lael-labs/executor

executor/apps/web/src/app/mcp/oauth/detect/route.ts+11−3

     },
   );
-  const hasBearerChallenge = /^Bearer\s/i.test(response.headers.get("WWW-Authenticate") ?? "");
+  const challengeHeader = response.headers.get("WWW-Authenticate") ?? "";
-  const challenge = extractWWWAuthenticateParams(response);
+  const hasBearerChallenge = /^Bearer\s/i.test(challengeHeader);
   await response.body?.cancel();
   if ((response.status === 401 || response.status === 403) && hasBearerChallenge) {
     return true;
   }
+  let challenge: ReturnType<typeof extractWWWAuthenticateParams>;
+  try {
+    challenge = extractWWWAuthenticateParams(response);
+  } catch {
+    return false;
+  }
   return Boolean(challenge.resourceMetadataUrl);
 }
     const probeDetail = challengeProbeResult.isOk()
       ? ""
       : `; challenge probe: ${resultErrorMessage(challengeProbeResult.error, "failed")}`;
     return noStoreJson({
       oauth: false,
       authorizationServers: [],
       detail: `${resultErrorMessage(metadataResult.error, "OAuth metadata lookup failed")}${probeDetail}`,
-    }, 502);
+    });
   }
   const metadata = metadataResult.value;

executor/apps/web/src/components/tools/add/source-dialog.tsx+25−15

@@ -113,7 +113,7 @@ export function AddSourceDialog({ · 112 unmodified lines
113	const credentialsLoading = Boolean(context) && credentials === undefined;	113	const credentialsLoading = Boolean(context) && credentials === undefined;
114	const [open, setOpen] = useState(false);	114	const [open, setOpen] = useState(false);
115	const [submitting, setSubmitting] = useState(false);	115	const [submitting, setSubmitting] = useState(false);
116	const [mcpOAuthBusy, setMcpOAuthBusy] = useState(false);	116	const [sourceOAuthBusy, setSourceOAuthBusy] = useState(false);
117	const [deleting, setDeleting] = useState(false);	117	const [deleting, setDeleting] = useState(false);
118		118
119	const sourceDialogHeader = sourceToEdit ? "Edit Tool Source" : "Add Tool Source";	119	const sourceDialogHeader = sourceToEdit ? "Edit Tool Source" : "Add Tool Source";
@@ -218,20 +218,30 @@ export function AddSourceDialog({ · 98 unmodified lines
218	setOpen(false);	218	setOpen(false);
219	};	219	};
220		220
221	const handleMcpOAuthConnect = async () => {	221	const sourceOAuthConnectUrl = (): string => {
222	if (form.type !== "mcp") {	222	if (form.type === "openapi") {
		223	return form.baseUrl.trim() \|\| form.endpoint.trim();
		224	}
		225
		226	return form.endpoint.trim();
		227	};
		228
		229	const handleSourceOAuthConnect = async () => {
		230	if (form.type !== "mcp" && form.type !== "openapi") {
223	return;	231	return;
224	}	232	}
225	const endpoint = form.endpoint.trim();	233
		234	const endpoint = sourceOAuthConnectUrl();
226	if (!endpoint) {	235	if (!endpoint) {
227	toast.error("Enter an MCP endpoint URL first");	236	const fieldName = form.type === "openapi" ? "spec or API base URL" : "endpoint URL";
		237	toast.error(`Enter a ${fieldName} first`);
228	return;	238	return;
229	}	239	}
230	const initiatedEndpoint = normalizeEndpoint(endpoint);	240	const initiatedEndpoint = normalizeEndpoint(endpoint);
231		241
232	setMcpOAuthBusy(true);	242	setSourceOAuthBusy(true);
233	const oauthResult = await Result.tryPromise(() => startMcpOAuthPopup(endpoint));	243	const oauthResult = await Result.tryPromise(() => startMcpOAuthPopup(endpoint));
234	setMcpOAuthBusy(false);	244	setSourceOAuthBusy(false);
235		245
236	if (!oauthResult.isOk()) {	246	if (!oauthResult.isOk()) {
237	toast.error(resultErrorMessage(oauthResult.error, "Failed to connect OAuth"));	247	toast.error(resultErrorMessage(oauthResult.error, "Failed to connect OAuth"));
@@ -244,7 +254,7 @@ export function AddSourceDialog({ · 6 unmodified lines
244	return;	254	return;
245	}	255	}
246		256
247	const currentEndpoint = normalizeEndpoint(form.endpoint);	257	const currentEndpoint = normalizeEndpoint(sourceOAuthConnectUrl());
248	if (currentEndpoint !== initiatedEndpoint) {	258	if (currentEndpoint !== initiatedEndpoint) {
249	toast.error("Endpoint changed while OAuth was running. Please reconnect OAuth.");	259	toast.error("Endpoint changed while OAuth was running. Please reconnect OAuth.");
250	return;	260	return;
@@ -254,7 +264,7 @@ export function AddSourceDialog({ · 3 unmodified lines
254	form.handleAuthTypeChange("bearer");	264	form.handleAuthTypeChange("bearer");
255	}	265	}
256	form.handleAuthFieldChange("tokenValue", oauthResult.value.accessToken);	266	form.handleAuthFieldChange("tokenValue", oauthResult.value.accessToken);
257	form.markMcpOAuthLinked(initiatedEndpoint);	267	form.markSourceOAuthLinked(initiatedEndpoint);
258	toast.success("OAuth linked successfully.");	268	toast.success("OAuth linked successfully.");
259	};	269	};
260		270
@@ -445,10 +455,10 @@ export function AddSourceDialog({ · 184 unmodified lines
445	specStatus: form.specStatus,	455	specStatus: form.specStatus,
446	inferredSpecAuth: form.inferredSpecAuth,	456	inferredSpecAuth: form.inferredSpecAuth,
447	specError: form.specError,	457	specError: form.specError,
448	mcpOAuthStatus: form.mcpOAuthStatus,	458	sourceOAuthStatus: form.sourceOAuthStatus,
449	mcpOAuthDetail: form.mcpOAuthDetail,	459	sourceOAuthDetail: form.sourceOAuthDetail,
450	mcpOAuthAuthorizationServers: form.mcpOAuthAuthorizationServers,	460	sourceOAuthAuthorizationServers: form.sourceOAuthAuthorizationServers,
451	mcpOAuthConnected: form.mcpOAuthConnected,	461	sourceOAuthConnected: form.sourceOAuthConnected,
452	authType: form.authType,	462	authType: form.authType,
453	scopeType: form.scopeType,	463	scopeType: form.scopeType,
454	authScope: form.authScope,	464	authScope: form.authScope,
@@ -462,8 +472,8 @@ export function AddSourceDialog({ · 7 unmodified lines
462	onAuthTypeChange={form.handleAuthTypeChange}	472	onAuthTypeChange={form.handleAuthTypeChange}
463	onScopeChange={form.handleScopePresetChange}	473	onScopeChange={form.handleScopePresetChange}
464	onFieldChange={form.handleAuthFieldChange}	474	onFieldChange={form.handleAuthFieldChange}
465	onMcpOAuthConnect={form.type === "mcp" ? handleMcpOAuthConnect : undefined}	475	onSourceOAuthConnect={form.type === "mcp" \|\| form.type === "openapi" ? handleSourceOAuthConnect : undefined}
466	mcpOAuthBusy={mcpOAuthBusy}	476	sourceOAuthBusy={sourceOAuthBusy}
467	/>	477	/>
468	</CustomViewSection>	478	</CustomViewSection>
469	)}	479	)}

