lael-labs/executor

.env.example+1−0

@@ -24,6 +24,7 @@ CONVEX_SITE_URL=https://your-deployment.convex.site · 23 unmodified lines
24	# ── Local port overrides (optional) ──	24	# ── Local port overrides (optional) ──
25	# EXECUTOR_BACKEND_PORT=5410	25	# EXECUTOR_BACKEND_PORT=5410
26	# EXECUTOR_BACKEND_SITE_PORT=5411	26	# EXECUTOR_BACKEND_SITE_PORT=5411
		27	# EXECUTOR_WEB_PORT=5312
27	# EXECUTOR_MCP_GATEWAY_PORT=5313	28	# EXECUTOR_MCP_GATEWAY_PORT=5313
28	# NEXT_PUBLIC_LOCAL_MCP_ORIGIN=http://localhost:4313	29	# NEXT_PUBLIC_LOCAL_MCP_ORIGIN=http://localhost:4313
29		30

executor/README.md+6−0

@@ -11,6 +11,7 @@ curl -fsSL https://executor.sh/install \| bash · 10 unmodified lines
11	The installed `executor` binary bootstraps and manages its own runtime under `~/.executor/runtime`, including:	11	The installed `executor` binary bootstraps and manages its own runtime under `~/.executor/runtime`, including:
12		12
13	- `convex-local-backend` (downloaded from Convex precompiled releases)	13	- `convex-local-backend` (downloaded from Convex precompiled releases)
		14	- packaged Executor web UI bundle
14	- persisted local backend config (`instanceName`, `instanceSecret`, and ports)	15	- persisted local backend config (`instanceName`, `instanceSecret`, and ports)
15	- local SQLite + file storage data	16	- local SQLite + file storage data
16		17
@@ -19,11 +20,15 @@ Common commands: · 2 unmodified lines
19	```bash	20	```bash
20	executor doctor	21	executor doctor
21	executor up	22	executor up
		23	executor web
22	executor backend --help	24	executor backend --help
23	executor gateway	25	executor gateway
		26	bash executor/uninstall --yes
24	```	27	```
25		28
26	`executor up` runs the managed `convex-local-backend` binary directly without requiring users to install Bun, Node, or Convex.	29	`executor up` runs the managed `convex-local-backend` binary directly without requiring users to install Bun, Node, or Convex.
		30	On first run, `executor up` also bootstraps Convex functions automatically when a local project checkout is available.
		31	`executor web` runs the packaged web UI on `http://localhost:5312`.
27		32
28	## Local development from source	33	## Local development from source
29		34
@@ -84,6 +89,7 @@ Artifacts are written to `dist/release/`. · 54 unmodified lines
84	- `run_code` attempts MCP form elicitation for pending tool approvals when the MCP client advertises `elicitation.form`; clients without elicitation support continue using out-of-band approval flow.	89	- `run_code` attempts MCP form elicitation for pending tool approvals when the MCP client advertises `elicitation.form`; clients without elicitation support continue using out-of-band approval flow.
85	- Local source-dev defaults: web `http://localhost:4312`, MCP gateway `http://localhost:4313/mcp`.	90	- Local source-dev defaults: web `http://localhost:4312`, MCP gateway `http://localhost:4313/mcp`.
86	- Installed binary default for `executor gateway`: `http://localhost:5313/mcp`.	91	- Installed binary default for `executor gateway`: `http://localhost:5313/mcp`.
		92	- WorkOS env vars are optional for local self-hosted usage; WorkOS component wiring is enabled only when all required WorkOS env vars are present.
87		93
88	## Credential providers	94	## Credential providers
89		95

executor/apps/web/next.config.ts+2−1

 ].join("|");
 const nextConfig: NextConfig = {
+  output: "standalone",
   transpilePackages: ["@executor/convex"],
   env: {
     // Map canonical env vars to NEXT_PUBLIC_ so they're available client-side.
     // This lets us keep a single root .env without NEXT_PUBLIC_ prefixes.
-    NEXT_PUBLIC_CONVEX_URL: process.env.CONVEX_URL,
+    NEXT_PUBLIC_CONVEX_URL: process.env.EXECUTOR_WEB_CONVEX_URL ?? process.env.CONVEX_URL,
     NEXT_PUBLIC_WORKOS_CLIENT_ID: process.env.WORKOS_CLIENT_ID,
     NEXT_PUBLIC_STRIPE_PRICE_ID: process.env.STRIPE_PRICE_ID,
   },

executor/convex/_generated/api.d.ts+37−0

@@ -28,6 +28,43 @@ export declare const api: { · 27 unmodified lines
28	any	28	any
29	>;	29	>;
30	};	30	};
		31	anonymousOauth: {
		32	getActiveSigningKey: FunctionReference<
		33	"query",
		34	"public",
		35	{ internalSecret: string },
		36	any
		37	>;
		38	getClient: FunctionReference<
		39	"query",
		40	"public",
		41	{ clientId: string; internalSecret: string },
		42	any
		43	>;
		44	registerClient: FunctionReference<
		45	"mutation",
		46	"public",
		47	{
		48	clientId: string;
		49	clientName?: string;
		50	internalSecret: string;
		51	redirectUris: Array<string>;
		52	},
		53	any
		54	>;
		55	storeSigningKey: FunctionReference<
		56	"mutation",
		57	"public",
		58	{
		59	algorithm: string;
		60	internalSecret: string;
		61	keyId: string;
		62	privateKeyJwk: any;
		63	publicKeyJwk: any;
		64	},
		65	any
		66	>;
		67	};
31	app: {	68	app: {
32	getClientConfig: FunctionReference<"query", "public", {}, any>;	69	getClientConfig: FunctionReference<"query", "public", {}, any>;
33	getCurrentAccount: FunctionReference<	70	getCurrentAccount: FunctionReference<

executor/convex/anonymousOauth.ts+85−0

@@ -0,0 +1,85 @@
	1	/**
	2	* Public Convex functions for the self-issued anonymous OAuth server.
	3	*
	4	* These are called by the MCP gateway process (via ConvexHttpClient) to
	5	* persist signing keys and client registrations across restarts.
	6	*
	7	* All functions require an `internalSecret` argument that must match the
	8	* `EXECUTOR_INTERNAL_TOKEN` environment variable. This prevents arbitrary
	9	* callers from reading private key material or injecting signing keys.
	10	*/
	11
	12	import { v } from "convex/values";
	13	import { internal } from "./_generated/api";
	14	import { mutation, query } from "./_generated/server";
	15
	16	function requireInternalSecret(secret: string): void {
	17	const expected = process.env.EXECUTOR_INTERNAL_TOKEN;
	18	if (!expected) {
	19	throw new Error("EXECUTOR_INTERNAL_TOKEN is not configured");
	20	}
	21	if (secret !== expected) {
	22	throw new Error("Unauthorized: invalid internal secret");
	23	}
	24	}
	25
	26	// ── Signing Keys ────────────────────────────────────────────────────────────
	27
	28	export const getActiveSigningKey = query({
	29	args: { internalSecret: v.string() },
	30	handler: async (ctx, args) => {
	31	requireInternalSecret(args.internalSecret);
	32	return await ctx.runQuery(
	33	internal.database.getActiveAnonymousOauthSigningKey,
	34	{},
	35	);
	36	},
	37	});
	38
	39	export const storeSigningKey = mutation({
	40	args: {
	41	internalSecret: v.string(),
	42	keyId: v.string(),
	43	algorithm: v.string(),
	44	privateKeyJwk: v.any(),
	45	publicKeyJwk: v.any(),
	46	},
	47	handler: async (ctx, args) => {
	48	requireInternalSecret(args.internalSecret);
	49	const { internalSecret: _, ...keyArgs } = args;
	50	return await ctx.runMutation(
	51	internal.database.storeAnonymousOauthSigningKey,
	52	keyArgs,
	53	);
	54	},
	55	});
	56
	57	// ── Client Registrations ────────────────────────────────────────────────────
	58
	59	export const registerClient = mutation({
	60	args: {
	61	internalSecret: v.string(),
	62	clientId: v.string(),
	63	clientName: v.optional(v.string()),
	64	redirectUris: v.array(v.string()),
	65	},
	66	handler: async (ctx, args) => {
	67	requireInternalSecret(args.internalSecret);
	68	const { internalSecret: _, ...clientArgs } = args;
	69	return await ctx.runMutation(
	70	internal.database.registerAnonymousOauthClient,
	71	clientArgs,
	72	);
	73	},
	74	});
	75
	76	export const getClient = query({
	77	args: { internalSecret: v.string(), clientId: v.string() },
	78	handler: async (ctx, args) => {
	79	requireInternalSecret(args.internalSecret);
	80	return await ctx.runQuery(
	81	internal.database.getAnonymousOauthClient,
	82	{ clientId: args.clientId },
	83	);
	84	},
	85	});

executor/convex/auth.ts+3−2

   process.env.WORKOS_CLIENT_ID && process.env.WORKOS_API_KEY && process.env.WORKOS_WEBHOOK_SECRET,
 );
-const authFunctions: AuthFunctions = internal.auth;
+const authFunctions = (internal as Record<string, unknown>).auth as AuthFunctions;
+const workosComponent = (components as Record<string, unknown>).workOSAuthKit;
 const authKitInstance = workosEnabled
-  ? new AuthKit<DataModel>(components.workOSAuthKit, {
+  ? new AuthKit<DataModel>(workosComponent as never, {
       authFunctions,
       additionalEventTypes: [
         "organization.created",

executor/convex/convex.config.ts+7−1

 const app = defineApp();
-app.use(workOSAuthKit);
+const workosEnabled = Boolean(
+  process.env.WORKOS_CLIENT_ID && process.env.WORKOS_API_KEY && process.env.WORKOS_WEBHOOK_SECRET,
+);
+if (workosEnabled) {
+  app.use(workOSAuthKit);
+}
 app.use(stripe);
 app.use(migrations);

