lael-labs/executor

apps/cloud/src/mcp/mount.test.ts+2−8

 import { describe, expect, it } from "@effect/vitest";
-import {
+import { protectedResourceMetadataUrlFor, resourceUrlFor, toolkitSlugFromRequest } from "./auth";
-  protectedResourceMetadataUrlFor,
-  resourceUrlFor,
-  toolkitSlugFromRequest,
-} from "./auth";
 import { classifyMcpPath, prepareMcpOrgScope } from "./mount";
 describe("cloud MCP toolkit route normalization", () => {
   it("builds toolkit-specific resource and metadata URLs", () => {
     expect(resourceUrlFor(null, "deploy")).toBe("https://executor.sh/mcp/toolkits/deploy");
-    expect(resourceUrlFor("acme", "deploy")).toBe(
+    expect(resourceUrlFor("acme", "deploy")).toBe("https://executor.sh/acme/mcp/toolkits/deploy");
-      "https://executor.sh/acme/mcp/toolkits/deploy",
-    );
     expect(protectedResourceMetadataUrlFor(null, "deploy")).toBe(
       "https://executor.sh/.well-known/oauth-protected-resource/mcp/toolkits/deploy",
     );

apps/cloud/src/mcp/mount.ts+2−8

     const organizationId = orgSelectorSegment(segments[0]);
     return organizationId ? { organizationId } : undefined;
   }
-  if (
+  if (segments.length === 4 && segments[1] === "mcp" && segments[2] === "toolkits") {
-    segments.length === 4 &&
-    segments[1] === "mcp" &&
-    segments[2] === "toolkits"
-  ) {
     const organizationId = orgSelectorSegment(segments[0]);
     const toolkitSlug = segments[3];
     return organizationId && toolkitSlug ? { organizationId, toolkitSlug } : undefined;
   const prmPrefix = "/.well-known/oauth-protected-resource";
   if (pathname.startsWith(`${prmPrefix}/`)) {
     const matched = matchMcpSuffix(segments.slice(2));
-    return matched === undefined
+    return matched === undefined ? null : { kind: "oauth-protected-resource", ...matched };
-      ? null
-      : { kind: "oauth-protected-resource", ...matched };
   }
   // MCP transport: `/mcp` or `/<org>/mcp`.

apps/host-selfhost/src/mcp/auth.ts+1−2

@@ -46,8 +46,7 @@ import { BetterAuth } from "../auth/better-auth"; · 45 unmodified lines
46	// ---------------------------------------------------------------------------	46	// ---------------------------------------------------------------------------
47		47
48	const PROTECTED_RESOURCE_METADATA_PATH = "/.well-known/oauth-protected-resource";	48	const PROTECTED_RESOURCE_METADATA_PATH = "/.well-known/oauth-protected-resource";
49	const TOOLKIT_PROTECTED_RESOURCE_METADATA_PATH =	49	const TOOLKIT_PROTECTED_RESOURCE_METADATA_PATH = `${PROTECTED_RESOURCE_METADATA_PATH}/mcp/toolkits/:toolkitSlug`;
50	`${PROTECTED_RESOURCE_METADATA_PATH}/mcp/toolkits/:toolkitSlug`;
51	const AUTHORIZATION_SERVER_METADATA_PATH = "/.well-known/oauth-authorization-server";	50	const AUTHORIZATION_SERVER_METADATA_PATH = "/.well-known/oauth-authorization-server";
52	const TOOLKIT_MCP_SEGMENT = "/mcp/toolkits/";	51	const TOOLKIT_MCP_SEGMENT = "/mcp/toolkits/";
53		52

apps/local/executor.config.ts+1−2

       onepasswordHttpPlugin(),
       desktopSettingsPlugin({
         webBaseUrl:
-          process.env.EXECUTOR_WEB_BASE_URL ??
+          process.env.EXECUTOR_WEB_BASE_URL ?? `http://localhost:${process.env.PORT ?? "4788"}`,
-          `http://localhost:${process.env.PORT ?? "4788"}`,
       }),
     ] as const,
 });