executor/apps/web/src/components/tools/add/source/auth-panel.tsx+42−41

   specStatus: "idle" | "detecting" | "ready" | "error";
   inferredSpecAuth: InferredSpecAuth | null;
   specError: string;
-  mcpOAuthStatus: "idle" | "checking" | "oauth" | "none" | "error";
+  sourceOAuthStatus: "idle" | "checking" | "oauth" | "none" | "error";
-  mcpOAuthDetail: string;
+  sourceOAuthDetail: string;
-  mcpOAuthAuthorizationServers: string[];
+  sourceOAuthAuthorizationServers: string[];
-  mcpOAuthConnected: boolean;
+  sourceOAuthConnected: boolean;
   authType: Exclude<SourceAuthType, "mixed">;
   scopeType: "organization" | "workspace";
   authScope: CredentialScope;
   onAuthTypeChange,
   onScopeChange,
   onFieldChange,
-  onMcpOAuthConnect,
+  onSourceOAuthConnect,
-  mcpOAuthBusy = false,
+  sourceOAuthBusy = false,
 }: {
   model: SourceAuthPanelModel;
   onAuthTypeChange: (value: Exclude<SourceAuthType, "mixed">) => void;
   onScopeChange: (value: SharingScope) => void;
   onFieldChange: (field: SourceAuthPanelEditableField, value: string) => void;
-  onMcpOAuthConnect?: () => void;
+  onSourceOAuthConnect?: () => void;
-  mcpOAuthBusy?: boolean;
+  sourceOAuthBusy?: boolean;
 }) {
   const {
     sourceType,
     specStatus,
     inferredSpecAuth,
     specError,
-    mcpOAuthStatus,
+    sourceOAuthStatus,
-    mcpOAuthDetail,
+    sourceOAuthDetail,
-    mcpOAuthAuthorizationServers,
+    sourceOAuthAuthorizationServers,
-    mcpOAuthConnected,
+    sourceOAuthConnected,
     authType,
     apiKeyHeader,
     tokenValue,
   }
   const badge = inferredAuthBadge(inferredSpecAuth);
-  const mcpBearerConnected = sourceType === "mcp" && authType === "bearer" && mcpOAuthConnected;
+  const usesSourceOAuthFlow = sourceType === "mcp" || sourceType === "openapi";
-  const mcpOAuthLoading = sourceType === "mcp" && mcpOAuthStatus === "checking";
+  const bearerOAuthConnected = usesSourceOAuthFlow && authType === "bearer" && sourceOAuthConnected;
-  const mcpOAuthDetected = sourceType === "mcp" && mcpOAuthStatus === "oauth";
+  const sourceOAuthLoading = usesSourceOAuthFlow && sourceOAuthStatus === "checking";
-  const useMcpOAuthFlow = mcpOAuthLoading || mcpOAuthDetected;
+  const sourceOAuthDetected = usesSourceOAuthFlow && sourceOAuthStatus === "oauth";
+  const useSourceOAuthFlow = sourceOAuthLoading || sourceOAuthDetected;
   return (
     <div className="space-y-3">
         </div>
       ) : null}
-      {sourceType === "mcp" ? (
+      {usesSourceOAuthFlow ? (
         <div className="flex items-center gap-2 flex-wrap">
           <Badge variant="outline" className="text-[10px] uppercase tracking-wider">
-            {mcpOAuthStatus === "idle"
+            {sourceOAuthStatus === "idle"
               ? "Awaiting URL"
-              : mcpOAuthStatus === "checking"
+              : sourceOAuthStatus === "checking"
-              ? "Checking OAuth"
+                ? "Checking OAuth"
-              : mcpOAuthStatus === "oauth"
+                : sourceOAuthStatus === "oauth"
-                ? "OAuth detected"
+                  ? "OAuth detected"
-                : mcpOAuthStatus === "error"
+                  : sourceOAuthStatus === "error"
-                  ? "OAuth unknown"
+                    ? "OAuth unknown"
-                  : "No OAuth metadata"}
+                    : "No OAuth metadata"}
           </Badge>
-          {mcpOAuthAuthorizationServers.length > 0 ? (
+          {sourceOAuthAuthorizationServers.length > 0 ? (
             <span className="text-[10px] text-muted-foreground">
-              {mcpOAuthAuthorizationServers[0]}
+              {sourceOAuthAuthorizationServers[0]}
             </span>
           ) : null}
-          {mcpOAuthStatus === "error" && mcpOAuthDetail ? (
+          {sourceOAuthStatus === "error" && sourceOAuthDetail ? (
-            <span className="text-[10px] text-terminal-amber">{mcpOAuthDetail}</span>
+            <span className="text-[10px] text-terminal-amber">{sourceOAuthDetail}</span>
           ) : null}
         </div>
       ) : null}
-      <div className={`grid ${useMcpOAuthFlow ? "grid-cols-1" : "grid-cols-2"} gap-3`}>
+      <div className={`grid ${useSourceOAuthFlow ? "grid-cols-1" : "grid-cols-2"} gap-3`}>
-        {!useMcpOAuthFlow ? (
+        {!useSourceOAuthFlow ? (
           <div className="space-y-1.5">
             <Label className="text-xs text-muted-foreground">Auth Type</Label>
             <Select value={authType} onValueChange={(value) => onAuthTypeChange(value as Exclude<SourceAuthType, "mixed">)}>
         </div>
       </div>
-      {sourceType === "mcp" && useMcpOAuthFlow && onMcpOAuthConnect ? (
+      {usesSourceOAuthFlow && useSourceOAuthFlow && onSourceOAuthConnect ? (
         <div className="space-y-1.5">
           <div className="flex items-center gap-2">
             <Label className="text-xs text-muted-foreground">OAuth</Label>
-            {mcpBearerConnected ? (
+            {bearerOAuthConnected ? (
               <Badge variant="outline" className="text-[10px] uppercase tracking-wider text-terminal-green">
                 Connected
               </Badge>
             ) : null}
           </div>
-          {mcpOAuthLoading ? (
+          {sourceOAuthLoading ? (
             <Skeleton className="h-8 w-full" />
           ) : (
             <Button
               variant="outline"
               size="sm"
               className="h-8 text-xs"
-              disabled={mcpOAuthBusy}
+              disabled={sourceOAuthBusy}
-              onClick={onMcpOAuthConnect}
+              onClick={onSourceOAuthConnect}
             >
-              {mcpOAuthBusy ? "Connecting..." : mcpBearerConnected ? "Reconnect OAuth" : "Connect OAuth in popup"}
+              {sourceOAuthBusy ? "Connecting..." : bearerOAuthConnected ? "Reconnect OAuth" : "Connect OAuth in popup"}
             </Button>
           )}
-          {mcpBearerConnected ? (
+          {bearerOAuthConnected ? (
             <p className="text-[11px] text-muted-foreground">OAuth linked successfully.</p>
           ) : null}
         </div>
         </div>
       ) : null}
-      {authType === "bearer" && sourceType !== "mcp" && !mcpBearerConnected ? (
+      {authType === "bearer" && !usesSourceOAuthFlow ? (
         <div className="space-y-1.5">
           <Label className="text-xs text-muted-foreground flex items-center gap-1.5">
             <LockKeyhole className="h-3 w-3" />
         </div>
       ) : null}
-      {authType === "apiKey" && !useMcpOAuthFlow ? (
+      {authType === "apiKey" && !useSourceOAuthFlow ? (
         <div className="space-y-1.5">
           <Label className="text-xs text-muted-foreground flex items-center gap-1.5">
             <KeyRound className="h-3 w-3" />
         </div>
       ) : null}
-      {authType === "basic" && !useMcpOAuthFlow ? (
+      {authType === "basic" && !useSourceOAuthFlow ? (
         <div className="grid grid-cols-2 gap-3">
           <div className="space-y-1.5">
             <Label className="text-xs text-muted-foreground flex items-center gap-1.5">