executor/executor.ts+46−2

@@ -1,7 +1,8 @@
1	#!/usr/bin/env bun	1	#!/usr/bin/env bun
2		2
		3	import fs from "node:fs/promises";
3	import { startMcpGateway } from "./mcp-gateway";	4	import { startMcpGateway } from "./mcp-gateway";
4	import { managedRuntimeDiagnostics, runManagedBackend } from "./lib/managed_runtime";	5	import { managedRuntimeDiagnostics, runManagedBackend, runManagedWeb } from "./lib/managed_runtime";
5		6
6	function printHelp(): void {	7	function printHelp(): void {
7	console.log(`Executor CLI	8	console.log(`Executor CLI
@@ -10,12 +11,14 @@ Usage: · 2 unmodified lines
10	executor doctor	11	executor doctor
11	executor up [backend-args]	12	executor up [backend-args]
12	executor backend <args>	13	executor backend <args>
		14	executor web [--port <number>]
13	executor gateway [--port <number>]	15	executor gateway [--port <number>]
14		16
15	Commands:	17	Commands:
16	doctor Bootstrap and verify managed Convex backend runtime	18	doctor Bootstrap and verify managed Convex backend runtime
17	up Run managed Convex backend directly (no Bun/Node/Convex install)	19	up Run managed backend and auto-bootstrap Convex functions
18	backend Pass through arguments to managed convex-local-backend binary	20	backend Pass through arguments to managed convex-local-backend binary
		21	web Run packaged web UI (default port: 5312)
19	gateway Start Executor MCP gateway (default port: 5313)	22	gateway Start Executor MCP gateway (default port: 5313)
20	`);	23	`);
21	}	24	}
@@ -39,6 +42,28 @@ function parsePort(args: string[]): number \| undefined { · 17 unmodified lines
39	return port;	42	return port;
40	}	43	}
41		44
		45	async function pathExists(filePath: string): Promise<boolean> {
		46	try {
		47	await fs.access(filePath);
		48	return true;
		49	} catch {
		50	return false;
		51	}
		52	}
		53
		54	async function checkHttp(url: string): Promise<boolean> {
		55	const controller = new AbortController();
		56	const timer = setTimeout(() => controller.abort(), 900);
		57	try {
		58	const response = await fetch(url, { signal: controller.signal });
		59	return response.ok;
		60	} catch {
		61	return false;
		62	} finally {
		63	clearTimeout(timer);
		64	}
		65	}
		66
42	async function run(): Promise<void> {	67	async function run(): Promise<void> {
43	const [command, ...rest] = process.argv.slice(2);	68	const [command, ...rest] = process.argv.slice(2);
44		69
@@ -49,11 +74,24 @@ async function run(): Promise<void> { · 4 unmodified lines
49		74
50	if (command === "doctor") {	75	if (command === "doctor") {
51	const info = await managedRuntimeDiagnostics();	76	const info = await managedRuntimeDiagnostics();
		77	const webPort = Number(Bun.env.EXECUTOR_WEB_PORT ?? 5312);
		78	const gatewayPort = Number(Bun.env.EXECUTOR_MCP_GATEWAY_PORT ?? 5313);
		79	const webInstalled = await pathExists(info.webServerEntry);
		80	const nodeInstalled = await pathExists(info.nodeBin);
		81	const backendRunning = await checkHttp(`${info.convexUrl}/version`);
		82	const webRunning = await checkHttp(`http://127.0.0.1:${webPort}/`);
		83	const gatewayRunning = await checkHttp(`http://127.0.0.1:${gatewayPort}/health`);
		84
52	console.log("Managed runtime ready");	85	console.log("Managed runtime ready");
53	console.log(` root: ${info.rootDir}`);	86	console.log(` root: ${info.rootDir}`);
54	console.log(` backend: ${info.backendVersion} (${info.backendBinary})`);	87	console.log(` backend: ${info.backendVersion} (${info.backendBinary})`);
55	console.log(` convex URL: ${info.convexUrl}`);	88	console.log(` convex URL: ${info.convexUrl}`);
56	console.log(` convex site: ${info.convexSiteUrl}`);	89	console.log(` convex site: ${info.convexSiteUrl}`);
		90	console.log(` node runtime: ${nodeInstalled ? info.nodeBin : "not installed yet (installed by 'executor web')"}`);
		91	console.log(` web bundle: ${webInstalled ? info.webServerEntry : "not installed yet (installed by 'executor web')"}`);
		92	console.log(` web URL: http://127.0.0.1:${webPort}`);
		93	console.log(` gateway URL: http://127.0.0.1:${gatewayPort}/mcp`);
		94	console.log(` running: backend=${backendRunning ? "yes" : "no"} web=${webRunning ? "yes" : "no"} gateway=${gatewayRunning ? "yes" : "no"}`);
57	console.log(` config: ${info.configPath}`);	95	console.log(` config: ${info.configPath}`);
58	return;	96	return;
59	}	97	}
@@ -77,6 +115,12 @@ async function run(): Promise<void> { · 17 unmodified lines
77	return;	115	return;
78	}	116	}
79		117
		118	if (command === "web") {
		119	const port = parsePort(rest);
		120	const exitCode = await runManagedWeb({ port });
		121	process.exit(exitCode);
		122	}
		123
80	throw new Error(`Unknown command: ${command}`);	124	throw new Error(`Unknown command: ${command}`);
81	}	125	}
82		126

executor/install+80−2

@@ -4,11 +4,14 @@ set -euo pipefail · 3 unmodified lines
4	APP="executor"	4	APP="executor"
5	REPO="${EXECUTOR_REPO:-RhysSullivan/assistant}"	5	REPO="${EXECUTOR_REPO:-RhysSullivan/assistant}"
6	INSTALL_DIR="${EXECUTOR_INSTALL_DIR:-$HOME/.executor/bin}"	6	INSTALL_DIR="${EXECUTOR_INSTALL_DIR:-$HOME/.executor/bin}"
		7	WEB_INSTALL_DIR="${EXECUTOR_WEB_INSTALL_DIR:-$HOME/.executor/runtime/web}"
7	REQUESTED_VERSION="${VERSION:-}"	8	REQUESTED_VERSION="${VERSION:-}"
		9	RESOLVED_VERSION=""
8	BINARY_PATH=""	10	BINARY_PATH=""
9	NO_MODIFY_PATH="0"	11	NO_MODIFY_PATH="0"
10	SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" >/dev/null 2>&1 && pwd)"	12	SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" >/dev/null 2>&1 && pwd)"
11	LOCAL_BINARY_CANDIDATE="$SCRIPT_DIR/dist/executor"	13	LOCAL_BINARY_CANDIDATE="$SCRIPT_DIR/dist/executor"
		14	LOCAL_WEB_CANDIDATE="$SCRIPT_DIR/dist/release"
12		15
13	RED='\033[0;31m'	16	RED='\033[0;31m'
14	MUTED='\033[0;2m'	17	MUTED='\033[0;2m'
@@ -30,6 +33,7 @@ Options: · 15 unmodified lines
30	Environment:	33	Environment:
31	EXECUTOR_REPO GitHub repository to install from (default: RhysSullivan/assistant)	34	EXECUTOR_REPO GitHub repository to install from (default: RhysSullivan/assistant)
32	EXECUTOR_INSTALL_DIR Install directory (default: ~/.executor/bin)	35	EXECUTOR_INSTALL_DIR Install directory (default: ~/.executor/bin)
		36	EXECUTOR_WEB_INSTALL_DIR Web bundle directory (default: ~/.executor/runtime/web)
33	EOF	37	EOF
34	}	38	}
35		39
@@ -66,6 +70,10 @@ while [[ $# -gt 0 ]]; do · 30 unmodified lines
66	esac	70	esac
67	done	71	done
68		72
		73	if [[ -n "$REQUESTED_VERSION" ]]; then
		74	RESOLVED_VERSION="${REQUESTED_VERSION#v}"
		75	fi
		76
69	raw_os="$(uname -s)"	77	raw_os="$(uname -s)"
70	case "$raw_os" in	78	case "$raw_os" in
71	Linux*) os="linux" ;;	79	Linux*) os="linux" ;;
@@ -90,16 +98,75 @@ archive_ext="zip" · 18 unmodified lines
90	archive_ext="tar.gz"	98	archive_ext="tar.gz"
91		99
92	filename="${APP}-${os}-${arch}.${archive_ext}"	100	filename="${APP}-${os}-${arch}.${archive_ext}"
		101	web_filename="executor-web-${os}-${arch}.tar.gz"
93	mkdir -p "$INSTALL_DIR"	102	mkdir -p "$INSTALL_DIR"
		103	mkdir -p "$WEB_INSTALL_DIR"
94		104
95	install_local_binary() {	105	install_local_binary() {
96	local src="$1"	106	local src="$1"
		107	local tmp_target
97	if [[ ! -f "$src" ]]; then	108	if [[ ! -f "$src" ]]; then
98	echo -e "${RED}Local binary not found: ${src}${NC}"	109	echo -e "${RED}Local binary not found: ${src}${NC}"
99	exit 1	110	exit 1
100	fi	111	fi
101	cp "$src" "$INSTALL_DIR/$APP"	112	tmp_target="$INSTALL_DIR/.${APP}.tmp.$$"
102	chmod 755 "$INSTALL_DIR/$APP"	113	cp "$src" "$tmp_target"
		114	chmod 755 "$tmp_target"
		115	mv -f "$tmp_target" "$INSTALL_DIR/$APP"
		116	}
		117
		118	install_web_bundle_from_archive() {
		119	local archive_path="$1"
		120	local tmp_web_dir
		121	tmp_web_dir="$(mktemp -d)"
		122	if ! tar -xzf "$archive_path" -C "$tmp_web_dir"; then
		123	rm -rf "$tmp_web_dir"
		124	echo -e "${RED}Failed extracting web archive${NC}"
		125	exit 1
		126	fi
		127	if [[ ! -f "$tmp_web_dir/server.js" ]]; then
		128	rm -rf "$tmp_web_dir"
		129	echo -e "${RED}Web archive missing expected server.js entry${NC}"
		130	exit 1
		131	fi
		132
		133	rm -rf "$WEB_INSTALL_DIR"
		134	mkdir -p "$WEB_INSTALL_DIR"
		135	cp -R "$tmp_web_dir"/. "$WEB_INSTALL_DIR"
		136	rm -rf "$tmp_web_dir"
		137	}
		138
		139	install_web_bundle() {
		140	local web_url
		141	local temp_archive
		142	temp_archive="$(mktemp)"
		143
		144	if [[ -z "$REQUESTED_VERSION" ]]; then
		145	web_url="https://github.com/${REPO}/releases/latest/download/${web_filename}"
		146	else
		147	web_url="https://github.com/${REPO}/releases/download/v${RESOLVED_VERSION}/${web_filename}"
		148	fi
		149
		150	if curl -fsSL "$web_url" -o "$temp_archive"; then
		151	echo -e "${MUTED}Installing web bundle${NC} ${web_filename}"
		152	install_web_bundle_from_archive "$temp_archive"
		153	rm -f "$temp_archive"
		154	return
		155	fi
		156	rm -f "$temp_archive"
		157
		158	local local_web_archive="$LOCAL_WEB_CANDIDATE/${web_filename}"
		159	if [[ -f "$local_web_archive" ]]; then
		160	echo -e "${MUTED}Web bundle release asset not found; using local archive at ${local_web_archive}${NC}"
		161	install_web_bundle_from_archive "$local_web_archive"
		162	return
		163	fi
		164
		165	echo -e "${RED}Web bundle was not installed (missing release asset ${web_filename})${NC}"
		166	echo ""
		167	echo "To build and install it locally:"
		168	echo " bun run --cwd executor build:release"
		169	echo " bash executor/install"
103	}	170	}
104		171
105	if [[ -n "$BINARY_PATH" ]]; then	172	if [[ -n "$BINARY_PATH" ]]; then
@@ -113,8 +180,10 @@ else · 7 unmodified lines
113	if [[ -z "$version" ]]; then	180	if [[ -z "$version" ]]; then
114	version="latest"	181	version="latest"
115	fi	182	fi
		183	RESOLVED_VERSION="${version#v}"
116	else	184	else
117	version="${REQUESTED_VERSION#v}"	185	version="${REQUESTED_VERSION#v}"
		186	RESOLVED_VERSION="$version"
118	url="https://github.com/${REPO}/releases/download/v${version}/${filename}"	187	url="https://github.com/${REPO}/releases/download/v${version}/${filename}"
119	fi	188	fi
120		189
@@ -147,6 +216,8 @@ else · 26 unmodified lines
147	fi	216	fi
148	fi	217	fi
149		218
		219	install_web_bundle
		220
150	if [[ "$NO_MODIFY_PATH" != "1" ]]; then	221	if [[ "$NO_MODIFY_PATH" != "1" ]]; then
151	shell_name="$(basename "${SHELL:-}")"	222	shell_name="$(basename "${SHELL:-}")"
152	case "$shell_name" in	223	case "$shell_name" in
@@ -165,7 +236,14 @@ fi · 12 unmodified lines
165		236
166	echo ""	237	echo ""
167	echo "Installed to: $INSTALL_DIR/$APP"	238	echo "Installed to: $INSTALL_DIR/$APP"
		239	if [[ -f "$WEB_INSTALL_DIR/server.js" ]]; then
		240	echo "Web bundle installed to: $WEB_INSTALL_DIR"
		241	fi
168	echo "Run:"	242	echo "Run:"
169	echo " executor doctor"	243	echo " executor doctor"
170	echo " executor up"	244	echo " executor up"
		245	echo " executor web # defaults to http://localhost:5312"
171	echo " executor gateway # defaults to http://localhost:5313/mcp"	246	echo " executor gateway # defaults to http://localhost:5313/mcp"
		247	echo ""
		248	echo "To uninstall later:"
		249	echo " bash executor/uninstall --yes"

