "@sentry/electron": "^7.13.0",
@@ -213,7 +213,7 @@ · 80 unmodified lines
213 },213 },
214 "apps/host-selfhost": {214 "apps/host-selfhost": {
215 "name": "@executor-js/host-selfhost",215 "name": "@executor-js/host-selfhost",
216 "version": "0.0.22",216 "version": "0.0.21",
217 "dependencies": {217 "dependencies": {
218 "@better-auth/api-key": "^1.6.11",218 "@better-auth/api-key": "^1.6.11",
219 "@effect/atom-react": "catalog:",219 "@effect/atom-react": "catalog:",
@@ -340,7 +340,7 @@ · 120 unmodified lines
340 },340 },
341 "e2e": {341 "e2e": {
342 "name": "@executor-js/e2e",342 "name": "@executor-js/e2e",
343 "version": "0.0.20",343 "version": "0.0.19",
344 "dependencies": {344 "dependencies": {
345 "@executor-js/api": "workspace:*",345 "@executor-js/api": "workspace:*",
346 "@executor-js/emulate": "^0.8.1",346 "@executor-js/emulate": "^0.8.1",
@@ -376,7 +376,7 @@ · 29 unmodified lines
376 },376 },
377 "examples/all-plugins": {377 "examples/all-plugins": {
378 "name": "@executor-js/example-all-plugins",378 "name": "@executor-js/example-all-plugins",
379 "version": "0.0.41",379 "version": "0.0.40",
380 "dependencies": {380 "dependencies": {
381 "@executor-js/plugin-file-secrets": "workspace:*",381 "@executor-js/plugin-file-secrets": "workspace:*",
382 "@executor-js/plugin-google": "workspace:*",382 "@executor-js/plugin-google": "workspace:*",
@@ -396,7 +396,7 @@ · 13 unmodified lines
396 },396 },
397 "examples/docs-sdk-quickstart": {397 "examples/docs-sdk-quickstart": {
398 "name": "@executor-js/example-docs-sdk-quickstart",398 "name": "@executor-js/example-docs-sdk-quickstart",
399 "version": "0.0.26",399 "version": "0.0.25",
400 "dependencies": {400 "dependencies": {
401 "@executor-js/plugin-openapi": "workspace:*",401 "@executor-js/plugin-openapi": "workspace:*",
402 "@executor-js/sdk": "workspace:*",402 "@executor-js/sdk": "workspace:*",
@@ -450,7 +450,7 @@ · 47 unmodified lines
450 },450 },
451 "packages/core/api": {451 "packages/core/api": {
452 "name": "@executor-js/api",452 "name": "@executor-js/api",
453 "version": "1.5.0",453 "version": "1.4.42",
454 "dependencies": {454 "dependencies": {
455 "@executor-js/execution": "workspace:*",455 "@executor-js/execution": "workspace:*",
456 "@executor-js/host-mcp": "workspace:*",456 "@executor-js/host-mcp": "workspace:*",
@@ -467,7 +467,7 @@ · 10 unmodified lines
467 },467 },
468 "packages/core/cli": {468 "packages/core/cli": {
469 "name": "@executor-js/cli",469 "name": "@executor-js/cli",
470 "version": "0.2.29",470 "version": "0.2.28",
471 "bin": {471 "bin": {
472 "executor-sdk": "./dist/index.js",472 "executor-sdk": "./dist/index.js",
473 },473 },
@@ -488,7 +488,7 @@ · 14 unmodified lines
488 },488 },
489 "packages/core/config": {489 "packages/core/config": {
490 "name": "@executor-js/config",490 "name": "@executor-js/config",
491 "version": "2.0.0",491 "version": "1.5.22",
492 "dependencies": {492 "dependencies": {
493 "@executor-js/sdk": "workspace:*",493 "@executor-js/sdk": "workspace:*",
494 "jiti": "^2.6.1",494 "jiti": "^2.6.1",
@@ -509,7 +509,7 @@ · 14 unmodified lines
509 },509 },
510 "packages/core/execution": {510 "packages/core/execution": {
511 "name": "@executor-js/execution",511 "name": "@executor-js/execution",
512 "version": "2.0.0",512 "version": "1.5.22",
513 "dependencies": {513 "dependencies": {
514 "@executor-js/codemode-core": "workspace:*",514 "@executor-js/codemode-core": "workspace:*",
515 "@executor-js/sdk": "workspace:*",515 "@executor-js/sdk": "workspace:*",
@@ -575,7 +575,7 @@ · 59 unmodified lines
575 },575 },
576 "packages/core/sdk": {576 "packages/core/sdk": {
577 "name": "@executor-js/sdk",577 "name": "@executor-js/sdk",
578 "version": "2.0.0",578 "version": "1.5.22",
579 "dependencies": {579 "dependencies": {
580 "@executor-js/fumadb": "workspace:*",580 "@executor-js/fumadb": "workspace:*",
581 "@standard-schema/spec": "^1.1.0",581 "@standard-schema/spec": "^1.1.0",
@@ -627,7 +627,7 @@ · 45 unmodified lines
627 },627 },
628 "packages/core/vite-plugin": {628 "packages/core/vite-plugin": {
629 "name": "@executor-js/vite-plugin",629 "name": "@executor-js/vite-plugin",
630 "version": "0.0.40",630 "version": "0.0.39",
631 "dependencies": {631 "dependencies": {
632 "@executor-js/sdk": "workspace:*",632 "@executor-js/sdk": "workspace:*",
633 "jiti": "^2.6.1",633 "jiti": "^2.6.1",
@@ -647,7 +647,7 @@ · 13 unmodified lines
647 },647 },
648 "packages/hosts/cloudflare": {648 "packages/hosts/cloudflare": {
649 "name": "@executor-js/cloudflare",649 "name": "@executor-js/cloudflare",
650 "version": "0.0.22",650 "version": "0.0.21",
651 "dependencies": {651 "dependencies": {
652 "@executor-js/api": "workspace:*",652 "@executor-js/api": "workspace:*",
653 "@executor-js/execution": "workspace:*",653 "@executor-js/execution": "workspace:*",
@@ -686,7 +686,7 @@ · 32 unmodified lines
686 },686 },
687 "packages/kernel/core": {687 "packages/kernel/core": {
688 "name": "@executor-js/codemode-core",688 "name": "@executor-js/codemode-core",
689 "version": "2.0.0",689 "version": "1.5.22",
690 "dependencies": {690 "dependencies": {
691 "@babel/parser": "^7.29.2",691 "@babel/parser": "^7.29.2",
692 "@standard-schema/spec": "^1.0.0",692 "@standard-schema/spec": "^1.0.0",
@@ -759,7 +759,7 @@ · 66 unmodified lines
759 },759 },
760 "packages/kernel/runtime-quickjs": {760 "packages/kernel/runtime-quickjs": {
761 "name": "@executor-js/runtime-quickjs",761 "name": "@executor-js/runtime-quickjs",
762 "version": "2.0.0",762 "version": "1.5.22",
763 "dependencies": {763 "dependencies": {
764 "@executor-js/codemode-core": "workspace:*",764 "@executor-js/codemode-core": "workspace:*",
765 "quickjs-emscripten": "catalog:",765 "quickjs-emscripten": "catalog:",
@@ -779,7 +779,7 @@ · 13 unmodified lines
779 },779 },
780 "packages/plugins/desktop-settings": {780 "packages/plugins/desktop-settings": {
781 "name": "@executor-js/plugin-desktop-settings",781 "name": "@executor-js/plugin-desktop-settings",
782 "version": "2.0.0",782 "version": "1.5.22",
783 "dependencies": {783 "dependencies": {
784 "@executor-js/sdk": "workspace:*",784 "@executor-js/sdk": "workspace:*",