apps/local/src/executor.ts+15−33

   return `${folder}-${hash}`;
 };
-const resolvePluginConfigPath = (scopeDir: string): string =>
+const resolvePluginConfigPath = (scopeDir: string): string => join(scopeDir, "executor.jsonc");
-  join(scopeDir, "executor.jsonc");
 // Plugins reach the host through two doors that compose:
 //   - `executor.config.ts`'s static tuple
       activeToolkitSlug: options.activeToolkitSlug,
     });
     const dynamicPlugins =
-      (yield* Effect.promise(() =>
+      (yield* Effect.promise(() => loadPluginsFromJsonc({ path: resolvePluginConfigPath(cwd) }))) ??
-        loadPluginsFromJsonc({ path: resolvePluginConfigPath(cwd) }),
+      [];
-      )) ?? [];
     const staticPackageNames = new Set(
-      staticPlugins
+      staticPlugins.map((plugin) => plugin.packageName).filter((name): name is string => !!name),
-        .map((plugin) => plugin.packageName)
-        .filter((name): name is string => !!name),
     );
     const dedupedDynamic = dynamicPlugins.filter((plugin) => {
       if (plugin.packageName && staticPackageNames.has(plugin.packageName)) {
   readonly plugins: LocalPlugins;
 }
-class LocalExecutorTag extends Context.Service<
+class LocalExecutorTag extends Context.Service<LocalExecutorTag, LocalExecutorBundle>()(
-  LocalExecutorTag,
+  "@executor-js/local/Executor",
-  LocalExecutorBundle
+) {}
->()("@executor-js/local/Executor") {}
 export type LocalExecutor = LocalExecutorBundle["executor"];
-class LocalExecutorCreateError extends Data.TaggedError(
+class LocalExecutorCreateError extends Data.TaggedError("LocalExecutorCreateError")<{
-  "LocalExecutorCreateError",
-)<{
   readonly message: string;
   readonly cause: unknown;
 }> {}
-class LocalExecutorDisposeError extends Data.TaggedError(
+class LocalExecutorDisposeError extends Data.TaggedError("LocalExecutorDisposeError")<{
-  "LocalExecutorDisposeError",
-)<{
   readonly operation: "createHandle" | "disposeExecutor" | "disposeRuntime";
   readonly cause: unknown;
 }> {}
   Effect.runPromise(
     Effect.tryPromise({
       try: () => promise,
-      catch: (cause) =>
+      catch: (cause) => new LocalExecutorDisposeError({ operation: "createHandle", cause }),
-        new LocalExecutorDisposeError({ operation: "createHandle", cause }),
     }).pipe(
       Effect.catch(() =>
-        Effect.succeed<Awaited<ReturnType<typeof createExecutorHandle>> | null>(
+        Effect.succeed<Awaited<ReturnType<typeof createExecutorHandle>> | null>(null),
-          null,
-        ),
       ),
     ),
   );
       // resolution so a custom $PORT flows through. EXECUTOR_WEB_BASE_URL
       // overrides entirely for deployments where the UI is on a different host.
       const webBaseUrl =
-        process.env.EXECUTOR_WEB_BASE_URL ??
+        process.env.EXECUTOR_WEB_BASE_URL ?? `http://localhost:${process.env.PORT ?? "4788"}`;
-        `http://localhost:${process.env.PORT ?? "4788"}`;
       const executor = yield* createExecutor({
         tenant: Tenant.make(tenantId),
   );
 };
-export const createExecutorHandle = async (
+export const createExecutorHandle = async (options: LocalExecutorOptions = {}) => {
-  options: LocalExecutorOptions = {},
-) => {
   const layer = createLocalExecutorLayer(options);
   const runtime = ManagedRuntime.make(layer);
   const bundle = await runtime.runPromise(LocalExecutorTag.asEffect());
   return sharedHandlePromise;
 };
-export const getExecutor = () =>
+export const getExecutor = () => loadSharedHandle().then((handle) => handle.executor);
-  loadSharedHandle().then((handle) => handle.executor);
 export const getExecutorBundle = () => loadSharedHandle();
 export const disposeExecutor = async (): Promise<void> => {
   const currentHandlePromise = sharedHandlePromise;
   sharedHandlePromise = null;
-  const handle = currentHandlePromise
+  const handle = currentHandlePromise ? await handleOrNull(currentHandlePromise) : null;
-    ? await handleOrNull(currentHandlePromise)
-    : null;
   if (handle) {
     await ignorePromiseFailure("disposeExecutor", () => handle.dispose());
   }

apps/local/src/main.ts+6−11

   );
 };
-export const createServerHandlers = async (
+export const createServerHandlers = async (token: string): Promise<ServerHandlers> => {
-  token: string,
-): Promise<ServerHandlers> => {
   // The typed `/api` web-handler comes from `ExecutorApp.make` (./app.ts). The
   // boot bearer token is the authoritative `/api` gate (see `identity.ts`).
   const apiHandler: ServerHandlers["api"] = await makeLocalApiHandler(token);
   return { api: apiHandler, mcp };
 };
-export class ServerHandlersService extends Context.Service<
+export class ServerHandlersService extends Context.Service<ServerHandlersService, ServerHandlers>()(
-  ServerHandlersService,
+  "@executor-js/local/ServerHandlersService",
-  ServerHandlers
+) {}
->()("@executor-js/local/ServerHandlersService") {}
 // The handlers are built once per process and memoized. The boot token is
 // captured on the first call (serve.ts / the vite dev middleware both pass the
 // SAME token loaded from `auth.json`), so memoization on first-call is correct.
-let serverHandlersRuntime: ManagedRuntime.ManagedRuntime<
+let serverHandlersRuntime: ManagedRuntime.ManagedRuntime<ServerHandlersService, never> | null =
-  ServerHandlersService,
+  null;
-  never
-> | null = null;
 const getServerHandlersRuntime = (
   token: string,