executor/lib/anonymous-oauth.test.ts+180−38

 import { describe, test, expect, beforeAll } from "bun:test";
 import {
   AnonymousOAuthServer,
+  InMemoryOAuthStorage,
   OAuthBadRequest,
   computeS256Challenge,
 } from "./anonymous-oauth";
   server: AnonymousOAuthServer,
   redirectUri = "http://localhost:9999/callback",
 ) {
-  const client = server.registerClient({
+  const client = await server.registerClient({
     redirect_uris: [redirectUri],
     client_name: "test-client",
   });
     state: "test-state-123",
   });
-  const { redirectTo } = server.authorize(params);
+  const { redirectTo } = await server.authorize(params);
   const redirectUrl = new URL(redirectTo);
   const code = redirectUrl.searchParams.get("code")!;
 describe("AnonymousOAuthServer", () => {
   let server: AnonymousOAuthServer;
+  let storage: InMemoryOAuthStorage;
   beforeAll(async () => {
-    server = createServer();
+    storage = new InMemoryOAuthStorage();
+    server = new AnonymousOAuthServer({
+      issuer: "http://localhost:3003",
+      storage,
+    });
     await server.init();
   });
   // ── Client Registration ─────────────────────────────────────────────────
   describe("registerClient", () => {
-    test("registers a client and returns a client_id", () => {
+    test("registers a client and returns a client_id", async () => {
-      const reg = server.registerClient({
+      const reg = await server.registerClient({
         redirect_uris: ["http://localhost:9999/callback"],
         client_name: "my-mcp-client",
       });
       expect(reg.created_at).toBeGreaterThan(0);
     });
-    test("rejects registration without redirect_uris", () => {
+    test("rejects registration without redirect_uris", async () => {
-      expect(() => server.registerClient({} as any)).toThrow(OAuthBadRequest);
+      await expect(server.registerClient({} as any)).rejects.toThrow(OAuthBadRequest);
     });
-    test("rejects registration with empty redirect_uris", () => {
+    test("rejects registration with empty redirect_uris", async () => {
-      expect(() => server.registerClient({ redirect_uris: [] })).toThrow(OAuthBadRequest);
+      await expect(server.registerClient({ redirect_uris: [] })).rejects.toThrow(OAuthBadRequest);
     });
-    test("rejects registration with invalid redirect_uri entries", () => {
+    test("rejects registration with invalid redirect_uri entries", async () => {
-      expect(() => server.registerClient({ redirect_uris: [""] })).toThrow(OAuthBadRequest);
+      await expect(server.registerClient({ redirect_uris: [""] })).rejects.toThrow(OAuthBadRequest);
     });
-    test("increments client count", () => {
+    test("rejects registration with non-URL redirect_uri", async () => {
-      const before = server.getClientCount();
+      await expect(
-      server.registerClient({ redirect_uris: ["http://example.com/cb"] });
+        server.registerClient({ redirect_uris: ["not-a-url"] }),
-      expect(server.getClientCount()).toBe(before + 1);
+      ).rejects.toThrow("Invalid redirect_uri");
+    });
+    test("increments client count in storage", async () => {
+      const before = storage.clientCount;
+      await server.registerClient({ redirect_uris: ["http://example.com/cb"] });
+      expect(storage.clientCount).toBe(before + 1);
     });
   });
       expect(redirectUrl.pathname).toBe("/callback");
     });
-    test("rejects unsupported response_type", () => {
+    test("rejects unsupported response_type", async () => {
-      const client = server.registerClient({
+      const client = await server.registerClient({
         redirect_uris: ["http://localhost/cb"],
       });
       const params = new URLSearchParams({
         code_challenge: "abc",
         code_challenge_method: "S256",
       });
-      expect(() => server.authorize(params)).toThrow("response_type must be 'code'");
+      await expect(server.authorize(params)).rejects.toThrow("response_type must be 'code'");
     });
-    test("rejects unknown client_id", () => {
+    test("rejects unknown client_id", async () => {
       const params = new URLSearchParams({
         response_type: "code",
         client_id: "unknown",
         code_challenge: "abc",
         code_challenge_method: "S256",
       });
-      expect(() => server.authorize(params)).toThrow("Unknown client_id");
+      await expect(server.authorize(params)).rejects.toThrow("Unknown client_id");
     });
-    test("rejects mismatched redirect_uri", () => {
+    test("rejects mismatched redirect_uri", async () => {
-      const client = server.registerClient({
+      const client = await server.registerClient({
         redirect_uris: ["http://localhost/cb"],
       });
       const params = new URLSearchParams({
         code_challenge: "abc",
         code_challenge_method: "S256",
       });
-      expect(() => server.authorize(params)).toThrow("redirect_uri does not match");
+      await expect(server.authorize(params)).rejects.toThrow("redirect_uri does not match");
     });
-    test("rejects missing PKCE challenge", () => {
+    test("rejects missing PKCE challenge", async () => {
-      const client = server.registerClient({
+      const client = await server.registerClient({
         redirect_uris: ["http://localhost/cb"],
       });
       const params = new URLSearchParams({
         client_id: client.client_id,
         redirect_uri: "http://localhost/cb",
       });
-      expect(() => server.authorize(params)).toThrow("PKCE S256 code_challenge is required");
+      await expect(server.authorize(params)).rejects.toThrow("PKCE S256 code_challenge is required");
     });
-    test("rejects non-S256 PKCE method", () => {
+    test("rejects non-S256 PKCE method", async () => {
-      const client = server.registerClient({
+      const client = await server.registerClient({
         redirect_uris: ["http://localhost/cb"],
       });
       const params = new URLSearchParams({
         code_challenge: "abc",
         code_challenge_method: "plain",
       });
-      expect(() => server.authorize(params)).toThrow("PKCE S256 code_challenge is required");
+      await expect(server.authorize(params)).rejects.toThrow("PKCE S256 code_challenge is required");
     });
   });
   describe("exchangeToken", () => {
     test("exchanges code for a valid JWT access token", async () => {
-      const { code, codeVerifier, redirectUri } = await registerAndAuthorize(server);
+      const { client, code, codeVerifier, redirectUri } = await registerAndAuthorize(server);
       const result = await server.exchangeToken(
         new URLSearchParams({
           grant_type: "authorization_code",
           code,
+          client_id: client.client_id,
           redirect_uri: redirectUri,
           code_verifier: codeVerifier,
         }),
     });
     test("code is single-use", async () => {
-      const { code, codeVerifier, redirectUri } = await registerAndAuthorize(server);
+      const { client, code, codeVerifier, redirectUri } = await registerAndAuthorize(server);
       const body = new URLSearchParams({
         grant_type: "authorization_code",
         code,
+        client_id: client.client_id,
         redirect_uri: redirectUri,
         code_verifier: codeVerifier,
       });
       ).rejects.toThrow("grant_type must be authorization_code");
     });
+    test("rejects wrong client_id", async () => {
+      const { code, codeVerifier, redirectUri } = await registerAndAuthorize(server);
+      await expect(
+        server.exchangeToken(
+          new URLSearchParams({
+            grant_type: "authorization_code",
+            code,
+            client_id: "anon_client_wrong",
+            redirect_uri: redirectUri,
+            code_verifier: codeVerifier,
+          }),
+        ),
+      ).rejects.toThrow("client_id mismatch");
+    });
     test("rejects expired code", async () => {
       // Create server with very short code expiry
       const shortServer = new AnonymousOAuthServer({
       });
       await shortServer.init();
-      const { code, codeVerifier, redirectUri } = await registerAndAuthorize(shortServer);
+      const { client, code, codeVerifier, redirectUri } = await registerAndAuthorize(shortServer);
       // Wait a tick for the code to expire
       await new Promise((resolve) => setTimeout(resolve, 10));
           new URLSearchParams({
             grant_type: "authorization_code",
             code,
+            client_id: client.client_id,
             redirect_uri: redirectUri,
             code_verifier: codeVerifier,
           }),
     });
     test("rejects wrong redirect_uri", async () => {
-      const { code, codeVerifier } = await registerAndAuthorize(server);
+      const { client, code, codeVerifier } = await registerAndAuthorize(server);
       await expect(
         server.exchangeToken(
           new URLSearchParams({
             grant_type: "authorization_code",
             code,
+            client_id: client.client_id,
             redirect_uri: "http://evil.com/cb",
             code_verifier: codeVerifier,
           }),
     });
     test("rejects wrong code_verifier", async () => {
-      const { code, redirectUri } = await registerAndAuthorize(server);
+      const { client, code, redirectUri } = await registerAndAuthorize(server);
       await expect(
         server.exchangeToken(
           new URLSearchParams({
             grant_type: "authorization_code",
             code,
+            client_id: client.client_id,
             redirect_uri: redirectUri,
             code_verifier: "wrong-verifier-value",
           }),
     });
     test("rejects missing code_verifier", async () => {
-      const { code, redirectUri } = await registerAndAuthorize(server);
+      const { client, code, redirectUri } = await registerAndAuthorize(server);
       await expect(
         server.exchangeToken(
           new URLSearchParams({
             grant_type: "authorization_code",
             code,
+            client_id: client.client_id,
             redirect_uri: redirectUri,
           }),
         ),
   describe("verifyToken", () => {
     test("verifies a self-issued token", async () => {
-      const { code, codeVerifier, redirectUri } = await registerAndAuthorize(server);
+      const { client, code, codeVerifier, redirectUri } = await registerAndAuthorize(server);
       const { access_token } = await server.exchangeToken(
         new URLSearchParams({
           grant_type: "authorization_code",
           code,
+          client_id: client.client_id,
           redirect_uri: redirectUri,
           code_verifier: codeVerifier,
         }),
       const otherServer = createServer("http://other-server:4000");
       await otherServer.init();
-      const { code, codeVerifier, redirectUri } = await registerAndAuthorize(otherServer);
+      const { client, code, codeVerifier, redirectUri } = await registerAndAuthorize(otherServer);
       const { access_token } = await otherServer.exchangeToken(
         new URLSearchParams({
           grant_type: "authorization_code",
           code,
+          client_id: client.client_id,
           redirect_uri: redirectUri,
           code_verifier: codeVerifier,
         }),
     });
   });
+  // ── Authorization code cap ────────────────────────────────────────────────
+  describe("authorization code cap", () => {
+    test("rejects new authorizations when at max pending codes", async () => {
+      const s = new AnonymousOAuthServer({
+        issuer: "http://localhost:3003",
+        maxPendingCodes: 2,
+        codeExpirySeconds: 300, // long-lived so they don't auto-purge
+      });
+      await s.init();
+      // Fill up the code slots
+      await registerAndAuthorize(s);
+      await registerAndAuthorize(s);
+      expect(s.getCodeCount()).toBe(2);
+      // Third should be rejected
+      await expect(registerAndAuthorize(s)).rejects.toThrow(
+        "Too many pending authorization requests",
+      );
+    });
+    test("auto-purges expired codes before rejecting", async () => {
+      const s = new AnonymousOAuthServer({
+        issuer: "http://localhost:3003",
+        maxPendingCodes: 2,
+        codeExpirySeconds: 0, // codes expire immediately
+      });
+      await s.init();
+      // Fill slots (they expire immediately)
+      await registerAndAuthorize(s);
+      await registerAndAuthorize(s);
+      expect(s.getCodeCount()).toBe(2);
+      // Wait for expiry
+      await new Promise((resolve) => setTimeout(resolve, 10));
+      // Should succeed because expired codes are purged
+      const { code } = await registerAndAuthorize(s);
+      expect(code).toBeTruthy();
+    });
+  });
+  // ── Key persistence via storage ─────────────────────────────────────────
+  describe("key persistence", () => {
+    test("reuses key from storage on second init", async () => {
+      const sharedStorage = new InMemoryOAuthStorage();
+      // First server generates a key
+      const s1 = new AnonymousOAuthServer({
+        issuer: "http://localhost:3003",
+        storage: sharedStorage,
+      });
+      await s1.init();
+      const jwks1 = s1.getJwks();
+      // Second server should load the same key from storage
+      const s2 = new AnonymousOAuthServer({
+        issuer: "http://localhost:3003",
+        storage: sharedStorage,
+      });
+      await s2.init();
+      const jwks2 = s2.getJwks();
+      expect(jwks1.keys[0].kid).toBe(jwks2.keys[0].kid);
+      expect(jwks1.keys[0].n).toBe(jwks2.keys[0].n);
+    });
+    test("token from first server is verified by second server with same storage", async () => {
+      const sharedStorage = new InMemoryOAuthStorage();
+      const s1 = new AnonymousOAuthServer({
+        issuer: "http://localhost:3003",
+        storage: sharedStorage,
+      });
+      await s1.init();
+      const { client, code, codeVerifier, redirectUri } = await registerAndAuthorize(s1);
+      const { access_token } = await s1.exchangeToken(
+        new URLSearchParams({
+          grant_type: "authorization_code",
+          code,
+          client_id: client.client_id,
+          redirect_uri: redirectUri,
+          code_verifier: codeVerifier,
+        }),
+      );
+      // "Restart" the gateway — new server instance, same storage
+      const s2 = new AnonymousOAuthServer({
+        issuer: "http://localhost:3003",
+        storage: sharedStorage,
+      });
+      await s2.init();
+      // Token from s1 should be valid on s2
+      const verified = await s2.verifyToken(access_token);
+      expect(verified).not.toBeNull();
+      expect(verified!.sub).toStartWith("anon_");
+      expect(verified!.provider).toBe("anonymous");
+    });
+  });
   // ── Each authorize creates a unique actor ───────────────────────────────
   describe("unique anonymous identities", () => {
       const subs = new Set<string>();
       for (let i = 0; i < 5; i++) {
-        const { code, codeVerifier, redirectUri } = await registerAndAuthorize(server);
+        const { client, code, codeVerifier, redirectUri } = await registerAndAuthorize(server);
         const { access_token } = await server.exchangeToken(
           new URLSearchParams({
             grant_type: "authorization_code",
             code,
+            client_id: client.client_id,
             redirect_uri: redirectUri,
             code_verifier: codeVerifier,
           }),

