lael-labs/executor

.github/workflows/release.yml+5−0

       - name: Build release artifacts
         run: bun run --cwd executor build:release
+      - name: Validate local install flow against built artifacts
+        run: |
+          bun run --cwd executor build:binary
+          EXECUTOR_INSTALL_E2E_SKIP_BUILD=1 bun test executor/scripts/e2e/install.e2e.test.ts
       - name: Verify release artifacts exist
         shell: bash
         run: |

executor/packages/core/src/managed-runtime.ts+26−12

   return value && value.length > 0 ? value : null;
 }
+function resolveManagedConvexEndpoints(info: ManagedRuntimeInfo): {
+  convexUrl: string;
+  convexSiteUrl: string;
+} {
+  const managedConvexUrl = `http://${info.config.hostInterface}:${info.config.backendPort}`;
+  const managedConvexSiteUrl = `http://${info.config.hostInterface}:${info.config.siteProxyPort}`;
+  const overrideConvexUrl = trimEnv("EXECUTOR_WEB_CONVEX_URL");
+  const overrideConvexSiteUrl = trimEnv("EXECUTOR_WEB_CONVEX_SITE_URL");
+  return {
+    convexUrl: overrideConvexUrl ?? managedConvexUrl,
+    convexSiteUrl: overrideConvexSiteUrl ?? managedConvexSiteUrl,
+  };
+}
 function normalizePemForEnv(value: string): string {
   return value.replace(/\r\n/g, "\n").replace(/\n/g, "\\n").trim();
 }
 export async function runManagedBackend(args: string[]): Promise<number> {
   const info = await ensureManagedRuntime();
   const anonymousAuthEnv = await resolveManagedAnonymousAuthEnv(info);
-  const managedConvexUrl = `http://${info.config.hostInterface}:${info.config.backendPort}`;
+  const endpoints = resolveManagedConvexEndpoints(info);
-  const managedConvexSiteUrl = `http://${info.config.hostInterface}:${info.config.siteProxyPort}`;
   if (args.length === 0) {
     try {
     ...process.env,
     ...anonymousAuthEnv,
     PATH: `${path.dirname(info.nodeBin)}:${process.env.PATH ?? ""}`,
-    CONVEX_URL: managedConvexUrl,
+    CONVEX_URL: endpoints.convexUrl,
-    CONVEX_SITE_URL: managedConvexSiteUrl,
+    CONVEX_SITE_URL: endpoints.convexSiteUrl,
-    ANONYMOUS_AUTH_ISSUER: managedConvexSiteUrl,
+    ANONYMOUS_AUTH_ISSUER: endpoints.convexSiteUrl,
   };
   const proc = Bun.spawn([info.backendBinary, ...backendArgs(info, args)], {
   const webPort = options.port ?? Number(Bun.env.EXECUTOR_WEB_PORT ?? 5312);
   const host = Bun.env.EXECUTOR_WEB_INTERFACE ?? "127.0.0.1";
-  const managedConvexUrl = `http://${info.config.hostInterface}:${info.config.backendPort}`;
+  const endpoints = resolveManagedConvexEndpoints(info);
-  const managedConvexSiteUrl = `http://${info.config.hostInterface}:${info.config.siteProxyPort}`;
   const env = {
     ...process.env,
     NODE_ENV: "production",
     PORT: String(webPort),
     HOSTNAME: host,
-    CONVEX_URL: managedConvexUrl,
+    CONVEX_URL: endpoints.convexUrl,
-    CONVEX_SITE_URL: managedConvexSiteUrl,
+    CONVEX_SITE_URL: endpoints.convexSiteUrl,
-    EXECUTOR_WEB_CONVEX_URL: managedConvexUrl,
+    EXECUTOR_WEB_CONVEX_URL: endpoints.convexUrl,
-    EXECUTOR_WEB_CONVEX_SITE_URL: managedConvexSiteUrl,
+    EXECUTOR_WEB_CONVEX_SITE_URL: endpoints.convexSiteUrl,
-    ANONYMOUS_AUTH_ISSUER: managedConvexSiteUrl,
+    ANONYMOUS_AUTH_ISSUER: endpoints.convexSiteUrl,
   };
   const proc = await runProcess(info.nodeBin, [info.webServerEntry], {