785 "react": "catalog:",785 "react": "catalog:",
@@ -792,7 +792,7 @@ · 6 unmodified lines
792 },792 },
793 "packages/plugins/encrypted-secrets": {793 "packages/plugins/encrypted-secrets": {
794 "name": "@executor-js/plugin-encrypted-secrets",794 "name": "@executor-js/plugin-encrypted-secrets",
795 "version": "0.0.22",795 "version": "0.0.21",
796 "dependencies": {796 "dependencies": {
797 "@executor-js/sdk": "workspace:*",797 "@executor-js/sdk": "workspace:*",
798 "effect": "catalog:",798 "effect": "catalog:",
@@ -807,7 +807,7 @@ · 8 unmodified lines
807 },807 },
808 "packages/plugins/example": {808 "packages/plugins/example": {
809 "name": "@executor-js/plugin-example",809 "name": "@executor-js/plugin-example",
810 "version": "2.0.0",810 "version": "1.5.22",
811 "dependencies": {811 "dependencies": {
812 "@executor-js/sdk": "workspace:*",812 "@executor-js/sdk": "workspace:*",
813 },813 },
@@ -830,7 +830,7 @@ · 16 unmodified lines
830 },830 },
831 "packages/plugins/file-secrets": {831 "packages/plugins/file-secrets": {
832 "name": "@executor-js/plugin-file-secrets",832 "name": "@executor-js/plugin-file-secrets",
833 "version": "2.0.0",833 "version": "1.5.22",
834 "dependencies": {834 "dependencies": {
835 "@executor-js/sdk": "workspace:*",835 "@executor-js/sdk": "workspace:*",
836 },836 },
@@ -847,7 +847,7 @@ · 10 unmodified lines
847 },847 },
848 "packages/plugins/google": {848 "packages/plugins/google": {
849 "name": "@executor-js/plugin-google",849 "name": "@executor-js/plugin-google",
850 "version": "2.0.0",850 "version": "1.5.21",
851 "dependencies": {851 "dependencies": {
852 "@executor-js/plugin-openapi": "workspace:*",852 "@executor-js/plugin-openapi": "workspace:*",
853 "@executor-js/sdk": "workspace:*",853 "@executor-js/sdk": "workspace:*",
@@ -884,7 +884,7 @@ · 30 unmodified lines
884 },884 },
885 "packages/plugins/graphql": {885 "packages/plugins/graphql": {
886 "name": "@executor-js/plugin-graphql",886 "name": "@executor-js/plugin-graphql",
887 "version": "2.0.0",887 "version": "1.5.22",
888 "dependencies": {888 "dependencies": {
889 "@effect/platform-node": "catalog:",889 "@effect/platform-node": "catalog:",
890 "@executor-js/config": "workspace:*",890 "@executor-js/config": "workspace:*",
@@ -923,7 +923,7 @@ · 32 unmodified lines
923 },923 },
924 "packages/plugins/keychain": {924 "packages/plugins/keychain": {
925 "name": "@executor-js/plugin-keychain",925 "name": "@executor-js/plugin-keychain",
926 "version": "2.0.0",926 "version": "1.5.22",
927 "dependencies": {927 "dependencies": {
928 "@executor-js/sdk": "workspace:*",928 "@executor-js/sdk": "workspace:*",
929 "@napi-rs/keyring": "^1.2.0",929 "@napi-rs/keyring": "^1.2.0",
@@ -942,7 +942,7 @@ · 12 unmodified lines
942 },942 },
943 "packages/plugins/mcp": {943 "packages/plugins/mcp": {
944 "name": "@executor-js/plugin-mcp",944 "name": "@executor-js/plugin-mcp",
945 "version": "2.0.0",945 "version": "1.5.22",
946 "dependencies": {946 "dependencies": {
947 "@cfworker/json-schema": "^4.1.1",947 "@cfworker/json-schema": "^4.1.1",
948 "@effect/platform-node": "catalog:",948 "@effect/platform-node": "catalog:",
@@ -982,7 +982,7 @@ · 33 unmodified lines
982 },982 },
983 "packages/plugins/microsoft": {983 "packages/plugins/microsoft": {
984 "name": "@executor-js/plugin-microsoft",984 "name": "@executor-js/plugin-microsoft",
985 "version": "2.0.0",985 "version": "1.5.21",
986 "dependencies": {986 "dependencies": {
987 "@executor-js/plugin-openapi": "workspace:*",987 "@executor-js/plugin-openapi": "workspace:*",
988 "@executor-js/sdk": "workspace:*",988 "@executor-js/sdk": "workspace:*",
@@ -1019,7 +1019,7 @@ · 30 unmodified lines
1019 },1019 },
1020 "packages/plugins/onepassword": {1020 "packages/plugins/onepassword": {
1021 "name": "@executor-js/plugin-onepassword",1021 "name": "@executor-js/plugin-onepassword",
1022 "version": "2.0.0",1022 "version": "1.5.22",
1023 "dependencies": {1023 "dependencies": {
1024 "@1password/op-js": "^0.1.13",1024 "@1password/op-js": "^0.1.13",
1025 "@1password/sdk": "^0.4.1-beta.1",1025 "@1password/sdk": "^0.4.1-beta.1",
@@ -1053,7 +1053,7 @@ · 27 unmodified lines
1053 },1053 },
1054 "packages/plugins/openapi": {1054 "packages/plugins/openapi": {
1055 "name": "@executor-js/plugin-openapi",1055 "name": "@executor-js/plugin-openapi",
1056 "version": "2.0.0",1056 "version": "1.5.22",
1057 "dependencies": {1057 "dependencies": {
1058 "@effect/platform-node": "catalog:",1058 "@effect/platform-node": "catalog:",
1059 "@executor-js/config": "workspace:*",1059 "@executor-js/config": "workspace:*",
@@ -1094,7 +1094,7 @@ · 34 unmodified lines
1094 },1094 },
1095 "packages/plugins/toolkits": {1095 "packages/plugins/toolkits": {
1096 "name": "@executor-js/plugin-toolkits",1096 "name": "@executor-js/plugin-toolkits",
1097 "version": "2.0.0",1097 "version": "1.5.14",
1098 "dependencies": {1098 "dependencies": {
1099 "@executor-js/sdk": "workspace:*",1099 "@executor-js/sdk": "workspace:*",
1100 },1100 },
@@ -1163,7 +1163,7 @@ · 62 unmodified lines
1163 },1163 },
1164 "packages/react": {1164 "packages/react": {
1165 "name": "@executor-js/react",1165 "name": "@executor-js/react",
1166 "version": "1.5.0",1166 "version": "1.4.42",
1167 "dependencies": {1167 "dependencies": {
1168 "@base-ui/react": "^1.3.0",1168 "@base-ui/react": "^1.3.0",
1169 "@effect/atom-react": "catalog:",1169 "@effect/atom-react": "catalog:",
e2e/AGENTS.md+1−1
@@ -187,7 +187,7 @@ still have a usable display: · 186 unmodified lines
187 187
188- **macOS**: the base image's autologin reaches a real Aqua session188- **macOS**: the base image's autologin reaches a real Aqua session
189 (WindowServer/Dock/Finder). Launch the app INTO it with `sudo launchctl asuser189 (WindowServer/Dock/Finder). Launch the app INTO it with `sudo launchctl asuser
190<uid> …` (a plain SSH spawn lands in a non-GUI session); the unsigned arm64190 <uid> …` (a plain SSH spawn lands in a non-GUI session); the unsigned arm64
191 bundle is ad-hoc `codesign`'d in the guest; `screencapture` films it.191 bundle is ad-hoc `codesign`'d in the guest; `screencapture` films it.