apps/local/src/mcp.ts+26−73

   return error;
 };
-const ignoreClose = (
+const ignoreClose = (close: (() => Promise<void>) | undefined): Promise<void> =>
-  close: (() => Promise<void>) | undefined,
-): Promise<void> =>
   close
     ? Effect.runPromise(
         Effect.ignore(
       )
     : Promise.resolve();
-const pausedRequestPattern =
+const pausedRequestPattern = /^\/api\/mcp-sessions\/([^/?#]+)\/executions\/([^/?#]+)$/;
-  /^\/api\/mcp-sessions\/([^/?#]+)\/executions\/([^/?#]+)$/;
+const approvalRequestPattern = /^\/api\/mcp-sessions\/([^/?#]+)\/executions\/([^/?#]+)\/resume$/;
-const approvalRequestPattern =
-  /^\/api\/mcp-sessions\/([^/?#]+)\/executions\/([^/?#]+)\/resume$/;
 const json = (value: unknown, status = 200): Response =>
   new Response(JSON.stringify(value), {
     Effect.tryPromise({
       try: () => request.json(),
       catch: () => null,
-    }).pipe(
+    }).pipe(Effect.map((raw) => (raw === null ? null : decodeResumeResponse(raw)))),
-      Effect.map((raw) => (raw === null ? null : decodeResumeResponse(raw))),
-    ),
   );
-const resumeApprovalResult = (
+const resumeApprovalResult = (executionId: string, response: ResumeResponse) => ({
-  executionId: string,
-  response: ResumeResponse,
-) => ({
   status: "completed",
   ...formatResumeAcknowledgement(executionId, response),
   isError: false,
   return { kind: "toolkit", slug: decodeURIComponent(match[1]) };
 };
-const engineFromConfig = (
+const engineFromConfig = (config: ExecutorMcpServerConfig): AnyExecutionEngine | null =>
-  config: ExecutorMcpServerConfig,
+  "engine" in config ? config.engine : null;
-): AnyExecutionEngine | null => ("engine" in config ? config.engine : null);
 const normalizeHandlerConfig = (
   input: ExecutorMcpServerConfig | LocalMcpRequestHandlerConfig,
-): LocalMcpRequestHandlerConfig =>
+): LocalMcpRequestHandlerConfig => ("defaultConfig" in input ? input : { defaultConfig: input });
-  "defaultConfig" in input ? input : { defaultConfig: input };
 export const createMcpRequestHandler = (
   input: ExecutorMcpServerConfig | LocalMcpRequestHandlerConfig,
 ): McpRequestHandler => {
   const handlerConfig = normalizeHandlerConfig(input);
-  const transports = new Map<
+  const transports = new Map<string, WebStandardStreamableHTTPServerTransport>();
-    string,
-    WebStandardStreamableHTTPServerTransport
-  >();
   const servers = new Map<string, McpServer>();
   const resources = new Map<string, McpResource>();
   const sessionEngines = new Map<string, AnyExecutionEngine>();
   ): Promise<ReturnType<typeof formatPausedExecution> | null> =>
     (sessionEngines.get(sessionId) ?? defaultEngine)
       ? Effect.runPromise(
-          (sessionEngines.get(sessionId) ?? defaultEngine)!
+          (sessionEngines.get(sessionId) ?? defaultEngine)!.getPausedExecution(executionId).pipe(
-            .getPausedExecution(executionId)
+            Effect.map((paused) => (paused ? formatPausedExecution(paused) : null)),
-            .pipe(
+            Effect.orElseSucceed(() => null),
-              Effect.map((paused) =>
+          ),
-                paused ? formatPausedExecution(paused) : null,
-              ),
-              Effect.orElseSucceed(() => null),
-            ),
         )
       : Promise.resolve(null);
-  const configForResource = async (
+  const configForResource = async (resource: McpResource): Promise<LocalMcpServerConfig> => {
-    resource: McpResource,
+    if (!handlerConfig.createConfigForResource) return { config: handlerConfig.defaultConfig };
-  ): Promise<LocalMcpServerConfig> => {
-    if (!handlerConfig.createConfigForResource)
-      return { config: handlerConfig.defaultConfig };
     return handlerConfig.createConfigForResource(resource);
   };
-  const dispose = async (
+  const dispose = async (id: string, opts: { transport?: boolean; server?: boolean } = {}) => {
-    id: string,
-    opts: { transport?: boolean; server?: boolean } = {},
-  ) => {