executor/scripts/e2e/install-checks.ts+9−0

@@ -13,3 +13,12 @@ export function anonymousBootstrapCheckScript(ports: { backendPort: number; webP · 12 unmodified lines
13	"printf '%s' \"$mutation_json\" \| \"$node_bin\" -e \"let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{const j=JSON.parse(d);if(j.status!=='success' \|\| !j.value \|\| typeof j.value.workspaceId!=='string' \|\| typeof j.value.sessionId!=='string'){console.error(d);process.exit(3)}console.log(JSON.stringify({workspaceId:j.value.workspaceId,sessionId:j.value.sessionId}))})\"",	13	"printf '%s' \"$mutation_json\" \| \"$node_bin\" -e \"let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{const j=JSON.parse(d);if(j.status!=='success' \|\| !j.value \|\| typeof j.value.workspaceId!=='string' \|\| typeof j.value.sessionId!=='string'){console.error(d);process.exit(3)}console.log(JSON.stringify({workspaceId:j.value.workspaceId,sessionId:j.value.sessionId}))})\"",
14	].join("; ");	14	].join("; ");
15	}	15	}
		16
		17	export function runtimeConfigCheckScript(options: { webPort: number; expectedConvexUrl: string }): string {
		18	return [
		19	"set -euo pipefail",
		20	`expected_convex_url='${options.expectedConvexUrl}'`,
		21	`html=$(curl -fsS http://127.0.0.1:${options.webPort}/)`,
		22	"printf '%s' \"$html\" \| node -e \"const expected=process.argv[1];let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{const m=d.match(/window\\.__EXECUTOR_RUNTIME_CONFIG__ = ([^;]+);/);if(!m){console.error('runtime config script missing');process.exit(2)};const cfg=JSON.parse(m[1]);if(cfg?.convexUrl!==expected){console.error(JSON.stringify({expected,actual:cfg?.convexUrl}));process.exit(3)};if(expected.startsWith('https://')&&!String(cfg?.convexUrl\|\|'').startsWith('https://')){console.error('expected https convex url');process.exit(4)};console.log(JSON.stringify({convexUrl:cfg.convexUrl}))})\" \"$expected_convex_url\"",
		23	].join("; ");
		24	}

executor/scripts/e2e/install.e2e.test.ts+26−13

@@ -77,6 +77,11 @@ function assertSuccess(result: CommandResult, label: string): void { · 76 unmodified lines
77	);	77	);
78	}	78	}
79		79
		80	function shouldSkipBuildSteps(): boolean {
		81	const raw = process.env.EXECUTOR_INSTALL_E2E_SKIP_BUILD?.trim().toLowerCase();
		82	return raw === "1" \|\| raw === "true" \|\| raw === "yes";
		83	}
		84
80	test("installer e2e: uninstall, install, deploy, and cleanup", async () => {	85	test("installer e2e: uninstall, install, deploy, and cleanup", async () => {
81	const repoRoot = repositoryRoot();	86	const repoRoot = repositoryRoot();
82	const installScript = path.join(repoRoot, "install");	87	const installScript = path.join(repoRoot, "install");
@@ -109,19 +114,27 @@ test("installer e2e: uninstall, install, deploy, and cleanup", async () => { · 26 unmodified lines
109	};	114	};
110		115
111	try {	116	try {
112	const buildBinary = await runCommand(["bun", "run", "build:binary"], {	117	if (!shouldSkipBuildSteps()) {
113	cwd: repoRoot,	118	const buildBinary = await runCommand(["bun", "run", "build:binary"], {
114	env: process.env,	119	cwd: repoRoot,
115	timeoutMs: 300_000,	120	env: process.env,
116	});	121	timeoutMs: 300_000,
117	assertSuccess(buildBinary, "build binary");	122	});
118		123	assertSuccess(buildBinary, "build binary");
119	const buildRelease = await runCommand(["bun", "run", "build:release"], {	124
120	cwd: repoRoot,	125	const buildRelease = await runCommand(["bun", "run", "build:release"], {
121	env: process.env,	126	cwd: repoRoot,
122	timeoutMs: 1_200_000,	127	env: process.env,
123	});	128	timeoutMs: 1_200_000,
124	assertSuccess(buildRelease, "build release");	129	});
		130	assertSuccess(buildRelease, "build release");
		131	}
		132
		133	if (!(await pathExists(binaryPath))) {
		134	throw new Error(
		135	`Missing expected binary at ${binaryPath}. Run 'bun run build:binary' or unset EXECUTOR_INSTALL_E2E_SKIP_BUILD.`,
		136	);
		137	}
125		138
126	await fs.mkdir(installCwd, { recursive: true });	139	await fs.mkdir(installCwd, { recursive: true });
127		140