executor/apps/web/src/components/tools/add/source/form-utils.ts+2−2

@@ -53,7 +53,7 @@ export type AddSourceUiState = { · 52 unmodified lines
53	locallyReservedNames: string[];	53	locallyReservedNames: string[];
54	authManuallyEdited: boolean;	54	authManuallyEdited: boolean;
55	authRevision: number;	55	authRevision: number;
56	mcpOAuthLinkedEndpoint: string \| null;	56	sourceOAuthLinkedEndpoint: string \| null;
57	};	57	};
58		58
59	export function createDefaultUiState(view: SourceDialogView = "catalog"): AddSourceUiState {	59	export function createDefaultUiState(view: SourceDialogView = "catalog"): AddSourceUiState {
@@ -65,7 +65,7 @@ export function createDefaultUiState(view: SourceDialogView = "catalog"): AddSou · 5 unmodified lines
65	locallyReservedNames: [],	65	locallyReservedNames: [],
66	authManuallyEdited: false,	66	authManuallyEdited: false,
67	authRevision: 0,	67	authRevision: 0,
68	mcpOAuthLinkedEndpoint: null,	68	sourceOAuthLinkedEndpoint: null,
69	};	69	};
70	}	70	}
71		71

executor/apps/web/src/components/tools/use/add/source/form-state.ts+44−39

       .sort((a, b) => b.updatedAt - a.updatedAt)[0] ?? null;
   }, [accountId, credentialItems, editingSourceKey, values.authScope, values.scopeType]);
-  const hasPersistedMcpBearerToken = useMemo(() => {
+  const hasPersistedSourceBearerToken = useMemo(() => {
-    if (values.type !== "mcp" || values.authType !== "bearer") {
+    if ((values.type !== "mcp" && values.type !== "openapi") || values.authType !== "bearer") {
       return false;
     }
     if (!existingScopedCredential) {
   const handleEndpointChange = (endpoint: string) => {
     form.setValue("endpoint", endpoint, { shouldDirty: true, shouldTouch: true });
-    patchUi(setUi, { mcpOAuthLinkedEndpoint: null });
+    patchUi(setUi, { sourceOAuthLinkedEndpoint: null });
     if (values.type === "openapi") {
       const inferredBaseUrl = deriveBaseUrlFromEndpoint(endpoint);
       patchUi(setUi, {
         openApiBaseUrlOptions: inferredBaseUrl ? [inferredBaseUrl] : [],
         authManuallyEdited: false,
-        mcpOAuthLinkedEndpoint: null,
+        sourceOAuthLinkedEndpoint: null,
       });
       if (!baseUrlManuallyEdited) {
         form.setValue("baseUrl", inferredBaseUrl, { shouldDirty: false, shouldTouch: false });
     patchUiWithAuthRevision(setUi, {
       openApiBaseUrlOptions: [],
       authManuallyEdited: false,
-      mcpOAuthLinkedEndpoint: null,
+      sourceOAuthLinkedEndpoint: null,
     });
     form.setValue("authType", "none", { shouldDirty: false, shouldTouch: false });
     form.setValue("authScope", "workspace", { shouldDirty: false, shouldTouch: false });
     form.setValue("authType", authType, { shouldDirty: true, shouldTouch: true });
     patchUiWithAuthRevision(setUi, {
       authManuallyEdited: true,
-      ...(authType === "bearer" ? {} : { mcpOAuthLinkedEndpoint: null }),
+      ...(authType === "bearer" ? {} : { sourceOAuthLinkedEndpoint: null }),
     });
   };
     form.setValue("authScope", authScope, { shouldDirty: true, shouldTouch: true });
     patchUiWithAuthRevision(setUi, {
       authManuallyEdited: true,
-      mcpOAuthLinkedEndpoint: null,
+      sourceOAuthLinkedEndpoint: null,
     });
   };
     if (field === "tokenValue") {
       form.setValue("tokenValue", value, { shouldDirty: true, shouldTouch: true });
-      patchUiWithAuthRevision(setUi, { mcpOAuthLinkedEndpoint: null });
+      patchUiWithAuthRevision(setUi, { sourceOAuthLinkedEndpoint: null });
       return;
     }
     if (field === "apiKeyValue") {
       : "Failed to fetch spec"
     : "";
-  const mcpDetectionEndpoint = useDeferredValue(values.endpoint.trim());
+  const sourceOAuthDetectionEndpoint = useDeferredValue(values.type === "openapi"
-  const mcpDetectionEnabled = open
+    ? (values.baseUrl.trim() || values.endpoint).trim()
+    : values.endpoint.trim());
+  const sourceOAuthDetectionEnabled = open
     && ui.view === "custom"
-    && values.type === "mcp"
+    && (values.type === "mcp" || values.type === "openapi")
-    && mcpDetectionEndpoint.length > 0;
+    && sourceOAuthDetectionEndpoint.length > 0;
-  const mcpOAuthQuery = useTanstackQuery({
+  const sourceOAuthQuery = useTanstackQuery({
-    queryKey: ["mcp-oauth-detect", mcpDetectionEndpoint],
+    queryKey: ["mcp-oauth-detect", sourceOAuthDetectionEndpoint],
     queryFn: async () => {
       const controller = new AbortController();
       const timeoutId = setTimeout(() => controller.abort(), MCP_OAUTH_DETECT_REQUEST_TIMEOUT_MS);
       try {
-        const response = await fetch(`/mcp/oauth/detect?sourceUrl=${encodeURIComponent(mcpDetectionEndpoint)}`, {
+        const response = await fetch(`/mcp/oauth/detect?sourceUrl=${encodeURIComponent(sourceOAuthDetectionEndpoint)}`, {
           signal: controller.signal,
           cache: "no-store",
         });
         clearTimeout(timeoutId);
       }
     },
-    enabled: mcpDetectionEnabled,
+    enabled: sourceOAuthDetectionEnabled,
     retry: false,
     staleTime: 60_000,
   });
-  const mcpOAuthStatus: "idle" | "checking" | "oauth" | "none" | "error" = !mcpDetectionEnabled
+  const sourceOAuthStatus: "idle" | "checking" | "oauth" | "none" | "error" = !sourceOAuthDetectionEnabled
     ? "idle"
-    : mcpOAuthQuery.isFetching
+    : sourceOAuthQuery.isFetching
       ? "checking"
-      : mcpOAuthQuery.isError
+      : sourceOAuthQuery.isError
         ? "error"
-        : mcpOAuthQuery.data?.oauth
+        : sourceOAuthQuery.data?.oauth
           ? "oauth"
           : "none";
-  const mcpOAuthDetail = mcpDetectionEnabled
+  const sourceOAuthDetail = sourceOAuthDetectionEnabled
-    ? mcpOAuthQuery.isError
+    ? sourceOAuthQuery.isError
-      ? mcpOAuthQuery.error instanceof Error
+      ? sourceOAuthQuery.error instanceof Error
-        ? mcpOAuthQuery.error.message
+        ? sourceOAuthQuery.error.message
         : "OAuth detection failed"
-      : mcpOAuthQuery.data?.detail ?? ""
+      : sourceOAuthQuery.data?.detail ?? ""
     : "";
-  const mcpOAuthAuthorizationServers = mcpOAuthQuery.data?.authorizationServers ?? [];
+  const sourceOAuthAuthorizationServers = sourceOAuthQuery.data?.authorizationServers ?? [];
-  const mcpOAuthConnected = values.type === "mcp"
+  const sourceOAuthConnectedEndpoint = values.type === "openapi"
+    ? values.baseUrl.trim() || values.endpoint
+    : values.endpoint;
+  const sourceOAuthConnected = (values.type === "mcp" || values.type === "openapi")
     && values.authType === "bearer"
-    && normalizeEndpointForOAuth(values.endpoint) !== ""
+    && normalizeEndpointForOAuth(sourceOAuthConnectedEndpoint) !== ""
-    && normalizeEndpointForOAuth(values.endpoint) === ui.mcpOAuthLinkedEndpoint
+    && normalizeEndpointForOAuth(sourceOAuthConnectedEndpoint) === ui.sourceOAuthLinkedEndpoint
     && values.tokenValue.trim().length > 0;
   useEffect(() => {
   }, [inspectionEnabled, inspectionEndpoint, specInspectionQuery.isError, ui.openApiBaseUrlOptions]);
   useEffect(() => {
-    if (values.type !== "mcp") {
+    if (values.type !== "mcp" && values.type !== "openapi") {
       return;
     }
-    if (mcpOAuthStatus !== "oauth") {
+    if (sourceOAuthStatus !== "oauth") {
       return;
     }
     if (values.authType !== "bearer") {
     if (values.authScope !== "workspace") {
       form.setValue("authScope", "workspace", { shouldDirty: false, shouldTouch: false });
     }
-  }, [form, mcpOAuthStatus, values.authScope, values.authType, values.type]);
+  }, [form, sourceOAuthStatus, values.authScope, values.authType, values.type]);
   const isNameTaken = (candidate: string) => {
     const taken = [...getTakenSourceNames()].map((entry) => entry.toLowerCase());
     visibleCatalogItems,
     specStatus,
     specError,
-    mcpOAuthStatus,
+    sourceOAuthStatus,
-    mcpOAuthDetail,
+    sourceOAuthDetail,
-    mcpOAuthAuthorizationServers,
+    sourceOAuthAuthorizationServers,
-    mcpOAuthConnected,
+    sourceOAuthConnected,
-    hasPersistedMcpBearerToken,
+    hasPersistedSourceBearerToken,
     inferredSpecAuth,
     authType: values.authType,
     authScope: values.authScope,
     handleAuthScopeChange,
     handleScopePresetChange: (scopePreset: SharingScope) => applySharingScope(form, scopePreset),
     handleAuthFieldChange,
-    markMcpOAuthLinked: (endpoint: string) =>
+    markSourceOAuthLinked: (endpoint: string) =>
       patchUi(setUi, {
-        mcpOAuthLinkedEndpoint: normalizeEndpointForOAuth(endpoint),
+        sourceOAuthLinkedEndpoint: normalizeEndpointForOAuth(endpoint),
       }),
     setBaseUrl: (baseUrl: string) => form.setValue("baseUrl", baseUrl, { shouldDirty: true, shouldTouch: true }),
     setMcpTransport: (mcpTransport: "auto" | "streamable-http" | "sse") =>