     const t = transports.get(id);
     const s = servers.get(id);
     const close = sessionClosers.get(id);
         const transport = transports.get(sessionId);
         if (!transport) return jsonError(404, -32001, "Session not found");
         const sessionResource = resources.get(sessionId);
-        if (
+        if (!sessionResource || mcpResourceKey(sessionResource) !== mcpResourceKey(resource)) {
-          !sessionResource ||
+          return jsonError(403, -32003, "Session belongs to a different MCP resource");
-          mcpResourceKey(sessionResource) !== mcpResourceKey(resource)
-        ) {
-          return jsonError(
-            403,
-            -32003,
-            "Session belongs to a different MCP resource",
-          );
         }
         return transport.handleRequest(request);
       }
           transports.set(sid, transport);
           if (created) servers.set(sid, created);
           resources.set(sid, resource);
-          const engine = resourceConfig
+          const engine = resourceConfig ? engineFromConfig(resourceConfig.config) : null;
-            ? engineFromConfig(resourceConfig.config)
-            : null;
           if (engine) sessionEngines.set(sid, engine);
-          if (resourceConfig?.close)
+          if (resourceConfig?.close) sessionClosers.set(sid, resourceConfig.close);
-            sessionClosers.set(sid, resourceConfig.close);
         },
         onsessionclosed: (sid) => void dispose(sid, { server: true }),
       });
                 ? {
                     mode: "browser" as const,
                     approvalUrl: (executionId) =>
-                      approvalUrlForRequest(
+                      approvalUrlForRequest(request, executionId, createdSessionId),
-                        request,
-                        executionId,
-                        createdSessionId,
-                      ),
                   }
                 : { mode: elicitationMode },
           }),
     handlePausedRequest: async (request) => {
       const match = pausedRequestPattern.exec(new URL(request.url).pathname);
       if (!match) return json({ error: "Not found" }, 404);
-      if (request.method !== "GET")
+      if (request.method !== "GET") return json({ error: "Method not allowed" }, 405);
-        return json({ error: "Method not allowed" }, 405);
-      const paused = await pausedDetail(
+      const paused = await pausedDetail(decodeURIComponent(match[1]), decodeURIComponent(match[2]));
-        decodeURIComponent(match[1]),
-        decodeURIComponent(match[2]),
-      );
       if (!paused) return json({ error: "Paused execution not found" }, 404);
       return json({ text: paused.text, structured: paused.structured });
     },
     handleApprovalRequest: async (request) => {
       const match = approvalRequestPattern.exec(new URL(request.url).pathname);
       if (!match) return json({ error: "Not found" }, 404);
-      if (request.method !== "POST")
+      if (request.method !== "POST") return json({ error: "Method not allowed" }, 405);
-        return json({ error: "Method not allowed" }, 405);
       const sessionId = decodeURIComponent(match[1]);
       const executionId = decodeURIComponent(match[2]);
     close: async () => {
       const ids = new Set([...transports.keys(), ...servers.keys()]);
-      await Promise.all(
+      await Promise.all([...ids].map((id) => dispose(id, { transport: true, server: true })));
-        [...ids].map((id) => dispose(id, { transport: true, server: true })),
-      );
     },
   };
 };
 // Stdio transport
 // ---------------------------------------------------------------------------
-export const runMcpStdioServer = async (
+export const runMcpStdioServer = async (config: ExecutorMcpServerConfig): Promise<void> => {
-  config: ExecutorMcpServerConfig,
-): Promise<void> => {
   startIntegrationsRefresh();
   const server = await Effect.runPromise(createExecutorMcpServer(config));