192- **linux**: no window server, so the app renders into an `Xvfb` display with a192- **linux**: no window server, so the app renders into an `Xvfb` display with a
193 minimal WM (`openbox` — without it the electron window never maps); the window193 minimal WM (`openbox` — without it the electron window never maps); the window
e2e/CHANGELOG.md+0−13
@@ -1,18 +1,5 @@
1# @executor-js/e2e1# @executor-js/e2e
2 2
3## 0.0.20
4
5### Patch Changes
6
7- Updated dependencies [[`fd29abe`](https://github.com/RhysSullivan/executor/commit/fd29abe23a329e8e8c50ce185bfc23f58a5348d0), [`cc94666`](https://github.com/RhysSullivan/executor/commit/cc94666fa6adf5a0c7ceb667b3797334020327b1), [`b6c8968`](https://github.com/RhysSullivan/executor/commit/b6c8968c2a3dd3cf8d8b2fa5ecdbd2a1f9cad4f2)]:
8 - @executor-js/api@1.5.0
9 - @executor-js/plugin-graphql@2.0.0
10 - @executor-js/plugin-mcp@2.0.0
11 - @executor-js/plugin-microsoft@2.0.0
12 - @executor-js/plugin-openapi@2.0.0
13 - @executor-js/plugin-toolkits@2.0.0
14 - @executor-js/sdk@2.0.0
15
16## 0.0.193## 0.0.19
17 4
18### Patch Changes5### Patch Changes
e2e/package.json+1−1
@@ -1,6 +1,6 @@
1{1{
2 "name": "@executor-js/e2e",2 "name": "@executor-js/e2e",
3 "version": "0.0.20",3 "version": "0.0.19",
4 "private": true,4 "private": true,
5 "type": "module",5 "type": "module",
6 "scripts": {6 "scripts": {
examples/all-plugins/CHANGELOG.md+0−15
@@ -1,20 +1,5 @@
1# @executor-js/example-all-plugins1# @executor-js/example-all-plugins
2 2
3## 0.0.41
4
5### Patch Changes
6
7- Updated dependencies [[`cc94666`](https://github.com/RhysSullivan/executor/commit/cc94666fa6adf5a0c7ceb667b3797334020327b1)]:
8 - @executor-js/plugin-graphql@2.0.0
9 - @executor-js/plugin-google@2.0.0
10 - @executor-js/plugin-mcp@2.0.0
11 - @executor-js/plugin-onepassword@2.0.0
12 - @executor-js/plugin-openapi@2.0.0
13 - @executor-js/plugin-workos-vault@0.0.2
14 - @executor-js/sdk@2.0.0
15 - @executor-js/plugin-file-secrets@2.0.0
16 - @executor-js/plugin-keychain@2.0.0
17
18## 0.0.403## 0.0.40
19 4
20### Patch Changes5### Patch Changes
examples/all-plugins/package.json+1−1
@@ -1,6 +1,6 @@
1{1{
2 "name": "@executor-js/example-all-plugins",2 "name": "@executor-js/example-all-plugins",
3 "version": "0.0.41",3 "version": "0.0.40",
4 "private": true,4 "private": true,
5 "type": "module",5 "type": "module",
6 "scripts": {6 "scripts": {
examples/docs-sdk-quickstart/CHANGELOG.md+0−8
@@ -1,13 +1,5 @@
1# @executor-js/example-docs-sdk-quickstart1# @executor-js/example-docs-sdk-quickstart
2 2
3## 0.0.26
4
5### Patch Changes
6
7- Updated dependencies []:
8 - @executor-js/plugin-openapi@2.0.0
9 - @executor-js/sdk@2.0.0
10
11## 0.0.253## 0.0.25
12 4
13### Patch Changes5### Patch Changes
examples/docs-sdk-quickstart/package.json+1−1
@@ -1,6 +1,6 @@
1{1{
2 "name": "@executor-js/example-docs-sdk-quickstart",2 "name": "@executor-js/example-docs-sdk-quickstart",
3 "version": "0.0.26",3 "version": "0.0.25",
4 "private": true,4 "private": true,
5 "type": "module",5 "type": "module",
6 "scripts": {6 "scripts": {
packages/core/api/CHANGELOG.md+0−22
@@ -1,27 +1,5 @@
1# @executor-js/api1# @executor-js/api
2 2
3## 1.5.0
4
5### Minor Changes
6
7- [#1182](https://github.com/RhysSullivan/executor/pull/1182) [`b6c8968`](https://github.com/RhysSullivan/executor/commit/b6c8968c2a3dd3cf8d8b2fa5ecdbd2a1f9cad4f2) Thanks [@RhysSullivan](https://github.com/RhysSullivan)! - Notify when a newer Executor is published. The CLI now prints an "update available" line under its ready banner, and the web shell's sidebar update card works for real (a new `/v1/app/npm/dist-tags` endpoint backs it). In the desktop app the card shows a native "Restart to update" action wired to the in-app updater instead of the npm command. The check is best-effort and offline-safe, and can be disabled with `EXECUTOR_DISABLE_UPDATE_CHECK`.
8
9### Patch Changes
10
11- [#1197](https://github.com/RhysSullivan/executor/pull/1197) [`fd29abe`](https://github.com/RhysSullivan/executor/commit/fd29abe23a329e8e8c50ce185bfc23f58a5348d0) Thanks [@RhysSullivan](https://github.com/RhysSullivan)! - Fix OAuth "Mismatching redirect URI" for org-scoped client-id metadata documents
12
13 Org-scoped client-id metadata documents registered their callback as
14 `redirect_uri` with an `executor_org` query param, but the client always sends
15 the bare callback and the org is carried in the OAuth `state`. Providers that
16 compare `redirect_uri` as an exact string (such as PostHog) rejected the
17 authorize request. Org targets now keep their distinct `client_id` URL but
18 register the same bare callback `redirect_uri` as every other target.
19
20- Updated dependencies []:
21 - @executor-js/sdk@2.0.0
22 - @executor-js/execution@2.0.0
23 - @executor-js/host-mcp@1.4.4
24
25## 1.4.423## 1.4.42
26 4
27### Patch Changes5### Patch Changes
packages/core/api/package.json+1−1
@@ -1,6 +1,6 @@
1{1{
2 "name": "@executor-js/api",2 "name": "@executor-js/api",
3 "version": "1.5.0",3 "version": "1.4.42",
4 "private": true,4 "private": true,
5 "type": "module",5 "type": "module",
6 "exports": {6 "exports": {
packages/core/cli/CHANGELOG.md+0−7
@@ -1,12 +1,5 @@
1# @executor-js/cli1# @executor-js/cli
2 2
3## 0.2.29
4
5### Patch Changes
6
7- Updated dependencies []:
8 - @executor-js/sdk@2.0.0
9
10## 0.2.283## 0.2.28
11 4
12### Patch Changes5### Patch Changes
packages/core/cli/package.json+1−1
@@ -1,6 +1,6 @@
1{1{
2 "name": "@executor-js/cli",2 "name": "@executor-js/cli",
3 "version": "0.2.29",3 "version": "0.2.28",
4 "description": "CLI for the executor SDK — schema generation, migrations",4 "description": "CLI for the executor SDK — schema generation, migrations",
5 "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/core/cli",5 "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/core/cli",
6 "bugs": {6 "bugs": {
packages/core/config/CHANGELOG.md+0−7
@@ -1,12 +1,5 @@
1# @executor-js/config1# @executor-js/config
2 2
3## 2.0.0
4
5### Patch Changes
6
7- Updated dependencies []:
8 - @executor-js/sdk@2.0.0
9
10## 1.5.223## 1.5.22
11 4
12### Patch Changes5### Patch Changes
packages/core/config/package.json+1−1
@@ -1,6 +1,6 @@
1{1{
2 "name": "@executor-js/config",2 "name": "@executor-js/config",
3 "version": "2.0.0",3 "version": "1.5.22",
4 "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/core/config",4 "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/core/config",
5 "bugs": {5 "bugs": {
6 "url": "https://github.com/RhysSullivan/executor/issues"6 "url": "https://github.com/RhysSullivan/executor/issues"
packages/core/execution/CHANGELOG.md+0−8
@@ -1,13 +1,5 @@
1# @executor-js/execution1# @executor-js/execution
2 2
3## 2.0.0
4
5### Patch Changes
6
7- Updated dependencies []:
8 - @executor-js/sdk@2.0.0
9 - @executor-js/codemode-core@2.0.0
10
11## 1.5.223## 1.5.22
12 4
13### Patch Changes5### Patch Changes
packages/core/execution/package.json+1−1
@@ -1,6 +1,6 @@
1{1{
2 "name": "@executor-js/execution",2 "name": "@executor-js/execution",
3 "version": "2.0.0",3 "version": "1.5.22",
4 "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/core/execution",4 "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/core/execution",
5 "bugs": {5 "bugs": {
6 "url": "https://github.com/RhysSullivan/executor/issues"6 "url": "https://github.com/RhysSullivan/executor/issues"
packages/core/sdk/CHANGELOG.md+0−2
@@ -1,7 +1,5 @@
1# @executor-js/sdk1# @executor-js/sdk
2 2
3## 2.0.0
4
5## 1.5.223## 1.5.22
6 4
7## 1.5.215## 1.5.21
packages/core/sdk/package.json+1−1
@@ -1,6 +1,6 @@
1{1{
2 "name": "@executor-js/sdk",2 "name": "@executor-js/sdk",
3 "version": "2.0.0",3 "version": "1.5.22",
4 "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/core/sdk",4 "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/core/sdk",
5 "bugs": {5 "bugs": {