executor/lib/anonymous-oauth.ts+56−20

   jwtVerify,
   type JWK,
   type CryptoKey as JoseCryptoKey,
+  type JWTVerifyGetKey,
 } from "jose";
 // ---------------------------------------------------------------------------
   accessTokenTtlSeconds?: number;
   /** Authorization code TTL in seconds. Default 120 s. */
   codeExpirySeconds?: number;
+  /** Maximum number of in-flight authorization codes. Default 10 000. */
+  maxPendingCodes?: number;
   /** Pluggable storage backend for keys & client registrations. */
   storage?: OAuthStorage;
 }
 export class AnonymousOAuthServer {
   private readonly issuer: string;
+  private readonly audience: string;
   private readonly accessTokenTtlSeconds: number;
   private readonly codeExpirySeconds: number;
+  private readonly maxPendingCodes: number;
   private readonly storage: OAuthStorage;
   private privateKey!: JoseCryptoKey;
   private publicJwk!: JWK;
   private keyId!: string;
+  /** Cached local JWKS for fast token verification (built once on init). */
+  private localJwks!: JWTVerifyGetKey;
   /** In-memory authorization codes (short-lived, cleaned up on use). */
   private readonly codes = new Map<string, AuthorizationCode>();
   constructor(config: AnonOAuthConfig) {
     this.issuer = config.issuer.replace(/\/+$/, "");
+    this.audience = `${this.issuer}/mcp`;
     this.accessTokenTtlSeconds = config.accessTokenTtlSeconds ?? 24 * 60 * 60;
     this.codeExpirySeconds = config.codeExpirySeconds ?? 120;
+    this.maxPendingCodes = config.maxPendingCodes ?? 10_000;
     this.storage = config.storage ?? new InMemoryOAuthStorage();
   }
       this.keyId = existing.keyId;
       this.publicJwk = { ...existing.publicKeyJwk, kid: this.keyId, use: "sig", alg: existing.algorithm };
       this.privateKey = await importJWK(existing.privateKeyJwk, existing.algorithm) as JoseCryptoKey;
-      return;
+    } else {
+      // No existing key — generate a fresh pair and persist it
+      const { privateKey, publicKey } = await generateKeyPair("RS256", { extractable: true });
+      this.privateKey = privateKey;
+      this.keyId = `anon_key_${crypto.randomUUID().slice(0, 8)}`;
+      const publicJwk = await exportJWK(publicKey);
+      this.publicJwk = { ...publicJwk, kid: this.keyId, use: "sig", alg: "RS256" };
+      const privateKeyJwk = await exportJWK(privateKey);
+      await this.storage.storeSigningKey({
+        keyId: this.keyId,
+        algorithm: "RS256",
+        privateKeyJwk,
+        publicKeyJwk: publicJwk,
+      });
     }
-    // No existing key — generate a fresh pair and persist it
+    // Build cached local JWKS for fast token verification
-    const { privateKey, publicKey } = await generateKeyPair("RS256");
+    this.localJwks = createLocalJWKSet({ keys: [this.publicJwk] });
-    this.privateKey = privateKey;
-    this.keyId = `anon_key_${crypto.randomUUID().slice(0, 8)}`;
-    const publicJwk = await exportJWK(publicKey);
-    this.publicJwk = { ...publicJwk, kid: this.keyId, use: "sig", alg: "RS256" };
-    const privateKeyJwk = await exportJWK(privateKey);
-    await this.storage.storeSigningKey({
-      keyId: this.keyId,
-      algorithm: "RS256",
-      privateKeyJwk,
-      publicKeyJwk: publicJwk,
-    });
   }
-  /** Import an existing key pair (for tests or manual persistence). */
+  /**
+   * Import an existing key pair (for tests only — bypasses storage).
+   * @internal
+   */
   async initWithKeys(privateKey: JoseCryptoKey, publicJwk: JWK): Promise<void> {
     this.privateKey = privateKey;
     this.keyId = publicJwk.kid ?? `anon_key_${crypto.randomUUID().slice(0, 8)}`;
     this.publicJwk = { ...publicJwk, kid: this.keyId, use: "sig", alg: "RS256" };
+    this.localJwks = createLocalJWKSet({ keys: [this.publicJwk] });
   }
   // -------------------------------------------------------------------------
       if (typeof uri !== "string" || uri.length === 0) {
         throw new OAuthBadRequest("Each redirect_uri must be a non-empty string");
       }
+      try {
+        new URL(uri);
+      } catch {
+        throw new OAuthBadRequest(`Invalid redirect_uri: ${uri}`);
+      }
     }
     const clientId = `anon_client_${crypto.randomUUID()}`;
     // Generate anonymous identity
     const actorId = `anon_${crypto.randomUUID()}`;
+    // Enforce cap on pending codes to prevent memory exhaustion
+    if (this.codes.size >= this.maxPendingCodes) {
+      // Purge expired codes first; if still over limit, reject
+      this.purgeExpiredCodes();
+      if (this.codes.size >= this.maxPendingCodes) {
+        throw new OAuthBadRequest("Too many pending authorization requests — try again later");
+      }
+    }
     // Issue authorization code (always in-memory — short-lived, single-use)
     const code = crypto.randomUUID();
     this.codes.set(code, {
       throw new OAuthBadRequest("authorization code has expired");
     }
+    // Verify client_id matches the code's originating client (RFC 6749 §4.1.3)
+    const clientId = body.get("client_id");
+    if (clientId !== storedCode.clientId) {
+      throw new OAuthBadRequest("client_id mismatch");
+    }
     // Verify redirect_uri matches
     const redirectUri = body.get("redirect_uri");
     if (redirectUri !== storedCode.redirectUri) {
     })
       .setProtectedHeader({ alg: "RS256", kid: this.keyId })
       .setIssuer(this.issuer)
+      .setAudience(this.audience)
       .setIssuedAt()
       .setExpirationTime(`${this.accessTokenTtlSeconds}s`)
       .setJti(crypto.randomUUID())
     token: string,
   ): Promise<{ sub: string; provider: string } | null> {
     try {
-      const jwks = createLocalJWKSet({ keys: [this.publicJwk] });
+      const { payload } = await jwtVerify(token, this.localJwks, {
-      const { payload } = await jwtVerify(token, jwks, {
         issuer: this.issuer,
+        audience: this.audience,
       });
       if (typeof payload.sub !== "string" || payload.sub.length === 0) {

executor/lib/convex-oauth-storage.ts+100−0

@@ -0,0 +1,100 @@
	1	/**
	2	* Convex-backed storage for the anonymous OAuth server.
	3	*
	4	* Persists signing keys and client registrations to Convex so they
	5	* survive gateway restarts. Keys are cached locally after first load
	6	* for fast in-process token verification.
	7	*
	8	* All Convex calls include an `internalSecret` argument that is validated
	9	* server-side against `EXECUTOR_INTERNAL_TOKEN`, preventing unauthorized
	10	* access to private key material.
	11	*/
	12
	13	import { ConvexHttpClient } from "convex/browser";
	14	import { api } from "../convex/_generated/api";
	15	import type {
	16	OAuthStorage,
	17	StoredSigningKey,
	18	AnonOAuthClientRegistration,
	19	} from "./anonymous-oauth";
	20
	21	export class ConvexOAuthStorage implements OAuthStorage {
	22	private readonly convex: ConvexHttpClient;
	23	private readonly internalSecret: string;
	24
	25	constructor(convexUrl: string, internalSecret: string) {
	26	if (!internalSecret) {
	27	throw new Error(
	28	"ConvexOAuthStorage requires an internalSecret (EXECUTOR_INTERNAL_TOKEN)",
	29	);
	30	}
	31	this.convex = new ConvexHttpClient(convexUrl);
	32	this.internalSecret = internalSecret;
	33	}
	34
	35	async getActiveSigningKey(): Promise<StoredSigningKey \| null> {
	36	const result = await this.convex.query(
	37	api.anonymousOauth.getActiveSigningKey,
	38	{ internalSecret: this.internalSecret },
	39	);
	40
	41	if (!result) return null;
	42
	43	return {
	44	keyId: result.keyId,
	45	algorithm: result.algorithm,
	46	privateKeyJwk: result.privateKeyJwk,
	47	publicKeyJwk: result.publicKeyJwk,
	48	};
	49	}
	50
	51	async storeSigningKey(key: StoredSigningKey): Promise<void> {
	52	await this.convex.mutation(
	53	api.anonymousOauth.storeSigningKey,
	54	{
	55	internalSecret: this.internalSecret,
	56	keyId: key.keyId,
	57	algorithm: key.algorithm,
	58	privateKeyJwk: key.privateKeyJwk,
	59	publicKeyJwk: key.publicKeyJwk,
	60	},
	61	);
	62	}
	63
	64	async registerClient(
	65	registration: AnonOAuthClientRegistration,
	66	): Promise<AnonOAuthClientRegistration> {
	67	const result = await this.convex.mutation(
	68	api.anonymousOauth.registerClient,
	69	{
	70	internalSecret: this.internalSecret,
	71	clientId: registration.client_id,
	72	clientName: registration.client_name,
	73	redirectUris: registration.redirect_uris,
	74	},
	75	);
	76
	77	return {
	78	client_id: result.client_id,
	79	client_name: result.client_name ?? undefined,
	80	redirect_uris: result.redirect_uris,
	81	created_at: result.created_at,
	82	};
	83	}
	84
	85	async getClient(clientId: string): Promise<AnonOAuthClientRegistration \| null> {
	86	const result = await this.convex.query(
	87	api.anonymousOauth.getClient,
	88	{ internalSecret: this.internalSecret, clientId },
	89	);
	90
	91	if (!result) return null;
	92
	93	return {
	94	client_id: result.client_id,
	95	client_name: result.client_name ?? undefined,
	96	redirect_uris: result.redirect_uris,
	97	created_at: result.created_at,
	98	};
	99	}
	100	}