executor/apps/web/src/lib/openapi/spec-inspector.ts+181−0

@@ -2,6 +2,7 @@ import { Result } from "better-result"; · 1 unmodified line
2	import { parse as parseYaml } from "yaml";	2	import { parse as parseYaml } from "yaml";
3	import { z } from "zod";	3	import { z } from "zod";
4	import type { CredentialScope, SourceAuthType } from "@/lib/types";	4	import type { CredentialScope, SourceAuthType } from "@/lib/types";
		5	import { HARD_CODED_CATALOG_ITEMS } from "@/lib/catalog-collections";
5		6
6	type SupportedAuthType = Exclude<SourceAuthType, "none" \| "mixed">;	7	type SupportedAuthType = Exclude<SourceAuthType, "none" \| "mixed">;
7		8
@@ -17,6 +18,147 @@ type OpenApiInspectionResult = { · 9 unmodified lines
17	inferredAuth: InferredSpecAuth;	18	inferredAuth: InferredSpecAuth;
18	};	19	};
19		20
		21	export type OpenApiSpecDiscoveryResult = OpenApiInspectionResult & {
		22	specUrl: string;
		23	discovered: boolean;
		24	attemptedSpecUrls: string[];
		25	};
		26
		27	const OPENAPI_SPEC_PATH_HINTS = [
		28	"/openapi.json",
		29	"/openapi.yaml",
		30	"/openapi.yml",
		31	"/swagger.json",
		32	"/swagger.yaml",
		33	"/swagger.yml",
		34	"/api-docs",
		35	"/api-docs.json",
		36	"/api-docs.yaml",
		37	"/api-docs.yml",
		38	"/v3/api-docs",
		39	"/v2/api-docs",
		40	"/docs/openapi.json",
		41	"/docs/openapi.yaml",
		42	"/docs/openapi.yml",
		43	"/.well-known/openapi.json",
		44	"/.well-known/openapi.yaml",
		45	"/.well-known/openapi.yml",
		46	"/.well-known/openapi",
		47	];
		48
		49	const OPENAPI_SPEC_RELATIVE_HINTS = [
		50	"openapi.json",
		51	"openapi.yaml",
		52	"openapi.yml",
		53	"swagger.json",
		54	"swagger.yaml",
		55	"swagger.yml",
		56	"api-docs",
		57	"api-docs.json",
		58	"api-docs.yaml",
		59	"api-docs.yml",
		60	"v3/api-docs",
		61	"v2/api-docs",
		62	"docs/openapi.json",
		63	"docs/openapi.yaml",
		64	"docs/openapi.yml",
		65	".well-known/openapi.json",
		66	".well-known/openapi.yaml",
		67	".well-known/openapi.yml",
		68	"openapi",
		69	"swagger.json",
		70	];
		71
		72	function isLikelySpecCandidateUrl(text: string): boolean {
		73	const lowered = text.toLowerCase();
		74	return lowered.endsWith(".json") \|\| lowered.endsWith(".yaml") \|\| lowered.endsWith(".yml")
		75	\|\| lowered.endsWith("/openapi") \|\| lowered.includes("openapi") \|\| lowered.includes("swagger");
		76	}
		77
		78	function dedupeUrls(values: string[]): string[] {
		79	const seen = new Set<string>();
		80	const next: string[] = [];
		81
		82	for (const value of values) {
		83	const normalized = value.trim();
		84	if (!normalized) {
		85	continue;
		86	}
		87
		88	if (seen.has(normalized)) {
		89	continue;
		90	}
		91	seen.add(normalized);
		92	next.push(normalized);
		93	}
		94
		95	return next;
		96	}
		97
		98	function buildOpenApiSpecCandidateUrls(sourceUrl: string): string[] {
		99	const parsedSource = new URL(sourceUrl);
		100	const sourceOrigin = parsedSource.origin;
		101	const cleanedSource = (() => {
		102	const cleaned = new URL(sourceUrl);
		103	cleaned.hash = "";
		104	cleaned.search = "";
		105	return cleaned.toString();
		106	})();
		107
		108	const candidates: string[] = [cleanedSource];
		109
		110	if (isLikelySpecCandidateUrl(cleanedSource)) {
		111	candidates.unshift(cleanedSource);
		112	}
		113
		114	const sourceHost = parsedSource.hostname.toLowerCase();
		115	const catalogHints = HARD_CODED_CATALOG_ITEMS
		116	.filter((item) => item.sourceType === "openapi" && item.specUrl)
		117	.map((item): string \| null => {
		118	if (!item.originUrl) {
		119	return null;
		120	}
		121
		122	try {
		123	const origin = new URL(item.originUrl);
		124	return origin.hostname.toLowerCase() === sourceHost ? item.specUrl : null;
		125	} catch {
		126	return null;
		127	}
		128	})
		129	.filter((entry): entry is string => Boolean(entry));
		130
		131	candidates.push(...catalogHints);
		132
		133	const pathBase = parsedSource.pathname.endsWith("/")
		134	? parsedSource.pathname
		135	: parsedSource.pathname.replace(/[^/]*$/, "");
		136	const baseWithSlash = pathBase.length === 0 ? "/" : pathBase;
		137
		138	const absoluteRoots = [
		139	`${sourceOrigin}/`,
		140	`${sourceOrigin}${baseWithSlash}`,
		141	];
		142
		143	for (const root of absoluteRoots) {
		144	for (const pathHint of OPENAPI_SPEC_PATH_HINTS) {
		145	candidates.push(new URL(pathHint, root).toString());
		146	}
		147	}
		148
		149	const relativeRoots = [
		150	`${sourceOrigin}/`,
		151	`${sourceOrigin}${baseWithSlash}`,
		152	];
		153	for (const root of relativeRoots) {
		154	for (const pathHint of OPENAPI_SPEC_RELATIVE_HINTS) {
		155	candidates.push(new URL(pathHint, `${root}/`).toString());
		156	}
		157	}
		158
		159	return dedupeUrls(candidates);
		160	}
		161
20	const recordSchema = z.record(z.unknown());	162	const recordSchema = z.record(z.unknown());
21		163
22	const securityRequirementSchema = z.record(z.array(z.unknown()).optional());	164	const securityRequirementSchema = z.record(z.array(z.unknown()).optional());
@@ -183,3 +325,42 @@ export async function fetchAndInspectOpenApiSpec(input: { · 160 unmodified lines
183	const inferredAuth = inferSecuritySchemaAuth(spec);	325	const inferredAuth = inferSecuritySchemaAuth(spec);
184	return { spec, inferredAuth };	326	return { spec, inferredAuth };
185	}	327	}
		328
		329	export async function discoverOpenApiSpecFromUrl(input: {
		330	sourceUrl: string;
		331	headers?: Record<string, string>;
		332	signal?: AbortSignal;
		333	}): Promise<OpenApiSpecDiscoveryResult> {
		334	const sourceUrl = input.sourceUrl.trim();
		335	if (!sourceUrl) {
		336	throw new Error("Spec URL is required");
		337	}
		338
		339	const candidates = buildOpenApiSpecCandidateUrls(sourceUrl);
		340
		341	let lastError: unknown;
		342	for (const candidate of candidates) {
		343	try {
		344	const result = await fetchAndInspectOpenApiSpec({
		345	specUrl: candidate,
		346	headers: input.headers,
		347	signal: input.signal,
		348	});
		349
		350	return {
		351	...result,
		352	specUrl: candidate,
		353	discovered: candidate !== sourceUrl,
		354	attemptedSpecUrls: candidates,
		355	};
		356	} catch (error) {
		357	lastError = error;
		358	}
		359	}
		360
		361	if (lastError instanceof Error) {
		362	throw lastError;
		363	}
		364
		365	throw new Error("No OpenAPI spec URL found");
		366	}