executor/scripts/e2e/install.sandbox.e2e.test.ts+43−5

 import { expect, test } from "bun:test";
 import { Sandbox } from "@vercel/sandbox";
-import { anonymousBootstrapCheckScript, runtimeDoctorScript } from "./install-checks";
+import { anonymousBootstrapCheckScript, runtimeConfigCheckScript, runtimeDoctorScript } from "./install-checks";
 type CommandResult = {
   exitCode: number;
   sandbox: Sandbox,
   script: string,
   timeoutMs: number,
+  env?: Record<string, string>,
 ): Promise<CommandResult> {
   const controller = new AbortController();
   const timeout = setTimeout(() => {
     const command = await sandbox.runCommand({
       cmd: "bash",
       args: ["-lc", script],
+      env,
       signal: controller.signal,
     });
 }
 test("installer works in fresh Vercel sandbox", async () => {
+  const backendPort = 5410;
+  const sitePort = 5411;
+  const webPort = 5312;
   const credentials =
     process.env.VERCEL_TOKEN && process.env.VERCEL_TEAM_ID && process.env.VERCEL_PROJECT_ID
       ? {
     try {
       return await Sandbox.create({
         runtime: "node22",
+        ports: [webPort, backendPort, sitePort],
         timeout: 30 * 60 * 1000,
         ...credentials,
       });
   let sandbox: Sandbox | null = await createSandbox();
   try {
+    const buildSandboxEnv = (activeSandbox: Sandbox) => {
+      const convexUrl = activeSandbox.domain(backendPort);
+      const convexSiteUrl = activeSandbox.domain(sitePort);
+      return {
+        convexUrl,
+        env: {
+          EXECUTOR_BACKEND_INTERFACE: "0.0.0.0",
+          EXECUTOR_WEB_INTERFACE: "0.0.0.0",
+          EXECUTOR_BACKEND_PORT: String(backendPort),
+          EXECUTOR_BACKEND_SITE_PORT: String(sitePort),
+          EXECUTOR_WEB_PORT: String(webPort),
+          CONVEX_URL: convexUrl,
+          CONVEX_SITE_URL: convexSiteUrl,
+          EXECUTOR_WEB_CONVEX_URL: convexUrl,
+          EXECUTOR_WEB_CONVEX_SITE_URL: convexSiteUrl,
+        },
+      };
+    };
+    let sandboxSettings = buildSandboxEnv(sandbox);
     const installScript = [
       "set -euo pipefail",
       "cd ~",
       "if [ -x ~/.executor/bin/executor ]; then ~/.executor/bin/executor uninstall --yes || true; fi",
       "rm -rf ~/.executor",
       "start=$(date +%s)",
-      "curl -fsSL https://executor.sh/install | bash",
+      "curl -fsSL https://executor.sh/install | bash -s -- --no-modify-path --no-star-prompt",
       "end=$(date +%s)",
       "echo INSTALL_SECONDS=$((end-start))",
       runtimeDoctorScript(),
     let install: CommandResult;
     try {
-      install = await runSandboxBash(sandbox, installScript, 900_000);
+      install = await runSandboxBash(sandbox, installScript, 900_000, sandboxSettings.env);
     } catch (error) {
       if (!isSandboxStoppedError(error)) {
         throw error;
         // ignore
       }
       sandbox = await createSandbox();
-      install = await runSandboxBash(sandbox, installScript, 900_000);
+      sandboxSettings = buildSandboxEnv(sandbox);
+      install = await runSandboxBash(sandbox, installScript, 900_000, sandboxSettings.env);
     }
     assertSuccess(install, "sandbox install + doctor");
     const output = `${install.stdout}\n${install.stderr}`;
     expect(output).toContain("Executor status: ready");
+    const runtimeConfigCheck = await runSandboxBash(
+      sandbox,
+      runtimeConfigCheckScript({ webPort, expectedConvexUrl: sandboxSettings.convexUrl }),
+      300_000,
+      sandboxSettings.env,
+    );
+    assertSuccess(runtimeConfigCheck, "sandbox runtime config convex URL check");
     const anonymousCheck = await runSandboxBash(
       sandbox,
-      anonymousBootstrapCheckScript({ backendPort: 5410, webPort: 5312 }),
+      anonymousBootstrapCheckScript({ backendPort, webPort }),
       300_000,
+      sandboxSettings.env,
     );
     assertSuccess(anonymousCheck, "sandbox anonymous bootstrap check");

executor/scripts/e2e/install.sandbox.session.ts+11−1

 import { Sandbox } from "@vercel/sandbox";
 import { generateKeyPairSync } from "node:crypto";
-import { anonymousBootstrapCheckScript, runtimeDoctorScript } from "./install-checks";
+import { anonymousBootstrapCheckScript, runtimeConfigCheckScript, runtimeDoctorScript } from "./install-checks";
 type CommandResult = {
   exitCode: number;
   );
   assertSuccess(doctor, "sandbox doctor --verbose");
+  const runtimeConfigCheck = await runSandboxBash(
+    sandbox,
+    runtimeConfigCheckScript({ webPort, expectedConvexUrl: convexUrl }),
+    {
+      timeoutMs: installTimeoutMs,
+      env: sandboxEnv,
+    },
+  );
+  assertSuccess(runtimeConfigCheck, "sandbox runtime config convex URL check");
   const anonymousCheck = await runSandboxBash(
     sandbox,
     anonymousBootstrapCheckScript({ backendPort, webPort }),