6 "url": "https://github.com/RhysSullivan/executor/issues"6 "url": "https://github.com/RhysSullivan/executor/issues"
packages/core/vite-plugin/CHANGELOG.md+0−7
@@ -1,12 +1,5 @@
1# @executor-js/vite-plugin1# @executor-js/vite-plugin
2 2
3## 0.0.40
4
5### Patch Changes
6
7- Updated dependencies []:
8 - @executor-js/sdk@2.0.0
9
10## 0.0.393## 0.0.39
11 4
12### Patch Changes5### Patch Changes
packages/core/vite-plugin/package.json+1−1
@@ -1,6 +1,6 @@
1{1{
2 "name": "@executor-js/vite-plugin",2 "name": "@executor-js/vite-plugin",
3 "version": "0.0.40",3 "version": "0.0.39",
4 "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/core/vite-plugin",4 "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/core/vite-plugin",
5 "bugs": {5 "bugs": {
6 "url": "https://github.com/RhysSullivan/executor/issues"6 "url": "https://github.com/RhysSullivan/executor/issues"
packages/hosts/cloudflare/CHANGELOG.md+0−10
@@ -1,15 +1,5 @@
1# @executor-js/cloudflare1# @executor-js/cloudflare
2 2
3## 0.0.22
4
5### Patch Changes
6
7- Updated dependencies [[`fd29abe`](https://github.com/RhysSullivan/executor/commit/fd29abe23a329e8e8c50ce185bfc23f58a5348d0), [`b6c8968`](https://github.com/RhysSullivan/executor/commit/b6c8968c2a3dd3cf8d8b2fa5ecdbd2a1f9cad4f2)]:
8 - @executor-js/api@1.5.0
9 - @executor-js/sdk@2.0.0
10 - @executor-js/execution@2.0.0
11 - @executor-js/host-mcp@1.4.4
12
13## 0.0.213## 0.0.21
14 4
15### Patch Changes5### Patch Changes
packages/hosts/cloudflare/package.json+1−1
@@ -1,6 +1,6 @@
1{1{
2 "name": "@executor-js/cloudflare",2 "name": "@executor-js/cloudflare",
3 "version": "0.0.22",3 "version": "0.0.21",
4 "private": true,4 "private": true,
5 "type": "module",5 "type": "module",
6 "exports": {6 "exports": {
packages/kernel/core/CHANGELOG.md+0−2
@@ -1,7 +1,5 @@
1# @executor-js/codemode-core1# @executor-js/codemode-core
2 2
3## 2.0.0
4
5## 1.5.223## 1.5.22
6 4
7## 1.5.215## 1.5.21
packages/kernel/core/package.json+1−1
@@ -1,6 +1,6 @@
1{1{
2 "name": "@executor-js/codemode-core",2 "name": "@executor-js/codemode-core",
3 "version": "2.0.0",3 "version": "1.5.22",
4 "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/kernel/core",4 "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/kernel/core",
5 "bugs": {5 "bugs": {
6 "url": "https://github.com/RhysSullivan/executor/issues"6 "url": "https://github.com/RhysSullivan/executor/issues"
packages/kernel/runtime-quickjs/CHANGELOG.md+0−7
@@ -1,12 +1,5 @@
1# @executor-js/runtime-quickjs1# @executor-js/runtime-quickjs
2 2
3## 2.0.0
4
5### Patch Changes
6
7- Updated dependencies []:
8 - @executor-js/codemode-core@2.0.0
9
10## 1.5.223## 1.5.22
11 4
12### Patch Changes5### Patch Changes
packages/kernel/runtime-quickjs/package.json+1−1
@@ -1,6 +1,6 @@
1{1{
2 "name": "@executor-js/runtime-quickjs",2 "name": "@executor-js/runtime-quickjs",
3 "version": "2.0.0",3 "version": "1.5.22",
4 "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/kernel/runtime-quickjs",4 "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/kernel/runtime-quickjs",
5 "bugs": {5 "bugs": {
6 "url": "https://github.com/RhysSullivan/executor/issues"6 "url": "https://github.com/RhysSullivan/executor/issues"
packages/plugins/desktop-settings/CHANGELOG.md+0−7
@@ -1,12 +1,5 @@
1# @executor-js/plugin-desktop-settings1# @executor-js/plugin-desktop-settings
2 2
3## 2.0.0
4
5### Patch Changes
6
7- Updated dependencies []:
8 - @executor-js/sdk@2.0.0
9
10## 1.5.223## 1.5.22
11 4
12### Patch Changes5### Patch Changes
packages/plugins/desktop-settings/package.json+1−1
@@ -1,6 +1,6 @@
1{1{
2 "name": "@executor-js/plugin-desktop-settings",2 "name": "@executor-js/plugin-desktop-settings",
3 "version": "2.0.0",3 "version": "1.5.22",
4 "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/plugins/desktop-settings",4 "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/plugins/desktop-settings",
5 "bugs": {5 "bugs": {
6 "url": "https://github.com/RhysSullivan/executor/issues"6 "url": "https://github.com/RhysSullivan/executor/issues"
packages/plugins/encrypted-secrets/CHANGELOG.md+0−7
@@ -1,12 +1,5 @@
1# @executor-js/plugin-encrypted-secrets1# @executor-js/plugin-encrypted-secrets
2 2
3## 0.0.22
4
5### Patch Changes
6
7- Updated dependencies []:
8 - @executor-js/sdk@2.0.0
9
10## 0.0.213## 0.0.21
11 4
12### Patch Changes5### Patch Changes
packages/plugins/encrypted-secrets/package.json+1−1
@@ -1,6 +1,6 @@
1{1{
2 "name": "@executor-js/plugin-encrypted-secrets",2 "name": "@executor-js/plugin-encrypted-secrets",
3 "version": "0.0.22",3 "version": "0.0.21",
4 "private": true,4 "private": true,
5 "type": "module",5 "type": "module",
6 "exports": {6 "exports": {
packages/plugins/example/CHANGELOG.md+0−7
@@ -1,12 +1,5 @@
1# @executor-js/plugin-example1# @executor-js/plugin-example
2 2
3## 2.0.0
4
5### Patch Changes
6
7- Updated dependencies []:
8 - @executor-js/sdk@2.0.0
9
10## 1.5.223## 1.5.22
11 4
12### Patch Changes5### Patch Changes
packages/plugins/example/package.json+1−1
@@ -1,6 +1,6 @@
1{1{
2 "name": "@executor-js/plugin-example",2 "name": "@executor-js/plugin-example",
3 "version": "2.0.0",3 "version": "1.5.22",
4 "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/plugins/example",4 "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/plugins/example",
5 "bugs": {5 "bugs": {
6 "url": "https://github.com/RhysSullivan/executor/issues"6 "url": "https://github.com/RhysSullivan/executor/issues"
packages/plugins/file-secrets/CHANGELOG.md+0−7
@@ -1,12 +1,5 @@
1# @executor-js/plugin-file-secrets1# @executor-js/plugin-file-secrets
2 2
3## 2.0.0
4
5### Patch Changes
6
7- Updated dependencies []:
8 - @executor-js/sdk@2.0.0
9
10## 1.5.223## 1.5.22
11 4
12### Patch Changes5### Patch Changes
packages/plugins/file-secrets/package.json+1−1
@@ -1,6 +1,6 @@
1{1{
2 "name": "@executor-js/plugin-file-secrets",2 "name": "@executor-js/plugin-file-secrets",
3 "version": "2.0.0",3 "version": "1.5.22",
4 "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/plugins/file-secrets",4 "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/plugins/file-secrets",
5 "bugs": {5 "bugs": {
6 "url": "https://github.com/RhysSullivan/executor/issues"6 "url": "https://github.com/RhysSullivan/executor/issues"
packages/plugins/google/CHANGELOG.md+0−10
@@ -1,15 +1,5 @@
1# @executor-js/plugin-google1# @executor-js/plugin-google
2 2
3## 2.0.0
4
5### Patch Changes
6
7- Updated dependencies [[`fd29abe`](https://github.com/RhysSullivan/executor/commit/fd29abe23a329e8e8c50ce185bfc23f58a5348d0), [`b6c8968`](https://github.com/RhysSullivan/executor/commit/b6c8968c2a3dd3cf8d8b2fa5ecdbd2a1f9cad4f2)]:
8 - @executor-js/api@1.5.0
9 - @executor-js/react@1.5.0
10 - @executor-js/plugin-openapi@2.0.0
11 - @executor-js/sdk@2.0.0
12
13## 1.5.213## 1.5.21
14 4
15### Patch Changes5### Patch Changes
packages/plugins/google/package.json+1−1
@@ -1,6 +1,6 @@
1{1{
2 "name": "@executor-js/plugin-google",2 "name": "@executor-js/plugin-google",
3 "version": "2.0.0",3 "version": "1.5.21",
4 "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/plugins/google",4 "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/plugins/google",
5 "bugs": {5 "bugs": {
6 "url": "https://github.com/RhysSullivan/executor/issues"6 "url": "https://github.com/RhysSullivan/executor/issues"
packages/plugins/graphql/CHANGELOG.md+0−16
@@ -1,21 +1,5 @@
1# @executor-js/plugin-graphql1# @executor-js/plugin-graphql
2 2
3## 2.0.0
4
5### Patch Changes
6
7- [#1173](https://github.com/RhysSullivan/executor/pull/1173) [`cc94666`](https://github.com/RhysSullivan/executor/commit/cc94666fa6adf5a0c7ceb667b3797334020327b1) Thanks [@RhysSullivan](https://github.com/RhysSullivan)! - Fix the GraphQL plugin generating invalid operations against large schemas, and make field selection caller-controlled instead of a baked-in guess.