executor/packages/core/src/mcp-server.test.ts+0−1

@@ -73,7 +73,6 @@ class FakeMcpService { · 72 unmodified lines
73	workspaceId: `ws_${crypto.randomUUID()}` as Id<"workspaces">,	73	workspaceId: `ws_${crypto.randomUUID()}` as Id<"workspaces">,
74	clientId: "mcp",	74	clientId: "mcp",
75	accountId: `account_${crypto.randomUUID()}` as Id<"accounts">,	75	accountId: `account_${crypto.randomUUID()}` as Id<"accounts">,
76	userId: `member_${crypto.randomUUID()}` as Id<"workspaceMembers">,
77	createdAt: now,	76	createdAt: now,
78	lastSeenAt: now,	77	lastSeenAt: now,
79	};	78	};

executor/packages/core/src/types.ts+0−1

@@ -170,7 +170,6 @@ export interface AnonymousContext { · 169 unmodified lines
170	workspaceId: Id<"workspaces">;	170	workspaceId: Id<"workspaces">;
171	clientId: string;	171	clientId: string;
172	accountId: Id<"accounts">;	172	accountId: Id<"accounts">;
173	userId: Id<"workspaceMembers">;
174	createdAt: number;	173	createdAt: number;
175	lastSeenAt: number;	174	lastSeenAt: number;
176	}	175	}

executor/packages/database/convex/_generated/api.d.ts+0−60

@@ -479,12 +479,6 @@ export declare const internal: { · 478 unmodified lines
479	{ accountId?: string; clientId?: string; sessionId?: string },	479	{ accountId?: string; clientId?: string; sessionId?: string },
480	any	480	any
481	>;	481	>;
482	ensureAnonymousMcpSession: FunctionReference<
483	"mutation",
484	"internal",
485	{ accountId: string; workspaceId: Id<"workspaces"> },
486	any
487	>;
488	};	482	};
489	approvals: {	483	approvals: {
490	createApproval: FunctionReference<	484	createApproval: FunctionReference<
@@ -621,12 +615,6 @@ export declare const internal: { · 130 unmodified lines
621	{ sourceId: string; workspaceId: Id<"workspaces"> },	615	{ sourceId: string; workspaceId: Id<"workspaces"> },
622	any	616	any
623	>;	617	>;
624	ensureAnonymousMcpSession: FunctionReference<
625	"mutation",
626	"internal",
627	{ accountId: string; workspaceId: Id<"workspaces"> },
628	any
629	>;
630	finishToolCall: FunctionReference<	618	finishToolCall: FunctionReference<
631	"mutation",	619	"mutation",
632	"internal",	620	"internal",
@@ -1122,54 +1110,6 @@ export declare const internal: { · 489 unmodified lines
1122	>;	1110	>;
1123	};	1111	};
1124	migrations: {	1112	migrations: {
1125	cleanupAccessPolicyEmptyStringSentinels: FunctionReference<
1126	"mutation",
1127	"internal",
1128	{
1129	batchSize?: number;
1130	cursor?: string \| null;
1131	dryRun?: boolean;
1132	fn?: string;
1133	next?: Array<string>;
1134	},
1135	any
1136	>;
1137	cleanupTaskEmptyStringSentinels: FunctionReference<
1138	"mutation",
1139	"internal",
1140	{
1141	batchSize?: number;
1142	cursor?: string \| null;
1143	dryRun?: boolean;
1144	fn?: string;
1145	next?: Array<string>;
1146	},
1147	any
1148	>;
1149	deleteAnonymousSessionsMissingAccountId: FunctionReference<
1150	"mutation",
1151	"internal",
1152	{
1153	batchSize?: number;
1154	cursor?: string \| null;
1155	dryRun?: boolean;
1156	fn?: string;
1157	next?: Array<string>;
1158	},
1159	any
1160	>;
1161	deleteSourceCredentialsMissingProvider: FunctionReference<
1162	"mutation",
1163	"internal",
1164	{
1165	batchSize?: number;
1166	cursor?: string \| null;
1167	dryRun?: boolean;
1168	fn?: string;
1169	next?: Array<string>;
1170	},
1171	any
1172	>;
1173	run: FunctionReference<	1113	run: FunctionReference<
1174	"mutation",	1114	"mutation",
1175	"internal",	1115	"internal",

executor/packages/database/convex/database.test.ts+0−2

   expect(first.sessionId).toContain("anon_session_");
   expect(first.workspaceId.length).toBeGreaterThan(0);
   expect(first.accountId).toBeDefined();
-  expect(first.userId).toBeDefined();
   const again = await t.mutation(internal.database.bootstrapAnonymousSession, {
     sessionId: first.sessionId,
   expect(again.sessionId).toBe(first.sessionId);
   expect(again.accountId).toBe(first.accountId);
-  expect(again.userId).toBe(first.userId);
 });
 test("bootstrap ignores non-MCP caller-provided session id", async () => {