executor/lib/managed_runtime.ts+392−15

@@ -3,6 +3,13 @@ import os from "node:os"; · 2 unmodified lines
3	import path from "node:path";	3	import path from "node:path";
4		4
5	const CONVEX_BACKEND_REPO = "get-convex/convex-backend";	5	const CONVEX_BACKEND_REPO = "get-convex/convex-backend";
		6	const EXECUTOR_RELEASE_REPO = Bun.env.EXECUTOR_REPO ?? "RhysSullivan/assistant";
		7	const NODE_VERSION = "22.22.0";
		8	const CONVEX_CLI_VERSION = "1.31.7";
		9	const CONVEX_CLIENT_HEADER = `npm-cli-${CONVEX_CLI_VERSION}`;
		10
		11	type HostPlatform = "linux" \| "darwin";
		12	type HostArch = "x64" \| "arm64";
6		13
7	export interface ManagedRuntimeConfig {	14	export interface ManagedRuntimeConfig {
8	instanceName: string;	15	instanceName: string;
@@ -22,6 +29,25 @@ export interface ManagedRuntimeInfo { · 13 unmodified lines
22	storageDir: string;	29	storageDir: string;
23	configPath: string;	30	configPath: string;
24	config: ManagedRuntimeConfig;	31	config: ManagedRuntimeConfig;
		32	nodeDir: string;
		33	nodeBin: string;
		34	npmBin: string;
		35	npmPrefix: string;
		36	convexCliEntry: string;
		37	webDir: string;
		38	webServerEntry: string;
		39	webArtifactName: string;
		40	webDownloadUrl: string;
		41	}
		42
		43	function hostTarget(): { platform: HostPlatform; arch: HostArch } {
		44	if (process.platform !== "linux" && process.platform !== "darwin") {
		45	throw new Error(`Unsupported platform: ${process.platform}. Supported platforms are linux and darwin.`);
		46	}
		47	if (process.arch !== "x64" && process.arch !== "arm64") {
		48	throw new Error(`Unsupported architecture: ${process.arch}. Supported architectures are x64 and arm64.`);
		49	}
		50	return { platform: process.platform, arch: process.arch };
25	}	51	}
26		52
27	function runtimeRootDir(): string {	53	function runtimeRootDir(): string {
@@ -37,22 +63,36 @@ function backendBinaryName(): string { · 9 unmodified lines
37	}	63	}
38		64
39	function backendAssetName(): string {	65	function backendAssetName(): string {
40	if (process.platform === "linux" && process.arch === "x64") {	66	const target = hostTarget();
		67	if (target.platform === "linux" && target.arch === "x64") {
41	return "convex-local-backend-x86_64-unknown-linux-gnu.zip";	68	return "convex-local-backend-x86_64-unknown-linux-gnu.zip";
42	}	69	}
43	if (process.platform === "linux" && process.arch === "arm64") {	70	if (target.platform === "linux" && target.arch === "arm64") {
44	return "convex-local-backend-aarch64-unknown-linux-gnu.zip";	71	return "convex-local-backend-aarch64-unknown-linux-gnu.zip";
45	}	72	}
46	if (process.platform === "darwin" && process.arch === "x64") {	73	if (target.platform === "darwin" && target.arch === "x64") {
47	return "convex-local-backend-x86_64-apple-darwin.zip";	74	return "convex-local-backend-x86_64-apple-darwin.zip";
48	}	75	}
49	if (process.platform === "darwin" && process.arch === "arm64") {	76	return "convex-local-backend-aarch64-apple-darwin.zip";
50	return "convex-local-backend-aarch64-apple-darwin.zip";	77	}
51	}
52		78
53	throw new Error(	79	function webAssetName(): string {
54	`Unsupported platform/arch for managed Convex backend: ${process.platform}/${process.arch}`,	80	const target = hostTarget();
55	);	81	return `executor-web-${target.platform}-${target.arch}.tar.gz`;
		82	}
		83
		84	function nodeArchiveName(): string {
		85	const target = hostTarget();
		86	return `node-v${NODE_VERSION}-${target.platform}-${target.arch}.tar.gz`;
		87	}
		88
		89	function nodeDirectoryName(): string {
		90	const target = hostTarget();
		91	return `node-v${NODE_VERSION}-${target.platform}-${target.arch}`;
		92	}
		93
		94	function npmBinaryName(): string {
		95	return process.platform === "win32" ? "npm.cmd" : "npm";
56	}	96	}
57		97
58	function randomHex(bytes: number): string {	98	function randomHex(bytes: number): string {
@@ -65,7 +105,7 @@ function defaultConfig(): ManagedRuntimeConfig { · 6 unmodified lines
65	const backendPort = Number(Bun.env.EXECUTOR_BACKEND_PORT ?? 5410);	105	const backendPort = Number(Bun.env.EXECUTOR_BACKEND_PORT ?? 5410);
66	const siteProxyPort = Number(Bun.env.EXECUTOR_BACKEND_SITE_PORT ?? 5411);	106	const siteProxyPort = Number(Bun.env.EXECUTOR_BACKEND_SITE_PORT ?? 5411);
67	return {	107	return {
68	instanceName: Bun.env.EXECUTOR_INSTANCE_NAME ?? "executor-local",	108	instanceName: Bun.env.EXECUTOR_INSTANCE_NAME ?? "anonymous-executor",
69	instanceSecret: Bun.env.EXECUTOR_INSTANCE_SECRET ?? randomHex(32),	109	instanceSecret: Bun.env.EXECUTOR_INSTANCE_SECRET ?? randomHex(32),
70	hostInterface: Bun.env.EXECUTOR_BACKEND_INTERFACE ?? "127.0.0.1",	110	hostInterface: Bun.env.EXECUTOR_BACKEND_INTERFACE ?? "127.0.0.1",
71	backendPort,	111	backendPort,
@@ -111,12 +151,11 @@ async function runProcess( · 39 unmodified lines
111	async function downloadWithFetch(url: string, destinationPath: string): Promise<void> {	151	async function downloadWithFetch(url: string, destinationPath: string): Promise<void> {
112	const response = await fetch(url);	152	const response = await fetch(url);
113	if (!response.ok \|\| !response.body) {	153	if (!response.ok \|\| !response.body) {
114	throw new Error(`Failed downloading Convex backend from ${url} (${response.status})`);	154	throw new Error(`Failed downloading ${url} (${response.status})`);
115	}	155	}
116		156
117	const totalBytes = Number(response.headers.get("content-length") ?? "0");	157	const totalBytes = Number(response.headers.get("content-length") ?? "0");
118	const totalMb = totalBytes > 0 ? (totalBytes / (1024 * 1024)).toFixed(1) : null;	158	const totalMb = totalBytes > 0 ? (totalBytes / (1024 * 1024)).toFixed(1) : null;
119
120	const file = await fs.open(destinationPath, "w");	159	const file = await fs.open(destinationPath, "w");
121	let downloadedBytes = 0;	160	let downloadedBytes = 0;
122	let nextPercentLog = 10;	161	let nextPercentLog = 10;
@@ -135,7 +174,9 @@ async function downloadWithFetch(url: string, destinationPath: string): Promise< · 12 unmodified lines
135	if (totalBytes > 0) {	174	if (totalBytes > 0) {
136	const percent = Math.floor((downloadedBytes / totalBytes) * 100);	175	const percent = Math.floor((downloadedBytes / totalBytes) * 100);
137	if (percent >= nextPercentLog) {	176	if (percent >= nextPercentLog) {
138	console.log(`[executor] download progress ${percent}% (${(downloadedBytes / (1024 * 1024)).toFixed(1)}MB/${totalMb}MB)`);	177	console.log(
		178	`[executor] download progress ${percent}% (${(downloadedBytes / (1024 * 1024)).toFixed(1)}MB/${totalMb}MB)`,
		179	);
139	nextPercentLog += 10;	180	nextPercentLog += 10;
140	}	181	}
141	} else {	182	} else {
@@ -187,7 +228,16 @@ async function extractZipArchive(archivePath: string, destinationDir: string): P · 45 unmodified lines
187	stdin: "ignore",	228	stdin: "ignore",
188	});	229	});
189	if (python.exitCode !== 0) {	230	if (python.exitCode !== 0) {
190	throw new Error("Failed to extract Convex backend archive. Install unzip or python3.");	231	throw new Error("Failed to extract zip archive. Install unzip or python3.");
		232	}
		233	}
		234
		235	async function extractTarArchive(archivePath: string, destinationDir: string): Promise<void> {