apps/local/src/serve.ts+13−38

     headers: { "content-type": "text/html", "cache-control": "no-store" },
   });
-function collectStaticRoutes(
+function collectStaticRoutes(dir: string, prefix = ""): Record<string, StaticHandler> {
-  dir: string,
-  prefix = "",
-): Record<string, StaticHandler> {
   const routes: Record<string, StaticHandler> = {};
   // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: filesystem route discovery is best-effort for optional built assets
   try {
  * Convert an embedded web UI map (path → bunfs path) into Bun.serve routes.
  * The embedded map is generated by the CLI build step using `with { type: "file" }`.
  */
-function embeddedToStaticRoutes(
+function embeddedToStaticRoutes(embedded: Record<string, string>): Record<string, StaticHandler> {
-  embedded: Record<string, string>,
-): Record<string, StaticHandler> {
   const routes: Record<string, StaticHandler> = {};
   for (const [key, bunfsPath] of Object.entries(embedded)) {
     const file = Bun.file(bunfsPath);
     }
     if (child.exitCode !== null) {
       // oxlint-disable-next-line executor/no-try-catch-or-throw, executor/no-error-constructor -- boundary: child process aborted before becoming ready
-      throw new Error(
+      throw new Error(`vite dev exited with code ${child.exitCode} before becoming ready`);
-        `vite dev exited with code ${child.exitCode} before becoming ready`,
-      );
     }
     await Bun.sleep(150);
   }
   if (!origin || !isAllowedOrigin(origin, allowedHosts)) return response;
   const headers = new Headers(response.headers);
   headers.set("access-control-allow-origin", origin);
-  for (const [key, value] of Object.entries(corsHeaders))
+  for (const [key, value] of Object.entries(corsHeaders)) headers.set(key, value);
-    headers.set(key, value);
   headers.set(
     "access-control-allow-headers",
     req.headers.get("access-control-request-headers") ??
   });
 };
-const corsPreflightResponse = (
+const corsPreflightResponse = (req: Request, allowedHosts: ReadonlySet<string>): Response =>
-  req: Request,
-  allowedHosts: ReadonlySet<string>,
-): Response =>
   withCorsHeaders(req, new Response(null, { status: 204 }), allowedHosts);
-export async function startServer(
+export async function startServer(opts: StartServerOptions = {}): Promise<ServerInstance> {
-  opts: StartServerOptions = {},
-): Promise<ServerInstance> {
   const port = opts.port ?? parseInt(process.env.PORT ?? "4788", 10);
   const hostname = opts.hostname ?? "127.0.0.1";
   // ONE credential, always present: an explicit override or the stable token
   // from auth.json (minted on first run). Auth is unconditionally on — loopback
   // is no longer a free pass, since Executor runs arbitrary code that any local
   // process could otherwise drive.
-  const authToken =
+  const authToken = normalizeCredential(opts.authToken) ?? loadOrMintLocalAuthToken();
-    normalizeCredential(opts.authToken) ?? loadOrMintLocalAuthToken();
   const isAuthorized = makeIsAuthorized(authToken);
   // CORS-only origin allowlist (no Host gate — the bearer is the boundary).
   const corsAllowedHosts = new Set<string>([
   const devMode = process.env.EXECUTOR_DEV === "1" && !opts.embeddedWebUI;
   if (devMode) {
-    console.log(
+    console.log("[executor] EXECUTOR_DEV=1 — spawning vite dev child for live UI");
-      "[executor] EXECUTOR_DEV=1 — spawning vite dev child for live UI",
-    );
     viteChild = await startViteChild();
     // Diagnostic only — this is the internal vite port the daemon proxies to.
     // It must NOT read as a destination: the URL to open is the `Open:` line the
     // CLI prints (the daemon port, with ?_token). Hitting the vite port directly
     // skips that bootstrap and lands on the auth gate.
-    console.log(
+    console.log(`[executor] (internal) vite dev child at ${viteChild.url} — don't open this`);
-      `[executor] (internal) vite dev child at ${viteChild.url} — don't open this`,
-    );
     serveIndex = () =>
       // Unused when viteChild is non-null; defined so the type checker
       // can keep `serveIndex` non-nullable.
       new Response("vite not ready", { status: 503 });
   } else if (opts.embeddedWebUI) {
     staticRoutes = embeddedToStaticRoutes(opts.embeddedWebUI);
-    const indexFile = Bun.file(
+    const indexFile = Bun.file(opts.embeddedWebUI["index.html"] ?? join(clientDir, "index.html"));
-      opts.embeddedWebUI["index.html"] ?? join(clientDir, "index.html"),
-    );
     serveIndex = () => htmlResponse(indexFile);
   } else {
     staticRoutes = collectStaticRoutes(clientDir);
       // Unauthenticated liveness probe — carries no data, used by the CLI
       // reachability check (which therefore never forwards a credential).
       if (url.pathname === "/api/health" && req.method === "GET") {
-        return withCors(
+        return withCors(new Response("ok", { headers: { "content-type": "text/plain" } }));
-          new Response("ok", { headers: { "content-type": "text/plain" } }),
-        );
       }
       // OAuth provider callbacks are hit by the user's external browser and
       // gate — see isUnauthenticatedOAuthCallbackPath. Everything else under
       // /api and /mcp requires the bearer.
       const skipAuth = isUnauthenticatedOAuthCallbackPath(url.pathname);
-      const isMcpPath =
+      const isMcpPath = url.pathname === "/mcp" || url.pathname.startsWith("/mcp/");
-        url.pathname === "/mcp" || url.pathname.startsWith("/mcp/");
       const isGatedSurface = url.pathname.startsWith("/api") || isMcpPath;
       if (isGatedSurface && !skipAuth && !isAuthorized(req)) {
 if (import.meta.main) {
   const server = await startServer();
-  console.log(
+  console.log(`Executor listening on http://localhost:${server.port}/?_token=${server.authToken}`);
-    `Executor listening on http://localhost:${server.port}/?_token=${server.authToken}`,
-  );
 }