executor/packages/database/convex/database.ts+1−1

@@ -22,7 +22,7 @@ export { · 21 unmodified lines
22	finishToolCall,	22	finishToolCall,
23	listToolCalls,	23	listToolCalls,
24	} from "./database/tool_calls";	24	} from "./database/tool_calls";
25	export { bootstrapAnonymousSession, ensureAnonymousMcpSession } from "./database/anonymous_session";	25	export { bootstrapAnonymousSession } from "./database/anonymous_session";
26	export {	26	export {
27	listRuntimeTargets,	27	listRuntimeTargets,
28	upsertAccessPolicy,	28	upsertAccessPolicy,

executor/packages/database/convex/database/anonymous_session.ts+0−76

@@ -37,7 +37,6 @@ export const bootstrapAnonymousSession = internalMutation({ · 36 unmodified lines
37	clientId,	37	clientId,
38	workspaceId: identity.workspaceId,	38	workspaceId: identity.workspaceId,
39	accountId: identity.accountId,	39	accountId: identity.accountId,
40	userId: identity.userId,
41	lastSeenAt: now,	40	lastSeenAt: now,
42	});	41	});
43		42
@@ -70,7 +69,6 @@ export const bootstrapAnonymousSession = internalMutation({ · 26 unmodified lines
70	workspaceId: identity.workspaceId,	69	workspaceId: identity.workspaceId,
71	clientId,	70	clientId,
72	accountId: identity.accountId,	71	accountId: identity.accountId,
73	userId: identity.userId,
74	createdAt: now,	72	createdAt: now,
75	lastSeenAt: now,	73	lastSeenAt: now,
76	});	74	});
@@ -86,77 +84,3 @@ export const bootstrapAnonymousSession = internalMutation({ · 9 unmodified lines
86	return mapAnonymousContext(created);	84	return mapAnonymousContext(created);
87	},	85	},
88	});	86	});
89
90	export const ensureAnonymousMcpSession = internalMutation({
91	args: {
92	workspaceId: v.id("workspaces"),
93	accountId: v.string(),
94	},
95	handler: async (ctx, args) => {
96	const accountId = args.accountId.trim();
97	if (!accountId) {
98	throw new Error("Anonymous accountId is required");
99	}
100
101	const account = await ctx.db.get(accountId as Id<"accounts">);
102	if (!account \|\| account.provider !== "anonymous") {
103	throw new Error("Anonymous account is not recognized");
104	}
105
106	const membership = await ctx.db
107	.query("workspaceMembers")
108	.withIndex("by_workspace_account", (q) => q.eq("workspaceId", args.workspaceId).eq("accountId", account._id))
109	.unique();
110	if (!membership \|\| membership.status !== "active") {
111	throw new Error("Anonymous account does not have workspace access");
112	}
113
114	const now = Date.now();
115	const existingSessions = await ctx.db
116	.query("anonymousSessions")
117	.withIndex("by_workspace_account", (q) => q.eq("workspaceId", args.workspaceId).eq("accountId", account._id))
118	.collect();
119	const existing = existingSessions.find((session) => session.sessionId.startsWith("mcp_"))
120	?? existingSessions[0]
121	?? null;
122
123	if (existing) {
124	await ctx.db.patch(existing._id, {
125	accountId: account._id,
126	userId: membership._id,
127	clientId: "mcp",
128	lastSeenAt: now,
129	});
130
131	const refreshed = await ctx.db
132	.query("anonymousSessions")
133	.withIndex("by_session_id", (q) => q.eq("sessionId", existing.sessionId))
134	.unique();
135	if (!refreshed) {
136	throw new Error("Failed to refresh anonymous MCP session");
137	}
138	return mapAnonymousContext(refreshed);
139	}
140
141	const sessionId = `mcp_${crypto.randomUUID()}`;
142	await ctx.db.insert("anonymousSessions", {
143	sessionId,
144	workspaceId: args.workspaceId,
145	clientId: "mcp",
146	accountId: account._id,
147	userId: membership._id,
148	createdAt: now,
149	lastSeenAt: now,
150	});
151
152	const created = await ctx.db
153	.query("anonymousSessions")
154	.withIndex("by_session_id", (q) => q.eq("sessionId", sessionId))
155	.unique();
156	if (!created) {
157	throw new Error("Failed to create anonymous MCP session");
158	}
159
160	return mapAnonymousContext(created);
161	},
162	});