		236	const untar = await runProcess("tar", ["-xzf", archivePath, "-C", destinationDir], {
		237	stdin: "ignore",
		238	});
		239	if (untar.exitCode !== 0) {
		240	throw new Error(`Failed to extract tar archive: ${archivePath}`);
191	}	241	}
192	}	242	}
193		243
@@ -199,6 +249,13 @@ function runtimeInfo(): ManagedRuntimeInfo { · 5 unmodified lines
199	const dbPath = path.join(rootDir, "convex-data", "convex_local_backend.sqlite3");	249	const dbPath = path.join(rootDir, "convex-data", "convex_local_backend.sqlite3");
200	const storageDir = path.join(rootDir, "convex-data", "storage");	250	const storageDir = path.join(rootDir, "convex-data", "storage");
201	const configPath = path.join(rootDir, "convex-backend.json");	251	const configPath = path.join(rootDir, "convex-backend.json");
		252	const nodeDir = path.join(rootDir, nodeDirectoryName());
		253	const nodeBin = path.join(nodeDir, "bin", "node");
		254	const npmPrefix = path.join(rootDir, "npm");
		255	const npmBin = path.join(nodeDir, "bin", npmBinaryName());
		256	const convexCliEntry = path.join(npmPrefix, "node_modules", "convex", "bin", "main.js");
		257	const webDir = path.join(rootDir, "web");
		258	const webArtifact = webAssetName();
202		259
203	return {	260	return {
204	rootDir,	261	rootDir,
@@ -210,6 +267,15 @@ function runtimeInfo(): ManagedRuntimeInfo { · 5 unmodified lines
210	storageDir,	267	storageDir,
211	configPath,	268	configPath,
212	config: defaultConfig(),	269	config: defaultConfig(),
		270	nodeDir,
		271	nodeBin,
		272	npmBin,
		273	npmPrefix,
		274	convexCliEntry,
		275	webDir,
		276	webServerEntry: path.join(webDir, "server.js"),
		277	webArtifactName: webArtifact,
		278	webDownloadUrl: `https://github.com/${EXECUTOR_RELEASE_REPO}/releases/latest/download/${webArtifact}`,
213	};	279	};
214	}	280	}
215		281
@@ -217,6 +283,11 @@ async function ensureConfig(info: ManagedRuntimeInfo): Promise<ManagedRuntimeCon · 1 unmodified line
217	if (await pathExists(info.configPath)) {	283	if (await pathExists(info.configPath)) {
218	const raw = await fs.readFile(info.configPath, "utf8");	284	const raw = await fs.readFile(info.configPath, "utf8");
219	const parsed = JSON.parse(raw) as ManagedRuntimeConfig;	285	const parsed = JSON.parse(raw) as ManagedRuntimeConfig;
		286	if (parsed.instanceName === "executor-local") {
		287	parsed.instanceName = "anonymous-executor";
		288	await fs.writeFile(info.configPath, `${JSON.stringify(parsed, null, 2)}\n`, "utf8");
		289	console.log("[executor] migrated instanceName from executor-local to anonymous-executor");
		290	}
220	return parsed;	291	return parsed;
221	}	292	}
222		293
@@ -254,6 +325,259 @@ async function ensureBackendBinary(info: ManagedRuntimeInfo): Promise<void> { · 31 unmodified lines
254	}	325	}
255	}	326	}
256		327
		328	async function ensureNodeRuntime(info: ManagedRuntimeInfo): Promise<void> {
		329	if (await pathExists(info.nodeBin)) {
		330	return;
		331	}
		332
		333	const archiveName = nodeArchiveName();
		334	const archiveUrl = `https://nodejs.org/dist/v${NODE_VERSION}/${archiveName}`;
		335
		336	const tempDir = await fs.mkdtemp(path.join(os.tmpdir(), "executor-node-runtime-"));
		337	const archivePath = path.join(tempDir, archiveName);
		338	try {
		339	await fs.mkdir(info.rootDir, { recursive: true });
		340	console.log(`[executor] downloading managed Node runtime (${archiveName})`);
		341	await downloadArchive(archiveUrl, archivePath);
		342
		343	console.log("[executor] extracting managed Node runtime");
		344	await extractTarArchive(archivePath, info.rootDir);
		345	} finally {
		346	await fs.rm(tempDir, { recursive: true, force: true });
		347	}
		348
		349	if (!(await pathExists(info.nodeBin))) {
		350	throw new Error(`Node runtime install incomplete. Expected node executable at ${info.nodeBin}`);
		351	}
		352	}
		353
		354	async function ensureConvexCliRuntime(info: ManagedRuntimeInfo): Promise<void> {
		355	if (await pathExists(info.convexCliEntry)) {
		356	return;
		357	}
		358
		359	await ensureNodeRuntime(info);
		360	await fs.mkdir(info.npmPrefix, { recursive: true });
		361
		362	const env = {
		363	...process.env,
		364	PATH: `${path.dirname(info.nodeBin)}:${process.env.PATH ?? ""}`,
		365	};
		366
		367	console.log(`[executor] installing managed Convex CLI (${CONVEX_CLI_VERSION})`);
		368	const install = await runProcess(
		369	info.npmBin,
		370	[
		371	"install",
		372	"--prefix",
		373	info.npmPrefix,
		374	"--no-audit",
		375	"--no-fund",
		376	"--loglevel",
		377	"error",
		378	`convex@${CONVEX_CLI_VERSION}`,
		379	],
		380	{ env },
		381	);
		382
		383	if (install.exitCode !== 0 \|\| !(await pathExists(info.convexCliEntry))) {
		384	throw new Error("Failed to install managed Convex CLI runtime.");
		385	}
		386	}
		387
		388	async function generateSelfHostedAdminKey(info: ManagedRuntimeInfo): Promise<string> {
		389	const response = await fetch("https://api.convex.dev/api/local_deployment/generate_admin_key", {
		390	method: "POST",
		391	headers: {
		392	"Content-Type": "application/json",
		393	"Convex-Client": CONVEX_CLIENT_HEADER,
		394	},
		395	body: JSON.stringify({
		396	instanceName: info.config.instanceName,
		397	instanceSecret: info.config.instanceSecret,
		398	}),
		399	});
		400
		401	if (!response.ok) {
		402	const text = await response.text();
		403	throw new Error(`Failed generating self-hosted admin key: ${text \|\| response.statusText}`);
		404	}
		405
		406	const parsed = (await response.json()) as { adminKey?: string };
		407	if (!parsed.adminKey) {
		408	throw new Error("Convex admin key generation did not return an admin key.");
		409	}
		410
		411	return parsed.adminKey;
		412	}
		413
		414	async function findProjectDir(): Promise<string \| null> {
		415	const candidates = [
		416	Bun.env.EXECUTOR_PROJECT_DIR,
		417	process.cwd(),
		418	path.resolve(import.meta.dir, ".."),
		419	].filter((value): value is string => Boolean(value && value.trim().length > 0));
		420
		421	for (const candidate of candidates) {
		422	const convexDir = path.join(candidate, "convex");
		423	const convexConfig = path.join(convexDir, "convex.config.ts");
		424	const convexJson = path.join(candidate, "convex.json");
		425	if ((await pathExists(convexDir)) && (await pathExists(convexConfig)) && (await pathExists(convexJson))) {
		426	return candidate;
		427	}
		428	}
		429
		430	return null;
		431	}
		432
		433	async function writeBootstrapEnvFile(info: ManagedRuntimeInfo, adminKey: string): Promise<string> {
		434	const tempDir = await fs.mkdtemp(path.join(os.tmpdir(), "executor-convex-env-"));
		435	const filePath = path.join(tempDir, "selfhost.env");
		436	const contents = [
		437	`CONVEX_SELF_HOSTED_URL=http://${info.config.hostInterface}:${info.config.backendPort}`,
		438	`CONVEX_SELF_HOSTED_ADMIN_KEY=${adminKey}`,
		439	].join("\n");
		440	await fs.writeFile(filePath, `${contents}\n`, "utf8");
		441	return filePath;
		442	}
		443
		444	async function runManagedConvexCli(
		445	info: ManagedRuntimeInfo,
		446	projectDir: string,
		447	args: string[],
		448	envFilePath: string,
		449	options?: { stdout?: "inherit" \| "pipe"; stderr?: "inherit" \| "pipe" },