8
9 Previously each tool froze a recursive, depth- and count-bounded selection at sync time. Against a rich schema (GitLab) this produced invalid GraphQL (composite fields with no sub-selection, nested fields missing required arguments) so every call over a rich return type failed, and the arbitrary bound silently truncated which fields came back.
10
11 Generated tools now default to selecting only scalar/enum leaf fields of the return type (always valid, always within a server's query-complexity budget), and expose an optional `select` input carrying a GraphQL selection set so a caller can request nested or list data per call (including supplying nested required arguments). Fixes [#1146](https://github.com/RhysSullivan/executor/issues/1146).
12
13- Updated dependencies [[`fd29abe`](https://github.com/RhysSullivan/executor/commit/fd29abe23a329e8e8c50ce185bfc23f58a5348d0), [`b6c8968`](https://github.com/RhysSullivan/executor/commit/b6c8968c2a3dd3cf8d8b2fa5ecdbd2a1f9cad4f2)]:
14 - @executor-js/api@1.5.0
15 - @executor-js/react@1.5.0
16 - @executor-js/sdk@2.0.0
17 - @executor-js/config@2.0.0
18
19## 1.5.223## 1.5.22
20 4
21### Patch Changes5### Patch Changes
packages/plugins/graphql/package.json+1−1
@@ -1,6 +1,6 @@
1{1{
2 "name": "@executor-js/plugin-graphql",2 "name": "@executor-js/plugin-graphql",
3 "version": "2.0.0",3 "version": "1.5.22",
4 "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/plugins/graphql",4 "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/plugins/graphql",
5 "bugs": {5 "bugs": {
6 "url": "https://github.com/RhysSullivan/executor/issues"6 "url": "https://github.com/RhysSullivan/executor/issues"
packages/plugins/keychain/CHANGELOG.md+0−7
@@ -1,12 +1,5 @@
1# @executor-js/plugin-keychain1# @executor-js/plugin-keychain
2 2
3## 2.0.0
4
5### Patch Changes
6
7- Updated dependencies []:
8 - @executor-js/sdk@2.0.0
9
10## 1.5.223## 1.5.22
11 4
12### Patch Changes5### Patch Changes
packages/plugins/keychain/package.json+1−1
@@ -1,6 +1,6 @@
1{1{
2 "name": "@executor-js/plugin-keychain",2 "name": "@executor-js/plugin-keychain",
3 "version": "2.0.0",3 "version": "1.5.22",
4 "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/plugins/keychain",4 "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/plugins/keychain",
5 "bugs": {5 "bugs": {
6 "url": "https://github.com/RhysSullivan/executor/issues"6 "url": "https://github.com/RhysSullivan/executor/issues"
packages/plugins/mcp/CHANGELOG.md+0−10
@@ -1,15 +1,5 @@
1# @executor-js/plugin-mcp1# @executor-js/plugin-mcp
2 2
3## 2.0.0
4
5### Patch Changes
6
7- Updated dependencies [[`fd29abe`](https://github.com/RhysSullivan/executor/commit/fd29abe23a329e8e8c50ce185bfc23f58a5348d0), [`b6c8968`](https://github.com/RhysSullivan/executor/commit/b6c8968c2a3dd3cf8d8b2fa5ecdbd2a1f9cad4f2)]:
8 - @executor-js/api@1.5.0
9 - @executor-js/react@1.5.0
10 - @executor-js/sdk@2.0.0
11 - @executor-js/config@2.0.0
12
13## 1.5.223## 1.5.22
14 4
15### Patch Changes5### Patch Changes
packages/plugins/mcp/package.json+1−1
@@ -1,6 +1,6 @@
1{1{
2 "name": "@executor-js/plugin-mcp",2 "name": "@executor-js/plugin-mcp",
3 "version": "2.0.0",3 "version": "1.5.22",
4 "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/plugins/mcp",4 "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/plugins/mcp",
5 "bugs": {5 "bugs": {
6 "url": "https://github.com/RhysSullivan/executor/issues"6 "url": "https://github.com/RhysSullivan/executor/issues"
packages/plugins/microsoft/CHANGELOG.md+0−10
@@ -1,15 +1,5 @@
1# @executor-js/plugin-microsoft1# @executor-js/plugin-microsoft
2 2
3## 2.0.0
4
5### Patch Changes
6
7- Updated dependencies [[`fd29abe`](https://github.com/RhysSullivan/executor/commit/fd29abe23a329e8e8c50ce185bfc23f58a5348d0), [`b6c8968`](https://github.com/RhysSullivan/executor/commit/b6c8968c2a3dd3cf8d8b2fa5ecdbd2a1f9cad4f2)]:
8 - @executor-js/api@1.5.0
9 - @executor-js/react@1.5.0
10 - @executor-js/plugin-openapi@2.0.0
11 - @executor-js/sdk@2.0.0
12
13## 1.5.213## 1.5.21
14 4
15### Patch Changes5### Patch Changes
packages/plugins/microsoft/package.json+1−1
@@ -1,6 +1,6 @@
1{1{
2 "name": "@executor-js/plugin-microsoft",2 "name": "@executor-js/plugin-microsoft",
3 "version": "2.0.0",3 "version": "1.5.21",
4 "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/plugins/microsoft",4 "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/plugins/microsoft",
5 "bugs": {5 "bugs": {
6 "url": "https://github.com/RhysSullivan/executor/issues"6 "url": "https://github.com/RhysSullivan/executor/issues"
packages/plugins/onepassword/CHANGELOG.md+0−9
@@ -1,14 +1,5 @@
1# @executor-js/plugin-onepassword1# @executor-js/plugin-onepassword
2 2
3## 2.0.0
4
5### Patch Changes
6
7- Updated dependencies [[`fd29abe`](https://github.com/RhysSullivan/executor/commit/fd29abe23a329e8e8c50ce185bfc23f58a5348d0), [`b6c8968`](https://github.com/RhysSullivan/executor/commit/b6c8968c2a3dd3cf8d8b2fa5ecdbd2a1f9cad4f2)]:
8 - @executor-js/api@1.5.0
9 - @executor-js/react@1.5.0
10 - @executor-js/sdk@2.0.0
11
12## 1.5.223## 1.5.22
13 4
14### Patch Changes5### Patch Changes
packages/plugins/onepassword/package.json+1−1
@@ -1,6 +1,6 @@
1{1{
2 "name": "@executor-js/plugin-onepassword",2 "name": "@executor-js/plugin-onepassword",
3 "version": "2.0.0",3 "version": "1.5.22",
4 "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/plugins/onepassword",4 "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/plugins/onepassword",
5 "bugs": {5 "bugs": {
6 "url": "https://github.com/RhysSullivan/executor/issues"6 "url": "https://github.com/RhysSullivan/executor/issues"
packages/plugins/openapi/CHANGELOG.md+0−10
@@ -1,15 +1,5 @@
1# @executor-js/plugin-openapi1# @executor-js/plugin-openapi
2 2
3## 2.0.0
4
5### Patch Changes
6
7- Updated dependencies [[`fd29abe`](https://github.com/RhysSullivan/executor/commit/fd29abe23a329e8e8c50ce185bfc23f58a5348d0), [`b6c8968`](https://github.com/RhysSullivan/executor/commit/b6c8968c2a3dd3cf8d8b2fa5ecdbd2a1f9cad4f2)]:
8 - @executor-js/api@1.5.0
9 - @executor-js/react@1.5.0
10 - @executor-js/sdk@2.0.0
11 - @executor-js/config@2.0.0
12
13## 1.5.223## 1.5.22
14 4
15### Patch Changes5### Patch Changes
packages/plugins/openapi/package.json+1−1
@@ -1,6 +1,6 @@
1{1{
2 "name": "@executor-js/plugin-openapi",2 "name": "@executor-js/plugin-openapi",
3 "version": "2.0.0",3 "version": "1.5.22",
4 "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/plugins/openapi",4 "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/plugins/openapi",
5 "bugs": {5 "bugs": {
6 "url": "https://github.com/RhysSullivan/executor/issues"6 "url": "https://github.com/RhysSullivan/executor/issues"
packages/plugins/toolkits/CHANGELOG.md+0−9
@@ -1,14 +1,5 @@
1# @executor-js/plugin-toolkits1# @executor-js/plugin-toolkits
2 2
3## 2.0.0
4
5### Patch Changes
6
7- Updated dependencies [[`fd29abe`](https://github.com/RhysSullivan/executor/commit/fd29abe23a329e8e8c50ce185bfc23f58a5348d0), [`b6c8968`](https://github.com/RhysSullivan/executor/commit/b6c8968c2a3dd3cf8d8b2fa5ecdbd2a1f9cad4f2)]:
8 - @executor-js/api@1.5.0
9 - @executor-js/react@1.5.0
10 - @executor-js/sdk@2.0.0
11
12## 1.5.143## 1.5.14
13 4
14### Patch Changes5### Patch Changes
packages/plugins/toolkits/package.json+1−1
@@ -1,6 +1,6 @@
1{1{
2 "name": "@executor-js/plugin-toolkits",2 "name": "@executor-js/plugin-toolkits",
3 "version": "2.0.0",3 "version": "1.5.14",
4 "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/plugins/toolkits",4 "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/plugins/toolkits",
5 "bugs": {5 "bugs": {
6 "url": "https://github.com/RhysSullivan/executor/issues"6 "url": "https://github.com/RhysSullivan/executor/issues"
packages/react/CHANGELOG.md+0−12
@@ -1,17 +1,5 @@
1# @executor-js/react1# @executor-js/react
2 2
3## 1.5.0
4
5### Minor Changes
6
7- [#1182](https://github.com/RhysSullivan/executor/pull/1182) [`b6c8968`](https://github.com/RhysSullivan/executor/commit/b6c8968c2a3dd3cf8d8b2fa5ecdbd2a1f9cad4f2) Thanks [@RhysSullivan](https://github.com/RhysSullivan)! - Notify when a newer Executor is published. The CLI now prints an "update available" line under its ready banner, and the web shell's sidebar update card works for real (a new `/v1/app/npm/dist-tags` endpoint backs it). In the desktop app the card shows a native "Restart to update" action wired to the in-app updater instead of the npm command. The check is best-effort and offline-safe, and can be disabled with `EXECUTOR_DISABLE_UPDATE_CHECK`.