executor/packages/database/convex/executor-mcp.e2e.test.ts+0−232

@@ -1,232 +0,0 @@
1	import { expect, test } from "bun:test";
2	import { generateKeyPairSync } from "node:crypto";
3	import { convexTest } from "convex-test";
4	import { Client } from "@modelcontextprotocol/sdk/client/index.js";
5	import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
6	import { internal } from "./_generated/api";
7	import type { Id } from "./_generated/dataModel.d.ts";
8	import schema from "./schema";
9
10	function ensureAnonymousAuthKeysConfigured() {
11	if (process.env.ANONYMOUS_AUTH_PRIVATE_KEY_PEM && process.env.ANONYMOUS_AUTH_PUBLIC_KEY_PEM) {
12	return;
13	}
14
15	const { privateKey, publicKey } = generateKeyPairSync("ec", { namedCurve: "P-256" });
16	process.env.ANONYMOUS_AUTH_PRIVATE_KEY_PEM = privateKey.export({ type: "pkcs8", format: "pem" }).toString();
17	process.env.ANONYMOUS_AUTH_PUBLIC_KEY_PEM = publicKey.export({ type: "spki", format: "pem" }).toString();
18	}
19
20	ensureAnonymousAuthKeysConfigured();
21
22	function setup() {
23	return convexTest(schema, {
24	"./database.ts": () => import("./database"),
25	"./executor.ts": () => import("./executor"),
26	"./executorNode.ts": () => import("./executorNode"),
27	"./http.ts": () => import("./http"),
28	"./auth.ts": () => import("./auth"),
29	"./workspaceAuthInternal.ts": () => import("./workspaceAuthInternal"),
30	"./workspaceToolCache.ts": () => import("./workspaceToolCache"),
31	"./toolRegistry.ts": () => import("./toolRegistry"),
32	"./openApiSpecCache.ts": () => import("./openApiSpecCache"),
33	"./_generated/api.js": () => import("./_generated/api.js"),
34	});
35	}
36
37	type AnonymousTokenResponse = {
38	error?: unknown;
39	accessToken?: unknown;
40	};
41
42	function readErrorMessage(body: AnonymousTokenResponse): string {
43	return typeof body.error === "string" ? body.error : "";
44	}
45
46	function readAccessToken(body: AnonymousTokenResponse): string \| null {
47	return typeof body.accessToken === "string" && body.accessToken.length > 0 ? body.accessToken : null;
48	}
49
50	async function getAnonymousAccessToken(
51	t: ReturnType<typeof setup>,
52	accountId: string,
53	): Promise<string> {
54	const resp = await t.fetch(`/auth/anonymous/token?accountId=${encodeURIComponent(accountId)}`);
55	const body = await resp.json().catch(() => ({} as AnonymousTokenResponse)) as AnonymousTokenResponse;
56
57	if (!resp.ok) {
58	const message = readErrorMessage(body) \|\| `HTTP ${resp.status}`;
59	throw new Error(`Failed to issue anonymous token: ${message}`);
60	}
61
62	const token = readAccessToken(body);
63	if (!token) {
64	throw new Error("Anonymous token response missing accessToken");
65	}
66
67	return token;
68	}
69
70	async function createMcpTransport(
71	t: ReturnType<typeof setup>,
72	workspaceId: string,
73	accountId: string,
74	sessionId: string,
75	clientId = "e2e",
76	) {
77	const isAnonymousSession = sessionId.startsWith("anon_session_") \|\| sessionId.startsWith("mcp_");
78	const url = new URL(`https://executor.test${isAnonymousSession ? "/mcp/anonymous" : "/mcp"}`);
79	url.searchParams.set("workspaceId", workspaceId);
80	if (!isAnonymousSession) {
81	url.searchParams.set("sessionId", sessionId);
82	}
83	url.searchParams.set("clientId", clientId);
84
85	const anonymousToken = isAnonymousSession
86	? await getAnonymousAccessToken(t, accountId)
87	: null;
88
89	return new StreamableHTTPClientTransport(url, {
90	fetch: async (input, init) => {
91	const raw = typeof input === "string" ? input : input instanceof URL ? input.toString() : (input as Request).url;
92	const parsed = new URL(raw);
93	const path = `${parsed.pathname}${parsed.search}${parsed.hash}`;
94	const headers = new Headers(init?.headers ?? {});
95	if (anonymousToken) {
96	headers.set("authorization", `Bearer ${anonymousToken}`);
97	}
98	return await t.fetch(path, { ...init, headers });
99	},
100	});
101	}
102
103	async function waitForTaskId(t: ReturnType<typeof setup>, workspaceId: string, timeoutMs = 10_000): Promise<string> {
104	const start = Date.now();
105	while (Date.now() - start < timeoutMs) {
106	const tasks = await t.query(internal.database.listTasks, { workspaceId: workspaceId as Id<"workspaces"> });
107	if (tasks.length > 0) {
108	return tasks[0]!.id;
109	}
110	await Bun.sleep(50);
111	}
112
113	throw new Error("Timed out waiting for created task");
114	}
115
116	async function waitForPendingApproval(
117	t: ReturnType<typeof setup>,
118	workspaceId: string,
119	toolPath: string,
120	timeoutMs = 10_000,
121	): Promise<string> {
122	const start = Date.now();
123	while (Date.now() - start < timeoutMs) {
124	const approvals = await t.query(internal.database.listPendingApprovals, { workspaceId: workspaceId as Id<"workspaces"> });
125	const approval = approvals.find((item: { toolPath: string; id: string }) => item.toolPath === toolPath);
126	if (approval) {
127	return approval.id;
128	}
129	await Bun.sleep(50);
130	}
131
132	throw new Error(`Timed out waiting for pending approval on ${toolPath}`);
133	}
134
135	test("MCP run_code survives delayed approval and completes", async () => {
136	const t = setup();
137	const session = await t.mutation(internal.database.bootstrapAnonymousSession, {});
138
139	const client = new Client({ name: "executor-e2e", version: "0.0.1" }, { capabilities: {} });
140	const transport = await createMcpTransport(t, session.workspaceId, session.accountId, session.sessionId, "e2e-approval-delay");
141
142	try {
143	await client.connect(transport);
144
145	const runCode = client.callTool({
146	name: "run_code",
147	arguments: {
148	code: `return await tools.admin.send_announcement({ channel: "general", message: "hello from convex-test" });`,
149	},
150	});
151
152	const taskId = await waitForTaskId(t, session.workspaceId);
153	const runTask = t.action(internal.executorNode.runTask, { taskId });
154
155	const approvalId = await waitForPendingApproval(t, session.workspaceId, "admin.send_announcement");
156
157	await Bun.sleep(16_000);
158
159	await t.mutation(internal.executor.resolveApprovalInternal, {
160	workspaceId: session.workspaceId,
161	approvalId,
162	decision: "approved",
163	reviewerId: "e2e-reviewer",
164	});
165
166	await runTask;
167
168	const result = (await runCode) as {
169	content: Array<{ type: string; text?: string }>;
170	isError?: boolean;
171	};
172	const text = result.content.find((item) => item.type === "text")?.text ?? "";
173
174	expect(result.isError).toBeFalsy();
175	expect(text).toContain("status: completed");
176	expect(text).toContain("hello from convex-test");
177
178	const task = await t.query(internal.database.getTask, { taskId });
179	expect(task?.status).toBe("completed");
180	} finally {
181	await transport.close().catch(() => {});
182	await client.close().catch(() => {});
183	}
184	}, 60_000);
185
186	test("MCP run_code returns denied after approval denial", async () => {
187	const t = setup();
188	const session = await t.mutation(internal.database.bootstrapAnonymousSession, {});
189
190	const client = new Client({ name: "executor-e2e", version: "0.0.1" }, { capabilities: {} });
191	const transport = await createMcpTransport(t, session.workspaceId, session.accountId, session.sessionId, "e2e-deny");
192
193	try {
194	await client.connect(transport);
195
196	const runCode = client.callTool({
197	name: "run_code",
198	arguments: {
199	code: `return await tools.admin.delete_data({ key: "important" });`,
200	},
201	});
202
203	const taskId = await waitForTaskId(t, session.workspaceId);
204	const runTask = t.action(internal.executorNode.runTask, { taskId });
205
206	const approvalId = await waitForPendingApproval(t, session.workspaceId, "admin.delete_data");
207	await t.mutation(internal.executor.resolveApprovalInternal, {
208	workspaceId: session.workspaceId,
209	approvalId,
210	decision: "denied",
211	reviewerId: "e2e-reviewer",
212	reason: "not allowed",
213	});
214
215	await runTask;
216
217	const result = (await runCode) as {
218	content: Array<{ type: string; text?: string }>;
219	isError?: boolean;
220	};
221	const text = result.content.find((item) => item.type === "text")?.text ?? "";
222
223	expect(result.isError).toBe(true);
224	expect(text).toContain("status: denied");
225
226	const task = await t.query(internal.database.getTask, { taskId });
227	expect(task?.status).toBe("denied");
228	} finally {
229	await transport.close().catch(() => {});
230	await client.close().catch(() => {});
231	}
232	}, 30_000);