		450	): Promise<{ exitCode: number; stdout: string; stderr: string }> {
		451	const env = {
		452	...process.env,
		453	PATH: `${path.dirname(info.nodeBin)}:${process.env.PATH ?? ""}`,
		454	CONVEX_DEPLOYMENT: "",
		455	CONVEX_URL: "",
		456	CONVEX_SITE_URL: "",
		457	};
		458
		459	return await runProcess(
		460	info.nodeBin,
		461	[info.convexCliEntry, ...args, "--env-file", envFilePath],
		462	{
		463	cwd: projectDir,
		464	env,
		465	stdout: options?.stdout ?? "inherit",
		466	stderr: options?.stderr ?? "inherit",
		467	},
		468	);
		469	}
		470
		471	async function waitForBackendReady(info: ManagedRuntimeInfo, timeoutMs = 30_000): Promise<void> {
		472	const target = `http://${info.config.hostInterface}:${info.config.backendPort}/instance_name`;
		473	const started = Date.now();
		474
		475	while (Date.now() - started < timeoutMs) {
		476	try {
		477	const response = await fetch(target);
		478	if (response.ok) {
		479	return;
		480	}
		481	} catch {
		482	// still starting
		483	}
		484	await Bun.sleep(500);
		485	}
		486
		487	throw new Error("Timed out waiting for local Convex backend to become ready.");
		488	}
		489
		490	async function ensureProjectBootstrapped(info: ManagedRuntimeInfo): Promise<void> {
		491	if (Bun.env.EXECUTOR_SKIP_BOOTSTRAP === "1") {
		492	return;
		493	}
		494
		495	const projectDir = await findProjectDir();
		496	if (!projectDir) {
		497	console.log("[executor] no local Convex project found; skipping function bootstrap");
		498	return;
		499	}
		500
		501	await ensureConvexCliRuntime(info);
		502	const adminKey = await generateSelfHostedAdminKey(info);
		503	const envFilePath = await writeBootstrapEnvFile(info, adminKey);
		504
		505	try {
		506	const check = await runManagedConvexCli(
		507	info,
		508	projectDir,
		509	["run", "app:getClientConfig"],
		510	envFilePath,
		511	{ stdout: "pipe", stderr: "pipe" },
		512	);
		513
		514	if (check.exitCode === 0) {
		515	console.log("[executor] Convex functions already bootstrapped");
		516	return;
		517	}
		518
		519	console.log("[executor] bootstrapping Convex functions to local backend");
		520	const deploy = await runManagedConvexCli(
		521	info,
		522	projectDir,
		523	["dev", "--once", "--typecheck", "disable", "--codegen", "disable"],
		524	envFilePath,
		525	);
		526
		527	if (deploy.exitCode !== 0) {
		528	throw new Error("Convex bootstrap failed while deploying local functions.");
		529	}
		530	} finally {
		531	await fs.rm(path.dirname(envFilePath), { recursive: true, force: true });
		532	}
		533	}
		534
		535	async function ensureWebBundle(info: ManagedRuntimeInfo): Promise<void> {
		536	if (await pathExists(info.webServerEntry)) {
		537	return;
		538	}
		539
		540	const legacyWebDir = path.join(os.homedir(), ".executor", "web");
		541	const legacyWebEntry = path.join(legacyWebDir, "server.js");
		542	if (await pathExists(legacyWebEntry)) {
		543	console.log(`[executor] using existing legacy web bundle at ${legacyWebDir}`);
		544	await fs.rm(info.webDir, { recursive: true, force: true });
		545	await fs.mkdir(path.dirname(info.webDir), { recursive: true });
		546	await fs.cp(legacyWebDir, info.webDir, { recursive: true });
		547	return;
		548	}
		549
		550	const tempDir = await fs.mkdtemp(path.join(os.tmpdir(), "executor-web-bundle-"));
		551	const archivePath = path.join(tempDir, info.webArtifactName);
		552	const localFallbackArchive = path.resolve(import.meta.dir, "..", "dist", "release", info.webArtifactName);
		553
		554	try {
		555	console.log(`[executor] downloading managed web bundle (${info.webArtifactName})`);
		556	try {
		557	await downloadArchive(info.webDownloadUrl, archivePath);
		558	} catch (error) {
		559	if (await pathExists(localFallbackArchive)) {
		560	console.log(`[executor] release web bundle unavailable, using local artifact ${localFallbackArchive}`);
		561	await fs.copyFile(localFallbackArchive, archivePath);
		562	} else {
		563	throw error;
		564	}
		565	}
		566
		567	await fs.rm(info.webDir, { recursive: true, force: true });
		568	await fs.mkdir(info.webDir, { recursive: true });
		569
		570	console.log("[executor] extracting managed web bundle");
		571	await extractTarArchive(archivePath, info.webDir);
		572	} finally {
		573	await fs.rm(tempDir, { recursive: true, force: true });
		574	}
		575
		576	if (!(await pathExists(info.webServerEntry))) {
		577	throw new Error(`Web bundle install incomplete. Expected server entry at ${info.webServerEntry}`);
		578	}
		579	}
		580
257	function backendArgs(info: ManagedRuntimeInfo, additionalArgs: string[]): string[] {	581	function backendArgs(info: ManagedRuntimeInfo, additionalArgs: string[]): string[] {
258	const cfg = info.config;	582	const cfg = info.config;
259	return [	583	return [
@@ -286,7 +610,60 @@ export async function ensureManagedRuntime(): Promise<ManagedRuntimeInfo> { · 26 unmodified lines
286		610
287	export async function runManagedBackend(args: string[]): Promise<number> {	611	export async function runManagedBackend(args: string[]): Promise<number> {
288	const info = await ensureManagedRuntime();	612	const info = await ensureManagedRuntime();
289	const proc = await runProcess(info.backendBinary, backendArgs(info, args));	613	const env = {
		614	...process.env,
		615	PATH: `${path.dirname(info.nodeBin)}:${process.env.PATH ?? ""}`,
		616	};
		617
		618	const proc = Bun.spawn([info.backendBinary, ...backendArgs(info, args)], {
		619	env,
		620	stdin: "inherit",
		621	stdout: "inherit",
		622	stderr: "inherit",
		623	});
		624
		625	if (args.length === 0) {
		626	try {
		627	await waitForBackendReady(info);
		628	await ensureProjectBootstrapped(info);
		629	} catch (error) {
		630	const message = error instanceof Error ? error.message : String(error);
		631	console.warn(`[executor] bootstrap skipped: ${message}`);
		632	}
		633	}
		634
		635	return await proc.exited;
		636	}
		637
		638	export async function runManagedWeb(options: { port?: number } = {}): Promise<number> {
		639	const info = await ensureManagedRuntime();
		640	try {
		641	await waitForBackendReady(info, 3_000);
		642	await ensureProjectBootstrapped(info);
		643	} catch {
		644	// Backend not running yet; web can still start and retry queries later.
		645	}
		646	await ensureNodeRuntime(info);
		647	await ensureWebBundle(info);
		648
		649	const mcpPort = Number(Bun.env.EXECUTOR_MCP_GATEWAY_PORT ?? 5313);
		650	const webPort = options.port ?? Number(Bun.env.EXECUTOR_WEB_PORT ?? 5312);
		651	const host = Bun.env.EXECUTOR_WEB_INTERFACE ?? "127.0.0.1";
		652
		653	const env = {
		654	...process.env,
		655	NODE_ENV: "production",
		656	PORT: String(webPort),
		657	HOSTNAME: host,
		658	CONVEX_URL: process.env.CONVEX_URL ?? `http://${info.config.hostInterface}:${info.config.backendPort}`,
		659	CONVEX_SITE_URL: process.env.CONVEX_SITE_URL ?? `http://${info.config.hostInterface}:${info.config.siteProxyPort}`,
		660	NEXT_PUBLIC_LOCAL_MCP_ORIGIN: process.env.NEXT_PUBLIC_LOCAL_MCP_ORIGIN ?? `http://localhost:${mcpPort}`,
		661	};
		662
		663	const proc = await runProcess(info.nodeBin, [info.webServerEntry], {
		664	cwd: info.webDir,
		665	env,
		666	});
290	return proc.exitCode;	667	return proc.exitCode;
291	}	668	}
292		669