apps/local/vite.config.ts+14−39

 import appPlugin from "@executor-js/app/vite";
 import { loadOrMintLocalAuthToken } from "./src/auth";
 import { consumeOAuthResult } from "./src/oauth-result-store";
-import {
+import { isUnauthenticatedOAuthCallbackPath, makeIsAuthorized } from "./src/serve-shared";
-  isUnauthenticatedOAuthCallbackPath,
-  makeIsAuthorized,
-} from "./src/serve-shared";
 // oxlint-disable-next-line executor/no-json-parse -- boundary: Vite config reads package metadata from package.json
 const rootPackage = JSON.parse(
 ) as { version?: string };
 const repositoryUrl =
-  typeof rootPackage.repository === "string"
+  typeof rootPackage.repository === "string" ? rootPackage.repository : rootPackage.repository?.url;
-    ? rootPackage.repository
-    : rootPackage.repository?.url;
 const EXECUTOR_VERSION = cliPackage.version ?? rootPackage.version;
 const EXECUTOR_GITHUB_URL = (
         server.httpServer?.once("listening", () => {
           const address = server.httpServer?.address();
           const port =
-            typeof address === "object" && address
+            typeof address === "object" && address ? address.port : server.config.server.port;
-              ? address.port
-              : server.config.server.port;
           server.config.logger.info(
             `\n  Open with auth:  http://127.0.0.1:${port}/?_token=${devToken}\n`,
           );
       }
       server.watcher.on("change", (path) => {
-        if (
+        if (path.includes("/apps/local/src/") || path.endsWith("/executor.config.ts")) {
-          path.includes("/apps/local/src/") ||
-          path.endsWith("/executor.config.ts")
-        ) {
           handlers = null;
         }
       });
         // bootstrap, so the UI is unaffected; external MCP clients use the
         // daemon port.
         const authExempt =
-          pathOnly === "/api/health" ||
+          pathOnly === "/api/health" || isUnauthenticatedOAuthCallbackPath(pathOnly);
-          isUnauthenticatedOAuthCallbackPath(pathOnly);
         if (!authExempt) {
           const presented = req.headers.authorization;
           const authValue = Array.isArray(presented) ? presented[0] : presented;
             "http://localhost/",
             authValue ? { headers: { authorization: authValue } } : undefined,
           );
-          if (
+          if (!makeIsAuthorized(devToken ?? loadOrMintLocalAuthToken())(probe)) {
-            !makeIsAuthorized(devToken ?? loadOrMintLocalAuthToken())(probe)
-          ) {
             res.statusCode = 401;
             res.setHeader("www-authenticate", 'Bearer realm="executor"');
             res.end("Unauthorized");
         try {
           if (!handlers) {
             const { getServerHandlers } = await import("./src/main");
-            handlers = await getServerHandlers(
+            handlers = await getServerHandlers(devToken ?? loadOrMintLocalAuthToken());
-              devToken ?? loadOrMintLocalAuthToken(),
-            );
           }
           const origin = `http://${req.headers.host ?? "localhost"}`;
           const headers = new Headers();
           for (const [key, value] of Object.entries(req.headers)) {
-            if (value)
+            if (value) headers.set(key, Array.isArray(value) ? value.join(", ") : value);
-              headers.set(key, Array.isArray(value) ? value.join(", ") : value);
           }
           const hasBody = req.method !== "GET" && req.method !== "HEAD";
                 : handlers.mcp.handleApprovalRequest;
             response = await handler(webRequest(rawUrl));
           } else {
-            const awaitMatch = /^\/api\/oauth\/await\/([^/?#]+)$/.exec(
+            const awaitMatch = /^\/api\/oauth\/await\/([^/?#]+)$/.exec(pathOnly);
-              pathOnly,
-            );
             if (awaitMatch && req.method === "GET") {
-              response = new Response(
+              response = new Response(JSON.stringify(consumeOAuthResult(awaitMatch[1]!)), {
-                JSON.stringify(consumeOAuthResult(awaitMatch[1]!)),
+                headers: { "content-type": "application/json" },
-                {
+              });
-                  headers: { "content-type": "application/json" },
-                },
-              );
             } else {
               // Strip /api prefix for Effect handlers.
-              response = await handlers.api.handler(
+              response = await handlers.api.handler(webRequest(rawUrl.slice("/api".length) || "/"));
-                webRequest(rawUrl.slice("/api".length) || "/"),
-              );
             }
           }
     "import.meta.env.VITE_APP_VERSION": JSON.stringify(EXECUTOR_VERSION),
     "import.meta.env.VITE_GITHUB_URL": JSON.stringify(EXECUTOR_GITHUB_URL),
     "import.meta.env.VITE_EXECUTOR_DEV_CLI_CWD": JSON.stringify(REPO_ROOT),
-    "process.env.NODE_ENV": JSON.stringify(
+    "process.env.NODE_ENV": JSON.stringify(process.env.NODE_ENV ?? "development"),
-      process.env.NODE_ENV ?? "development",
-    ),
   },
   resolve: {
     tsconfigPaths: true,

e2e/local/toolkits-mcp.test.ts+2−2

@@ -67,8 +67,8 @@ const pingSpec = (baseUrl: string): string => · 66 unmodified lines
67	});	67	});
68		68
69	const closeServer = (server: Server): Promise<void> =>	69	const closeServer = (server: Server): Promise<void> =>
70	new Promise((resolve, reject) => {	70	new Promise((resolve) => {
71	server.close((error) => (error ? reject(error) : resolve()));	71	server.close(() => resolve());
72	});	72	});
73		73
74	const servePingApi = Effect.acquireRelease(	74	const servePingApi = Effect.acquireRelease(

e2e/scenarios/toolkits-mcp.test.ts+2−2

@@ -56,8 +56,8 @@ const pingSpec = (baseUrl: string): string => · 55 unmodified lines
56	});	56	});
57		57
58	const closeServer = (server: Server): Promise<void> =>	58	const closeServer = (server: Server): Promise<void> =>
59	new Promise((resolve, reject) => {	59	new Promise((resolve) => {
60	server.close((error) => (error ? reject(error) : resolve()));	60	server.close(() => resolve());
61	});	61	});
62		62
63	const servePingApi = Effect.acquireRelease(	63	const servePingApi = Effect.acquireRelease(