executor/scripts/release/build-release.ts+38−4

@@ -246,12 +246,48 @@ async function generateSelfHostedAdminKey(config: RuntimeConfig): Promise<string · 245 unmodified lines
246	return parsed.adminKey;	246	return parsed.adminKey;
247	}	247	}
248		248
		249	async function assertSeededClientConfig(config: RuntimeConfig, expectedAnonymousIssuer: string): Promise<void> {
		250	const response = await fetch(`http://${config.hostInterface}:${config.backendPort}/api/query`, {
		251	method: "POST",
		252	headers: {
		253	"content-type": "application/json",
		254	},
		255	body: JSON.stringify({
		256	path: "app:getClientConfig",
		257	args: {},
		258	}),
		259	});
		260
		261	if (!response.ok) {
		262	const text = await response.text();
		263	throw new Error(`Failed querying app:getClientConfig during runtime seeding: ${text \|\| response.statusText}`);
		264	}
		265
		266	const parsed = await response.json() as {
		267	status?: string;
		268	value?: {
		269	anonymousAuthIssuer?: unknown;
		270	};
		271	};
		272
		273	if (parsed.status !== "success") {
		274	throw new Error(`Runtime seeding query returned unexpected status: ${JSON.stringify(parsed)}`);
		275	}
		276
		277	if (parsed.value?.anonymousAuthIssuer !== expectedAnonymousIssuer) {
		278	throw new Error(
		279	`Runtime seeding issuer mismatch. Expected ${expectedAnonymousIssuer}, got ${String(parsed.value?.anonymousAuthIssuer)}`,
		280	);
		281	}
		282	}
		283
249	async function seedManagedRuntimeState(	284	async function seedManagedRuntimeState(
250	rootDir: string,	285	rootDir: string,
251	runtimeDir: string,	286	runtimeDir: string,
252	config: RuntimeConfig,	287	config: RuntimeConfig,
253	anonymousAuth: AnonymousAuthSeed,	288	anonymousAuth: AnonymousAuthSeed,
254	): Promise<void> {	289	): Promise<void> {
		290	const expectedAnonymousIssuer = `http://${config.hostInterface}:${defaultManagedSitePort}`;
255	const adminKey = await generateSelfHostedAdminKey(config);	291	const adminKey = await generateSelfHostedAdminKey(config);
256	const tempDir = await fs.mkdtemp(path.join(os.tmpdir(), "executor-seed-env-"));	292	const tempDir = await fs.mkdtemp(path.join(os.tmpdir(), "executor-seed-env-"));
257	const envFilePath = path.join(tempDir, "selfhost.env");	293	const envFilePath = path.join(tempDir, "selfhost.env");
@@ -265,7 +301,7 @@ async function seedManagedRuntimeState( · 7 unmodified lines
265		301
266	const envEntries: Array<{ name: string; value: string }> = [	302	const envEntries: Array<{ name: string; value: string }> = [
267	{ name: "WORKOS_CLIENT_ID", value: "disabled" },	303	{ name: "WORKOS_CLIENT_ID", value: "disabled" },
268	{ name: "ANONYMOUS_AUTH_ISSUER", value: `http://${config.hostInterface}:${defaultManagedSitePort}` },	304	{ name: "ANONYMOUS_AUTH_ISSUER", value: expectedAnonymousIssuer },
269	{ name: "ANONYMOUS_AUTH_PRIVATE_KEY_PEM", value: anonymousAuth.privateKeyPem },	305	{ name: "ANONYMOUS_AUTH_PRIVATE_KEY_PEM", value: anonymousAuth.privateKeyPem },
270	{ name: "ANONYMOUS_AUTH_PUBLIC_KEY_PEM", value: anonymousAuth.publicKeyPem },	306	{ name: "ANONYMOUS_AUTH_PUBLIC_KEY_PEM", value: anonymousAuth.publicKeyPem },
271	{ name: "MCP_API_KEY_SECRET", value: anonymousAuth.apiKeySecret },	307	{ name: "MCP_API_KEY_SECRET", value: anonymousAuth.apiKeySecret },
@@ -282,9 +318,7 @@ async function seedManagedRuntimeState( · 10 unmodified lines
282	cwd: rootDir,	318	cwd: rootDir,
283	});	319	});
284		320
285	await runCommand(["bunx", "convex", "run", "app:getClientConfig", "--env-file", envFilePath], {	321	await assertSeededClientConfig(config, expectedAnonymousIssuer);
286	cwd: rootDir,
287	});
288	} finally {	322	} finally {
289	await fs.rm(tempDir, { recursive: true, force: true });	323	await fs.rm(tempDir, { recursive: true, force: true });
290	}	324	}