8
9### Patch Changes
10
11- Updated dependencies [[`fd29abe`](https://github.com/RhysSullivan/executor/commit/fd29abe23a329e8e8c50ce185bfc23f58a5348d0), [`b6c8968`](https://github.com/RhysSullivan/executor/commit/b6c8968c2a3dd3cf8d8b2fa5ecdbd2a1f9cad4f2)]:
12 - @executor-js/api@1.5.0
13 - @executor-js/sdk@2.0.0
14
15## 1.4.423## 1.4.42
16 4
17### Patch Changes5### Patch Changes
packages/react/package.json+1−1
@@ -1,6 +1,6 @@
1{1{
2 "name": "@executor-js/react",2 "name": "@executor-js/react",
3 "version": "1.5.0",3 "version": "1.4.42",
4 "private": true,4 "private": true,
5 "type": "module",5 "type": "module",
6 "exports": {6 "exports": {
vision.md+29−30
@@ -19,7 +19,7 @@ it safely. · 18 unmodified lines
19 19
20The bet: as work shifts toward agents acting through software, every company needs one layer20The bet: as work shifts toward agents acting through software, every company needs one layer
21where anything a human could do is callable — auditable, across every account — and where new21where anything a human could do is callable — auditable, across every account — and where new
22capability is _composed_ on a shared substrate, not rebuilt per integration. One primitive22capability is *composed* on a shared substrate, not rebuilt per integration. One primitive
23unlocks the whole slice: catalog + auth + tools + scoping + UI + workflows + storage.23unlocks the whole slice: catalog + auth + tools + scoping + UI + workflows + storage.
24 24
25It runs the same two ways from one codebase: an **in-process SDK** (no server, single-player,25It runs the same two ways from one codebase: an **in-process SDK** (no server, single-player,
@@ -40,12 +40,12 @@ multiplayer must be powerful; neither carries the other's weight. · 14 unmodified lines
40- **Secret** — never lives in Executor and never reaches the agent. A connection holds a40- **Secret** — never lives in Executor and never reaches the agent. A connection holds a
41 `SecretRef` (a pointer — `op://`, `keychain://`, `env://`, `vault://`); a provider resolves it41 `SecretRef` (a pointer — `op://`, `keychain://`, `env://`, `vault://`); a provider resolves it
42 at call time, in trusted space, behind a proxy.42 at call time, in trusted space, behind a proxy.
43- **Scope** — placement and identity. An ordered, merged set (see _Scopes_). Every record is43- **Scope** — placement and identity. An ordered, merged set (see *Scopes*). Every record is
44 placed in a scope.44 placed in a scope.
45- **Policy** — gates execution (allow / require-approval / block). Attached to sources and45- **Policy** — gates execution (allow / require-approval / block). Attached to sources and
46 connections (see _Policies_).46 connections (see *Policies*).
47- **Plugin** — registers sources, tools, providers, storage, surfaces. The one open extension47- **Plugin** — registers sources, tools, providers, storage, surfaces. The one open extension
48 seam (see _The model_).48 seam (see *The model*).
49- **Manager / Invoker** — the core runtime roles: a manager owns a source's tools and config; an49- **Manager / Invoker** — the core runtime roles: a manager owns a source's tools and config; an
50 invoker executes a tool through the right connection and proxy.50 invoker executes a tool through the right connection and proxy.
51 51
@@ -58,10 +58,10 @@ extension seam**, and **surfaces** that expose it. · 6 unmodified lines
58**connections**; **scopes**; **policies/guardrails**; and `scope()` — narrow the executor to a58**connections**; **scopes**; **policies/guardrails**; and `scope()` — narrow the executor to a
59subset, the seam everything composes through.59subset, the seam everything composes through.
60 60
61**First-party capabilities** are a fixed, known set, included or omitted as modules — _not_ a61**First-party capabilities** are a fixed, known set, included or omitted as modules — *not* a
62generic plugin registry: toolkits, the MCP host, generative UI, workflows, storage, skills,62generic plugin registry: toolkits, the MCP host, generative UI, workflows, storage, skills,
63audit/runs, the internal-apps catalog. They're separable but they don't go through an abstract63audit/runs, the internal-apps catalog. They're separable but they don't go through an abstract
64plugin contract, because nobody outside you needs to add a new _kind_ of them.64plugin contract, because nobody outside you needs to add a new *kind* of them.
65 65
66**One open plugin seam: sources.** There are thousands of APIs; you'll never enumerate them; you66**One open plugin seam: sources.** There are thousands of APIs; you'll never enumerate them; you
67want others to add them. That is where an open contract (`resolveTools` / `invokeTool`) earns its67want others to add them. That is where an open contract (`resolveTools` / `invokeTool`) earns its
@@ -83,17 +83,17 @@ coordinates, not bespoke subsystems — this is what keeps the breadth tractable · 15 unmodified lines
83- **lifetime** — ephemeral (a turn/session) / durable (deployed, addressable, re-openable)83- **lifetime** — ephemeral (a turn/session) / durable (deployed, addressable, re-openable)
84- **origin** — imported (a spec) / authored (code) / invoked-inline (produced by a call)84- **origin** — imported (a spec) / authored (code) / invoked-inline (produced by a call)
85- **surface** — in-process / MCP / HTTP / CLI / trigger / web85- **surface** — in-process / MCP / HTTP / CLI / trigger / web
86- **delivery** — inline value / handle / embedded resource / deep link _(negotiated by client86- **delivery** — inline value / handle / embedded resource / deep link *(negotiated by client
87 capability)_87 capability)*
88 88
89Two rules fall out and dissolve most "how does X compose" confusion:89Two rules fall out and dissolve most "how does X compose" confusion:
90 90
911. **Artifacts vs surfaces.** What you _build_ (kind) is separate from how it's _reached_911. **Artifacts vs surfaces.** What you *build* (kind) is separate from how it's *reached*
92 (surface). Build once; a surface projects it. A workflow defined once is reachable via cron,92 (surface). Build once; a surface projects it. A workflow defined once is reachable via cron,
93 MCP, or in-process. A view defined once renders standalone or returns over MCP. Not everything93 MCP, or in-process. A view defined once renders standalone or returns over MCP. Not everything
94 fits every surface (a workflow isn't a slow tool; a UI isn't an HTTP handler).94 fits every surface (a workflow isn't a slow tool; a UI isn't an HTTP handler).