executor/packages/database/convex/mcp/run/code-oom.e2e.test.ts+0−127

@@ -1,127 +0,0 @@
1	import { expect, test } from "bun:test";
2	import { generateKeyPairSync } from "node:crypto";
3	import { convexTest } from "convex-test";
4	import { Client } from "@modelcontextprotocol/sdk/client/index.js";
5	import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
6	import { internal } from "../../_generated/api";
7	import schema from "../../schema";
8
9	const OOM_MESSAGE = "JavaScript execution ran out of memory (maximum memory usage: 64 MB): request stream size was 0 bytes";
10
11	function ensureAnonymousAuthKeysConfigured() {
12	if (process.env.ANONYMOUS_AUTH_PRIVATE_KEY_PEM && process.env.ANONYMOUS_AUTH_PUBLIC_KEY_PEM) {
13	return;
14	}
15
16	const { privateKey, publicKey } = generateKeyPairSync("ec", { namedCurve: "P-256" });
17	process.env.ANONYMOUS_AUTH_PRIVATE_KEY_PEM = privateKey.export({ type: "pkcs8", format: "pem" }).toString();
18	process.env.ANONYMOUS_AUTH_PUBLIC_KEY_PEM = publicKey.export({ type: "spki", format: "pem" }).toString();
19	}
20
21	ensureAnonymousAuthKeysConfigured();
22
23	function setup() {
24	return convexTest(schema, {
25	"../../database.ts": () => import("../../database"),
26	"../../executor.ts": () => import("../../executor"),
27	"../../executorNode.ts": () => import("../../../src/test-fixtures/executorNode.oomFixture"),
28	"../../http.ts": () => import("../../http"),
29	"../../auth.ts": () => import("../../auth"),
30	"../../workspaceAuthInternal.ts": () => import("../../workspaceAuthInternal"),
31	"../../workspaceToolCache.ts": () => import("../../workspaceToolCache"),
32	"../../toolRegistry.ts": () => import("../../toolRegistry"),
33	"../../openApiSpecCache.ts": () => import("../../openApiSpecCache"),
34	"../../_generated/api.js": () => import("../../_generated/api.js"),
35	});
36	}
37
38	type AnonymousTokenResponse = {
39	error?: unknown;
40	accessToken?: unknown;
41	};
42
43	function readErrorMessage(body: AnonymousTokenResponse): string {
44	return typeof body.error === "string" ? body.error : "";
45	}
46
47	function readAccessToken(body: AnonymousTokenResponse): string \| null {
48	return typeof body.accessToken === "string" && body.accessToken.length > 0 ? body.accessToken : null;
49	}
50
51	async function getAnonymousAccessToken(
52	t: ReturnType<typeof setup>,
53	accountId: string,
54	): Promise<string> {
55	const resp = await t.fetch(`/auth/anonymous/token?accountId=${encodeURIComponent(accountId)}`);
56	const body = await resp.json().catch(() => ({} as AnonymousTokenResponse)) as AnonymousTokenResponse;
57
58	if (!resp.ok) {
59	const message = readErrorMessage(body) \|\| `HTTP ${resp.status}`;
60	throw new Error(`Failed to issue anonymous token: ${message}`);
61	}
62
63	const token = readAccessToken(body);
64	if (!token) {
65	throw new Error("Anonymous token response missing accessToken");
66	}
67
68	return token;
69	}
70
71	async function createMcpTransport(
72	t: ReturnType<typeof setup>,
73	workspaceId: string,
74	accountId: string,
75	sessionId: string,
76	clientId = "oom-repro",
77	) {
78	const isAnonymousSession = sessionId.startsWith("anon_session_") \|\| sessionId.startsWith("mcp_");
79	const url = new URL(`https://executor.test${isAnonymousSession ? "/mcp/anonymous" : "/mcp"}`);
80	url.searchParams.set("workspaceId", workspaceId);
81	if (!isAnonymousSession) {
82	url.searchParams.set("sessionId", sessionId);
83	}
84	url.searchParams.set("clientId", clientId);
85
86	const anonymousToken = isAnonymousSession
87	? await getAnonymousAccessToken(t, accountId)
88	: null;
89
90	return new StreamableHTTPClientTransport(url, {
91	fetch: async (input, init) => {
92	const raw = typeof input === "string" ? input : input instanceof URL ? input.toString() : (input as Request).url;
93	const parsed = new URL(raw);
94	const path = `${parsed.pathname}${parsed.search}${parsed.hash}`;
95	const headers = new Headers(init?.headers ?? {});
96	if (anonymousToken) {
97	headers.set("authorization", `Bearer ${anonymousToken}`);
98	}
99	return await t.fetch(path, { ...init, headers });
100	},
101	});
102	}
103
104	test("MCP run_code no longer hits typecheck OOM path", async () => {
105	const t = setup();
106	const session = await t.mutation(internal.database.bootstrapAnonymousSession, {});
107
108	const client = new Client({ name: "executor-oom-repro", version: "0.0.1" }, { capabilities: {} });
109	const transport = await createMcpTransport(t, session.workspaceId, session.accountId, session.sessionId);
110
111	try {
112	await client.connect(transport);
113
114	const result = await client.callTool({
115	name: "run_code",
116	arguments: {
117	code: "return await tools.github.users.get_authenticated();",
118	},
119	});
120
121	const serialized = JSON.stringify(result);
122	expect(serialized.includes(OOM_MESSAGE)).toBe(false);
123	} finally {
124	await transport.close().catch(() => {});
125	await client.close().catch(() => {});
126	}
127	}, 30_000);

executor/packages/database/convex/migrations.ts+0−44

@@ -4,48 +4,4 @@ import { components } from "./_generated/api"; · 3 unmodified lines
4		4
5	const migrations = new Migrations<DataModel>(components.migrations);	5	const migrations = new Migrations<DataModel>(components.migrations);
6		6
7	export const deleteAnonymousSessionsMissingAccountId = migrations.define({
8	table: "anonymousSessions",
9	migrateOne: async (ctx, session) => {
10	if (session.accountId) {
11	return;
12	}
13
14	await ctx.db.delete(session._id);
15	},
16	});
17
18	export const deleteSourceCredentialsMissingProvider = migrations.define({
19	table: "sourceCredentials",
20	migrateOne: async (ctx, credential) => {
21	if (credential.provider) {
22	return;
23	}
24
25	await ctx.db.delete(credential._id);
26	},
27	});
28
29	export const cleanupTaskEmptyStringSentinels = migrations.define({
30	table: "tasks",
31	migrateOne: async (_ctx, task) => {
32	const patch: Record<string, undefined> = {};
33	if (Reflect.get(task, "accountId") === "") patch.accountId = undefined;
34	if (task.clientId === "") patch.clientId = undefined;
35	if (Object.keys(patch).length > 0) return patch;
36	},
37	});
38
39	export const cleanupAccessPolicyEmptyStringSentinels = migrations.define({
40	table: "accessPolicies",
41	migrateOne: async (_ctx, policy) => {
42	const policyRecord = policy as Record<string, unknown>;
43	const patch: Record<string, undefined> = {};
44	if (Reflect.get(policyRecord, "accountId") === "") patch["accountId"] = undefined;
45	if (Reflect.get(policyRecord, "targetAccountId") === "") patch["targetAccountId"] = undefined;
46	if (policy.clientId === "") patch["clientId"] = undefined;
47	if (Object.keys(patch).length > 0) return patch;
48	},
49	});
50
51	export const run = migrations.runner();	7	export const run = migrations.runner();

executor/packages/database/convex/schema.ts+1−2

   // Anonymous session linkage.
   // Used to map an unauthenticated/anonymous account to a backing `accounts` row and a
-  // `workspaceMembers` user entry.
+  // workspace.
   //
   // Primary access patterns:
   // - Resolve by session id.
     workspaceId: v.id("workspaces"),
     clientId: v.string(), // client label: "web", "mcp", etc.
     accountId: v.id("accounts"),
-    userId: v.id("workspaceMembers"),
     createdAt: v.number(),
     lastSeenAt: v.number(),
   })

executor/packages/database/src/database/anonymous.ts+0−12

@@ -98,20 +98,8 @@ export async function ensureAnonymousIdentity( · 97 unmodified lines
98	now,	98	now,
99	});	99	});
100		100
101	let user = await ctx.db
102	.query("workspaceMembers")
103	.withIndex("by_workspace_account", (q) => q.eq("workspaceId", workspace._id).eq("accountId", account._id))
104	.unique();
105
106	if (!user) {
107	throw new Error("Failed to project anonymous workspace membership");
108	}
109
110	await ctx.db.patch(user._id, { updatedAt: now });
111
112	return {	101	return {
113	accountId: account._id,	102	accountId: account._id,
114	workspaceId: workspace._id,	103	workspaceId: workspace._id,
115	userId: user._id,
116	};	104	};
117	}	105	}

executor/packages/database/src/database/readers.ts+0−1

@@ -13,7 +13,6 @@ export function mapAnonymousContext(doc: Doc<"anonymousSessions">) { · 12 unmodified lines
13	workspaceId: doc.workspaceId,	13	workspaceId: doc.workspaceId,
14	clientId: doc.clientId,	14	clientId: doc.clientId,
15	accountId: doc.accountId,	15	accountId: doc.accountId,
16	userId: doc.userId,
17	createdAt: doc.createdAt,	16	createdAt: doc.createdAt,
18	lastSeenAt: doc.lastSeenAt,	17	lastSeenAt: doc.lastSeenAt,
19	};	18	};