e2e/selfhost/toolkits-ui.test.ts+8−2

         });
         await step("Remove the connection from the toolkit tools list", async () => {
-          await page.getByRole("button", { name: /^Remove connection / }).first().click();
+          await page
+            .getByRole("button", { name: /^Remove connection / })
+            .first()
+            .click();
           await page.getByText("No connections added").waitFor();
           await page.getByRole("button", { name: "Add connection to toolkit" }).click();
           const dialog = page.getByRole("dialog", { name: "Add connection" });
           await dialog.waitFor();
           await dialog.getByLabel("Search connections and tools").fill("policies.list");
-          await dialog.getByRole("button", { name: /^Add connection / }).first().click();
+          await dialog
+            .getByRole("button", { name: /^Add connection / })
+            .first()
+            .click();
           await dialog.waitFor({ state: "hidden" });
           const toolkitTools = page.getByRole("region", { name: "Toolkit tools" });
           await toolkitTools.getByLabel("Filter tools").fill("policies.list");

packages/plugins/google/src/sdk/openapi-ownership-migration.test.ts+12−54

     sql: `INSERT INTO integration
       (row_id, tenant, slug, plugin_id, name, description, config, can_remove, can_refresh, created_at, updated_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, 1, 1, ?, ?)`,
-    args: [
+    args: [row.rowId, row.tenant, row.slug, row.pluginId, row.slug, row.slug, row.config, now, now],
-      row.rowId,
-      row.tenant,
-      row.slug,
-      row.pluginId,
-      row.slug,
-      row.slug,
-      row.config,
-      now,
-      now,
-    ],
   });
 const insertBlob = (
     sql: `INSERT INTO tool
       (tenant, owner, subject, integration, connection, plugin_id, name, description, input_schema, output_schema, annotations, created_at, updated_at, row_id)
       VALUES (?, 'org', '', ?, 'default', ?, 'items.list', 'List items', NULL, NULL, NULL, ?, ?, ?)`,
-    args: [
+    args: [row.tenant, row.integration, row.pluginId, now, now, `tool-${row.integration}`],
-      row.tenant,
-      row.integration,
-      row.pluginId,
-      now,
-      now,
-      `tool-${row.integration}`,
-    ],
   });
 const insertDefinition = (
     sql: `INSERT INTO definition
       (tenant, owner, subject, integration, connection, plugin_id, name, schema, created_at, row_id)
       VALUES (?, 'org', '', ?, 'default', ?, 'Item', '{}', ?, ?)`,
-    args: [
+    args: [row.tenant, row.integration, row.pluginId, now, `definition-${row.integration}`],
-      row.tenant,
-      row.integration,
-      row.pluginId,
-      now,
-      `definition-${row.integration}`,
-    ],
   });
 describe("runSqliteGoogleOpenApiOwnershipMigration", () => {
   it.effect("skips malformed legacy integration config rows", () =>
     Effect.gen(function* () {
-      const db = yield* Effect.promise(() =>
+      const db = yield* Effect.promise(() => createSqliteTestFumaDb({ tables: collectTables() }));
-        createSqliteTestFumaDb({ tables: collectTables() }),
-      );
       yield* Effect.promise(() =>
         insertIntegrationRawConfig(db.client, {
         }),
       );
-      expect(yield* runSqliteGoogleOpenApiOwnershipMigration(db.client)).toBe(
+      expect(yield* runSqliteGoogleOpenApiOwnershipMigration(db.client)).toBe(0);
-        0,
-      );
       const integrations = yield* Effect.promise(() =>
         db.client.execute("SELECT slug, plugin_id, config FROM integration"),
       );
-      expect(integrations.rows).toEqual([
+      expect(integrations.rows).toEqual([{ slug: "broken", plugin_id: "openapi", config: "" }]);
-        { slug: "broken", plugin_id: "openapi", config: "" },
-      ]);
       yield* Effect.promise(() => db.close());
     }),
   it.effect("moves OpenAPI-owned Google bundle rows to the Google plugin", () =>
     Effect.gen(function* () {
-      const db = yield* Effect.promise(() =>
+      const db = yield* Effect.promise(() => createSqliteTestFumaDb({ tables: collectTables() }));
-        createSqliteTestFumaDb({ tables: collectTables() }),
-      );
       const client = db.client;
       yield* Effect.promise(() =>
           pluginId: "openapi",
           config: {
             specHash: "googlehash",
-            googleDiscoveryUrls: [
+            googleDiscoveryUrls: ["https://www.googleapis.com/discovery/v1/apis/calendar/v3/rest"],
-              "https://www.googleapis.com/discovery/v1/apis/calendar/v3/rest",
-            ],
           },
         }),
       );
       expect(googleBlob.rows).toEqual([{ value: "google spec" }]);
       const openApiBlobs = yield* Effect.promise(() =>
-        client.execute(
+        client.execute("SELECT key FROM blob WHERE namespace = 'o:org_1/openapi' ORDER BY key"),
-          "SELECT key FROM blob WHERE namespace = 'o:org_1/openapi' ORDER BY key",
-        ),
       );
-      expect(openApiBlobs.rows).toEqual([
+      expect(openApiBlobs.rows).toEqual([{ key: "spec/googlehash" }, { key: "spec/stripehash" }]);
-        { key: "spec/googlehash" },
-        { key: "spec/stripehash" },
-      ]);
       const storage = yield* Effect.promise(() =>
         client.execute(
       ]);
       const tools = yield* Effect.promise(() =>
-        client.execute(
+        client.execute("SELECT integration, plugin_id FROM tool ORDER BY integration"),
-          "SELECT integration, plugin_id FROM tool ORDER BY integration",
-        ),
       );
       expect(tools.rows).toEqual([
         { integration: "google", plugin_id: "google" },
       ]);
       const definitions = yield* Effect.promise(() =>
-        client.execute(
+        client.execute("SELECT integration, plugin_id FROM definition ORDER BY integration"),
-          "SELECT integration, plugin_id FROM definition ORDER BY integration",
-        ),
       );
       expect(definitions.rows).toEqual([
         { integration: "google", plugin_id: "google" },