952. **Rich outputs negotiate delivery.** Too big or too rich for the channel → return a952. **Rich outputs negotiate delivery.** Too big or too rich for the channel → return a
96 _reference_ the client resolves per its capability. A large result → a **storage handle**. A96 *reference* the client resolves per its capability. A large result → a **storage handle**. A
97 UI → an **embedded UI resource** if the client renders it (MCP apps), else a **deep link**97 UI → an **embedded UI resource** if the client renders it (MCP apps), else a **deep link**
98 into the web app. UI is not special; it's a rich output under the same rules as everything.98 into the web app. UI is not special; it's a rich output under the same rules as everything.
99 99
@@ -105,25 +105,24 @@ policies per scope; and create temporary scopes. Single-player is one scope; mul · 5 unmodified lines
105same model with more entries.105same model with more entries.
106 106
107Three fixed merge rules, nothing configurable:107Three fixed merge rules, nothing configurable:
108
109- **visibility = union** (you see everything placed in any scope you hold);108- **visibility = union** (you see everything placed in any scope you hold);
110- **guardrails/policy = deny-union, outer-wins** (an outer scope's `block` can't be weakened109- **guardrails/policy = deny-union, outer-wins** (an outer scope's `block` can't be weakened
111 inward; mandatory flows in);110 inward; mandatory flows in);
112- **scalars/config/secret-overrides = innermost-wins** (the nearest scope to the actor wins).111- **scalars/config/secret-overrides = innermost-wins** (the nearest scope to the actor wins).
113 112
114`org | user` is just the **two-element case** of this. The current codebase collapsed scopes to113`org | user` is just the **two-element case** of this. The current codebase collapsed scopes to
115fixed org/user; the direction is to model it as an _ordered list that today has two entries_, so114fixed org/user; the direction is to model it as an *ordered list that today has two entries*, so
116the resolver is already the general one and inserting a "team" or "environment" level later is115the resolver is already the general one and inserting a "team" or "environment" level later is
117additive, not a rewrite — added demand-driven, only when a real case needs the middle level.116additive, not a rewrite — added demand-driven, only when a real case needs the middle level.
118 117
119**Why scopes are a dimension, not indirection.** A past mistake (the credential-binding model:118**Why scopes are a dimension, not indirection.** A past mistake (the credential-binding model:
120credential / slot / binding as separate objects wired together) caused an overcorrection that119credential / slot / binding as separate objects wired together) caused an overcorrection that
121flattened scopes along with killing bindings. The lesson: **fuse indirection, keep dimensions.**120flattened scopes along with killing bindings. The lesson: **fuse indirection, keep dimensions.**
122A binding is a layer whose only job is to _connect_ two things — fuse it away (born-wired121A binding is a layer whose only job is to *connect* two things — fuse it away (born-wired
123connections did this). A scope is a property that varies independently and meaningfully — keep122connections did this). A scope is a property that varies independently and meaningfully — keep
124it; flatten it and it leaks back as workarounds. Placement stays a **direct, inline property** on123it; flatten it and it leaks back as workarounds. Placement stays a **direct, inline property** on
125each record (the way `scope` already sits on a connection); never reintroduce an object whose job124each record (the way `scope` already sits on a connection); never reintroduce an object whose job
126is to _attach_ a record to a scope.125is to *attach* a record to a scope.
127 126
128## Connections, secrets & auth127## Connections, secrets & auth
129 128
@@ -132,7 +131,7 @@ is to _attach_ a record to a scope. · 2 unmodified lines
132- **Multiple accounts per source per scope** (distinct names). Per-member auth (each connects131- **Multiple accounts per source per scope** (distinct names). Per-member auth (each connects
133 their own) and team-level shared auth (one credential placed in an outer scope) are both just132 their own) and team-level shared auth (one credential placed in an outer scope) are both just
134 placement.133 placement.
135- **Auth template vs credential.** A source declares _how_ it authenticates (OAuth / bearer /134- **Auth template vs credential.** A source declares *how* it authenticates (OAuth / bearer /
136 API key — a discriminated set); each connection fills that template.135 API key — a discriminated set); each connection fills that template.
137- **Secrets never reach the agent.** Resolved by a provider at call time, in trusted space,136- **Secrets never reach the agent.** Resolved by a provider at call time, in trusted space,
138 behind a **tool-proxy** — credentials never enter agent or sandbox code. **No escape hatch:** a137 behind a **tool-proxy** — credentials never enter agent or sandbox code. **No escape hatch:** a
@@ -148,18 +147,18 @@ Each kind is added through the **one open seam** (`resolveTools` + `invokeTool`) · 9 unmodified lines
148later **direct database** and **email**. The plugin owns the opaque config and raw spec; the core147later **direct database** and **email**. The plugin owns the opaque config and raw spec; the core
149reasons over a **normalized manifest** (schemas, side-effect class, auth template, data labels,148reasons over a **normalized manifest** (schemas, side-effect class, auth template, data labels,
150required capabilities, an LLM-authored description). **Spec auto-refresh** tracks upstream drift149required capabilities, an LLM-authored description). **Spec auto-refresh** tracks upstream drift
151and **must never auto-expand authority** — new operations appear _ungranted until reviewed_.150and **must never auto-expand authority** — new operations appear *ungranted until reviewed*.
152 151
153An **integrations registry** lets people discover and add sources.152An **integrations registry** lets people discover and add sources.
154 153
155## Policies154## Policies
156 155
157Policies gate **execution** — `approve` / `require_approval` / `block` — and are distinct from156Policies gate **execution** — `approve` / `require_approval` / `block` — and are distinct from
158toolkits (which gate visibility). Resolution is _most-restrictive-wins_; **plugin defaults** let157toolkits (which gate visibility). Resolution is *most-restrictive-wins*; **plugin defaults** let
159a source ship a tool pre-marked `require_approval` (destructive detection), with `approve` as the158a source ship a tool pre-marked `require_approval` (destructive detection), with `approve` as the
160override when an import wrongly flags a safe action.159override when an import wrongly flags a safe action.
161 160
162How people actually use them today (real usage): glob patterns over the address, where _every_161How people actually use them today (real usage): glob patterns over the address, where *every*
163rule targets a **source** and wildcards the scope/connection (`stripe_api.*.*.disputes.*`,162rule targets a **source** and wildcards the scope/connection (`stripe_api.*.*.disputes.*`,
164`pscale.*.*.execute_write_query`) — i.e. faking structural targeting because there's nowhere to163`pscale.*.*.execute_write_query`) — i.e. faking structural targeting because there's nowhere to
165attach it. The direction:164attach it. The direction:
@@ -167,7 +166,7 @@ attach it. The direction: · 1 unmodified line
167- **Kill the global glob list. Attach policy to the source and connection records** — the two166- **Kill the global glob list. Attach policy to the source and connection records** — the two
168 structural levels. **Connection overrides source** (innermost-wins), with **scope authority167 structural levels. **Connection overrides source** (innermost-wins), with **scope authority
169 layered on top** (outer/org mandatory, can't be weakened inward).168 layered on top** (outer/org mandatory, can't be weakened inward).
170- Fixing a mis-flagged tool becomes `approve` _on that source/connection_, directly.169- Fixing a mis-flagged tool becomes `approve` *on that source/connection*, directly.
171- **Toolkits carry no policy** — they're pure curation and inherit whatever source/connection170- **Toolkits carry no policy** — they're pure curation and inherit whatever source/connection
172 policies apply to the tools they expose. This dissolves the old global-vs-toolkit merge171 policies apply to the tools they expose. This dissolves the old global-vs-toolkit merge
173 conflict.172 conflict.
@@ -176,7 +175,7 @@ attach it. The direction: · 2 unmodified lines
176 175
177A **toolkit is pure curation** — a named subset of tools (a `ToolSet`) that yields a **scoped176A **toolkit is pure curation** — a named subset of tools (a `ToolSet`) that yields a **scoped
178view** of the executor. Used for **per-agent capability control**: lock down exactly what an177view** of the executor. Used for **per-agent capability control**: lock down exactly what an
179added agent can reach (a background firewall-monitor agent gets _only_ a monitor tool and an178added agent can reach (a background firewall-monitor agent gets *only* a monitor tool and an
180update-firewall tool, and nothing that builds). **`toolkits.list` feeds a consent screen** — the179update-firewall tool, and nothing that builds). **`toolkits.list` feeds a consent screen** — the
181grantable slices an agent or OAuth flow requests. Single-player keeps toolkits too.180grantable slices an agent or OAuth flow requests. Single-player keeps toolkits too.
182 181
@@ -199,7 +198,7 @@ no advisory mode — the local isolate and the cloud worker enforce the same mem · 16 unmodified lines
199You build once; surfaces project.198You build once; surfaces project.