packages/plugins/google/src/sdk/openapi-ownership-migration.ts+2−6

 import { Effect } from "effect";
-import {
+import { DataMigrationError, type SqliteDataMigrationClient } from "@executor-js/sdk/core";
-  DataMigrationError,
-  type SqliteDataMigrationClient,
-} from "@executor-js/sdk/core";
 const MIGRATION_NAME = "2026-06-20-google-openapi-ownership";
 const googleOpenApiCandidate = (alias?: string): string => {
 ) =>
   Effect.tryPromise({
     try: () => client.execute(stmt),
-    catch: (cause) =>
+    catch: (cause) => new DataMigrationError({ migration: MIGRATION_NAME, cause }),
-      new DataMigrationError({ migration: MIGRATION_NAME, cause }),
   });
 export const runSqliteGoogleOpenApiOwnershipMigration = (

packages/plugins/toolkits/CHANGELOG.md+1−0

@@ -0,0 +1 @@
		1	# @executor-js/plugin-toolkits

packages/plugins/toolkits/src/page.tsx+6−11

 function AddToolkitCard(props: { owner: Owner; onClick: () => void }) {
   const scopeLabel = addToolkitScopeLabel(props.owner);
   return (
-    <button
+    <Button
       type="button"
+      variant="ghost"
       onClick={props.onClick}
       aria-label={`Add ${scopeLabel} toolkit`}
-      className="group flex min-h-36 min-w-0 self-start items-center justify-center rounded-md border border-dashed border-border/75 bg-card/40 text-muted-foreground transition-[border-color,background-color,box-shadow,color] hover:border-foreground/25 hover:bg-muted/20 hover:text-foreground hover:shadow-sm focus-visible:ring-[3px] focus-visible:ring-ring/30 focus-visible:outline-none"
+      className="group flex h-auto min-h-36 min-w-0 self-start items-center justify-center rounded-md border border-dashed border-border/75 bg-card/40 p-0 text-muted-foreground transition-[border-color,background-color,box-shadow,color] hover:border-foreground/25 hover:bg-muted/20 hover:text-foreground hover:shadow-sm focus-visible:ring-[3px] focus-visible:ring-ring/30 focus-visible:outline-none"
       style={toolkitCardStyle}
     >
       <span
       >
         <PlusIcon className="size-6" />
       </span>
-    </button>
+    </Button>
   );
 }
   );
   const exposedToolIds = useMemo(
     () =>
-      new Set(
+      new Set(toolkitTools.filter((tool) => tool.policy.action !== "block").map((tool) => tool.id)),
-        toolkitTools
-          .filter((tool) => tool.policy.action !== "block")
-          .map((tool) => tool.id),
-      ),
     [toolkitTools],
   );
   const selectedTool = selectedToolId
   const toolkitRows = AsyncResult.isSuccess(toolkits) ? toolkits.value.toolkits : [];
   const selectedToolkit =
-    selectedToolkitSlug === null
+    selectedToolkitSlug === null ? null : toolkitByRouteSlug(toolkitRows, selectedToolkitSlug);
-      ? null
-      : toolkitByRouteSlug(toolkitRows, selectedToolkitSlug);
   const toolRows = AsyncResult.isSuccess(tools) ? (tools.value as readonly ToolRow[]) : [];
   const integrationRows = AsyncResult.isSuccess(integrations)

packages/plugins/toolkits/src/server.ts+7−3

   const getEntry = (toolkitId: string) => storage.toolkits.get({ key: toolkitId });
   const getBySlugEntry = (slug: string) =>
-    storage.toolkits.query({ where: { slug } }).pipe(
+    storage.toolkits
-      Effect.map((entries) => entries.find((entry) => entry.owner === "org") ?? entries[0] ?? null),
+      .query({ where: { slug } })
-    );
+      .pipe(
+        Effect.map(
+          (entries) => entries.find((entry) => entry.owner === "org") ?? entries[0] ?? null,
+        ),
+      );
   const requireToolkit = (toolkitId: string) =>
     getEntry(toolkitId).pipe(