200 199
201- **In-process** — `execute`, the SDK path. No server.200- **In-process** — `execute`, the SDK path. No server.
202- **MCP** — a scoped endpoint (`/mcp?toolkit=...`) over a _scoped executor_; the host201- **MCP** — a scoped endpoint (`/mcp?toolkit=...`) over a *scoped executor*; the host
203 authenticates → resolves the toolkit → `scope()` → hands the narrowed executor to the MCP202 authenticates → resolves the toolkit → `scope()` → hands the narrowed executor to the MCP
204 server, which never sees a toolkit. Default shape is **meta-tools** (`search` + `describe` +203 server, which never sees a toolkit. Default shape is **meta-tools** (`search` + `describe` +
205 `execute` + `run_code`) so a huge catalog doesn't blow context, with a direct-tools opt-out.204 `execute` + `run_code`) so a huge catalog doesn't blow context, with a direct-tools opt-out.
@@ -210,7 +209,7 @@ You build once; surfaces project. · 4 unmodified lines
210- **MCP channels** — talk back to the agent mid-tool-call (the "Claude Code over Discord"209- **MCP channels** — talk back to the agent mid-tool-call (the "Claude Code over Discord"
211 pattern), for human-in-the-loop and elicitation.210 pattern), for human-in-the-loop and elicitation.
212- **HTTP** — any capability projected as a route, after policy/auth/versioning/CORS.211- **HTTP** — any capability projected as a route, after policy/auth/versioning/CORS.
213- **CLI** — the same operations from the terminal (see _Distribution_).212- **CLI** — the same operations from the terminal (see *Distribution*).
214- **Triggers** — a schedule (cron) or an event that fires an artifact.213- **Triggers** — a schedule (cron) or an event that fires an artifact.
215- **Web app** — the UI-capable surface where views render and deep links land.214- **Web app** — the UI-capable surface where views render and deep links land.
216 215
@@ -222,13 +221,13 @@ You build once; surfaces project. · 5 unmodified lines
222 SDK** for everything added.221 SDK** for everything added.
223- **Workflows.** Multi-step sequences of tool calls with **durable run semantics**, built ideally222- **Workflows.** Multi-step sequences of tool calls with **durable run semantics**, built ideally
224 on `use workflow` (or Cloudflare Workflows). User-defined entry points; **cron + event223 on `use workflow` (or Cloudflare Workflows). User-defined entry points; **cron + event
225 triggers**; infrastructure-as-code. A step _is_ a catalog tool call.224 triggers**; infrastructure-as-code. A step *is* a catalog tool call.
226- **Generative UI.** A **view** governed by lifetime × delivery: ephemeral (the agent calls225- **Generative UI.** A **view** governed by lifetime × delivery: ephemeral (the agent calls
227 `render`) or durable (an authored dashboard). Rich UI runs in a sandbox; it calls only the226 `render`) or durable (an authored dashboard). Rich UI runs in a sandbox; it calls only the
228 tools its scope grants, proxied server-side, never holding credentials.227 tools its scope grants, proxied server-side, never holding credentials.
229- **Skills.** Shared, code-authored knowledge — the company knowledge base as code — that agents228- **Skills.** Shared, code-authored knowledge — the company knowledge base as code — that agents
230 draw on, that **surfaces in tool search**, and can **run tools inline** to cut round-trips.229 draw on, that **surfaces in tool search**, and can **run tools inline** to cut round-trips.
231 Served off MCP and from a `.well-known`. File-backed (see _Authoring model_).230 Served off MCP and from a `.well-known`. File-backed (see *Authoring model*).
232- **Internal apps catalog & custom UI snippets.** Store and share custom UI and internal apps.231- **Internal apps catalog & custom UI snippets.** Store and share custom UI and internal apps.
233- **Configure Executor via Executor** — managing sources, connections, scopes, policies,232- **Configure Executor via Executor** — managing sources, connections, scopes, policies,
234 toolkits is itself done through tools.233 toolkits is itself done through tools.
@@ -278,7 +277,7 @@ it**: audit log, human-in-the-loop approvals, workflow runs, and resumability/de · 43 unmodified lines
278 277
279Pause a call and require a human before it proceeds: **MCP elicitation**, a **gated `resume`278Pause a call and require a human before it proceeds: **MCP elicitation**, a **gated `resume`
280tool** (the user simply doesn't always allow it), a **resume URL**, or an **MCP channel**279tool** (the user simply doesn't always allow it), a **resume URL**, or an **MCP channel**
281talk-back mid-call. A gated call returns a _pending_ Run with a resume reference.280talk-back mid-call. A gated call returns a *pending* Run with a resume reference.
282 281
283## Sandbox & runtime282## Sandbox & runtime
284 283
@@ -292,7 +291,7 @@ whatever it needs; ship instructions (skills) as part of Executor. · 7 unmodified lines
292## Distribution, the CLI & remotes291## Distribution, the CLI & remotes
293 292
294The `executor` CLI is **three things at once**: the **local runtime** (run a full instance and293The `executor` CLI is **three things at once**: the **local runtime** (run a full instance and
295start using it), the **control plane** (local _and_ remote, same commands), and an294start using it), the **control plane** (local *and* remote, same commands), and an
296**agent-facing surface**. Distribution surfaces are all "local": `executor` (CLI), `executor295**agent-facing surface**. Distribution surfaces are all "local": `executor` (CLI), `executor
297service install` (daemon), `executor web` (web app) — one instance, delivered differently.296service install` (daemon), `executor web` (web app) — one instance, delivered differently.
298 297
@@ -326,7 +325,7 @@ Cloudflare Artifacts, local SQLite for hosted storage. · 27 unmodified lines
326 325
327## Architecture326## Architecture
328 327
329Built on **Effect**. The same SDK is in-memory _and_ client/server; SDK-only users need no328Built on **Effect**. The same SDK is in-memory *and* client/server; SDK-only users need no
330server; serving is a standard Web `Request → Response` handler. The discipline that keeps breadth329server; serving is a standard Web `Request → Response` handler. The discipline that keeps breadth
331cheap is the **seam discipline**: the platform owns generic concerns (auth, caching, retries,330cheap is the **seam discipline**: the platform owns generic concerns (auth, caching, retries,
332schema, rendering, transport, the Run); a plugin owns only the source-specific resolve/invoke.331schema, rendering, transport, the Run); a plugin owns only the source-specific resolve/invoke.
@@ -359,8 +358,8 @@ schema, rendering, transport, the Run); a plugin owns only the source-specific r · 26 unmodified lines
359 substrate-generic and source-specific code.358 substrate-generic and source-specific code.
360- **Vision mode vs build mode.** This document is vision mode — generativity ("and then you'd359- **Vision mode vs build mode.** This document is vision mode — generativity ("and then you'd
361 want X") is the point. In **build mode, every "and then you'd want X" is a YAGNI to defer**, not360 want X") is the point. In **build mode, every "and then you'd want X" is a YAGNI to defer**, not
362 a dependency to satisfy. Build the smallest thing useful on its own; let the next be _pulled_ by361 a dependency to satisfy. Build the smallest thing useful on its own; let the next be *pulled* by
363 real pain, not _pushed_ by imagined composition. The tell that you've slipped back to vision362 real pain, not *pushed* by imagined composition. The tell that you've slipped back to vision
364 mode: the next step needs two other things built first. (Example: v1 skills = read a folder,363 mode: the next step needs two other things built first. (Example: v1 skills = read a folder,
365 expose `skills.search` + `skills.get`. No scopes, toolkits, environments, or git required.)364 expose `skills.search` + `skills.get`. No scopes, toolkits, environments, or git required.)
366 365
@@ -369,7 +368,7 @@ schema, rendering, transport, the Run); a plugin owns only the source-specific r · 2 unmodified lines
369- **The shared-data loop.** "Every morning at 9am, load my GitHub issues into SQLite": a368- **The shared-data loop.** "Every morning at 9am, load my GitHub issues into SQLite": a
370 scheduled workflow writes to storage; a generative-UI front end reads it live; you chat with the369 scheduled workflow writes to storage; a generative-UI front end reads it live; you chat with the
371 agent over the same data. One substrate, three readers.370 agent over the same data. One substrate, three readers.
372- **The scoped agent.** "An agent I can message that can _only_ update my calendar." A toolkit371- **The scoped agent.** "An agent I can message that can *only* update my calendar." A toolkit
373 exposes a one-tool slice; the agent connects to a scoped MCP endpoint; it physically cannot372 exposes a one-tool slice; the agent connects to a scoped MCP endpoint; it physically cannot
374 reach anything else.373 reach anything else.
375 374