executor/lib/mcp-gateway-oauth-sdk.test.ts+21−10

 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import { UnauthorizedError } from "@modelcontextprotocol/sdk/client/auth.js";
-import type { OAuthClientProvider, OAuthClientMetadata } from "@modelcontextprotocol/sdk/client/auth.js";
+import type { OAuthClientProvider } from "@modelcontextprotocol/sdk/client/auth.js";
+import type { OAuthClientMetadata } from "@modelcontextprotocol/sdk/shared/auth.js";
 import { AnonymousOAuthServer, OAuthBadRequest } from "./anonymous-oauth";
 import { handleMcpRequest, type McpWorkspaceContext } from "./mcp_server";
 import type { AnonymousContext, CreateTaskInput, TaskRecord, ToolDescriptor } from "./types";
   get clientMetadata(): OAuthClientMetadata {
     return {
-      redirect_uris: [new URL("http://localhost:0/callback")],
+      redirect_uris: ["http://localhost:0/callback"],
       client_name: "mcp-oauth-sdk-test",
     };
   }
       if (url.pathname === "/register" && request.method === "POST") {
         const body = await request.json();
         try {
-          return Response.json(oauthServer.registerClient(body as any), { status: 201 });
+          const reg = await oauthServer.registerClient(body as any);
+          return Response.json(reg, { status: 201 });
         } catch (e) {
           if (e instanceof OAuthBadRequest) {
             return Response.json({ error: "invalid_client_metadata", error_description: e.message }, { status: 400 });
       if (url.pathname === "/authorize" && request.method === "GET") {
         try {
-          const { redirectTo } = oauthServer.authorize(url.searchParams);
+          const { redirectTo } = await oauthServer.authorize(url.searchParams);
           return Response.redirect(redirectTo, 302);
         } catch (e) {
           if (e instanceof OAuthBadRequest) {
     // Step 4: Complete the auth flow — SDK exchanges code for token
     await transport.finishAuth(code);
-    // Step 5: Now connect succeeds
+    // Step 5: Create a new transport + client (the old transport was already started
-    await client.connect(transport);
+    // by the first connect call — the SDK doesn't allow re-starting it).
+    // The provider now has tokens stored, so this connection will succeed.
+    const transport2 = new StreamableHTTPClientTransport(mcpUrl, {
+      authProvider: provider,
+    });
+    const client2 = new Client(
+      { name: "oauth-e2e-test", version: "1.0.0" },
+      { capabilities: {} },
+    );
+    await client2.connect(transport2);
     // Step 6: Make a tool call — this uses the Bearer token automatically
-    const tools = await client.listTools();
+    const tools = await client2.listTools();
     expect(tools.tools.length).toBeGreaterThan(0);
     expect(tools.tools[0].name).toBe("run_code");
-    const result = (await client.callTool({
+    const result = (await client2.callTool({
       name: "run_code",
       arguments: {
         code: "return 42",
     expect(typeof structured?.actorId).toBe("string");
     // Cleanup
-    await transport.close().catch(() => {});
+    await transport2.close().catch(() => {});
-    await client.close().catch(() => {});
+    await client2.close().catch(() => {});
   });
 });

executor/lib/mcp-gateway-oauth.test.ts+4−2

       if (url.pathname === "/register" && request.method === "POST") {
         const body = await request.json();
         try {
-          const reg = oauthServer.registerClient(body as any);
+          const reg = await oauthServer.registerClient(body as any);
           return Response.json(reg, { status: 201 });
         } catch (error) {
           if (error instanceof OAuthBadRequest) {
       if (url.pathname === "/authorize" && request.method === "GET") {
         try {
-          const { redirectTo } = oauthServer.authorize(url.searchParams);
+          const { redirectTo } = await oauthServer.authorize(url.searchParams);
           return Response.redirect(redirectTo, 302);
         } catch (error) {
           if (error instanceof OAuthBadRequest) {
       body: new URLSearchParams({
         grant_type: "authorization_code",
         code,
+        client_id,
         redirect_uri: "http://localhost:9999/callback",
         code_verifier: codeVerifier,
       }).toString(),
         body: new URLSearchParams({
           grant_type: "authorization_code",
           code,
+          client_id,
           redirect_uri: "http://localhost:9999/callback",
           code_verifier: codeVerifier,
         }).toString(),

executor/mcp-gateway.ts+11−5

 import { api } from "./convex/_generated/api";
 import { handleMcpRequest, type McpWorkspaceContext } from "./lib/mcp_server";
 import { AnonymousOAuthServer, OAuthBadRequest } from "./lib/anonymous-oauth";
+import { ConvexOAuthStorage } from "./lib/convex-oauth-storage";
 import type { AnonymousContext, PendingApprovalRecord, TaskRecord, ToolDescriptor } from "./lib/types";
 import type { Id } from "./convex/_generated/dataModel";
 }
 async function initAnonymousOAuth(issuer: string): Promise<void> {
-  anonOAuth = new AnonymousOAuthServer({ issuer });
+  const internalSecret = Bun.env.EXECUTOR_INTERNAL_TOKEN;
+  const storage = convexUrl && internalSecret
+    ? new ConvexOAuthStorage(convexUrl, internalSecret)
+    : undefined;
+  anonOAuth = new AnonymousOAuthServer({ issuer, storage });
   await anonOAuth.init();
 }
   }
   try {
-    const registration = anonOAuth.registerClient(body as any);
+    const registration = await anonOAuth.registerClient(body as any);
     return Response.json(registration, { status: 201 });
   } catch (error) {
     if (error instanceof OAuthBadRequest) {
   }
 }
-function handleAuthorize(request: Request): Response {
+async function handleAuthorize(request: Request): Promise<Response> {
   if (!anonOAuth) {
     return Response.json({ error: "Anonymous OAuth server not initialized" }, { status: 500 });
   }
   const url = new URL(request.url);
   try {
-    const { redirectTo } = anonOAuth.authorize(url.searchParams);
+    const { redirectTo } = await anonOAuth.authorize(url.searchParams);
     return Response.redirect(redirectTo, 302);
   } catch (error) {
     if (error instanceof OAuthBadRequest) {
       }
       if (url.pathname === "/authorize" && request.method === "GET") {
-        return handleAuthorize(request);
+        return await handleAuthorize(request);
       }
       if (url.pathname === "/token" && request.method === "POST") {

executor/package.json+1−0

@@ -7,6 +7,7 @@ · 6 unmodified lines
7	"up": "bun run executor.ts up",	7	"up": "bun run executor.ts up",
8	"backend": "bun run executor.ts backend",	8	"backend": "bun run executor.ts backend",
9	"convex": "bun run executor.ts backend",	9	"convex": "bun run executor.ts backend",
		10	"web": "bun run executor.ts web",
10	"gateway": "bun run executor.ts gateway",	11	"gateway": "bun run executor.ts gateway",
11	"deploy": "bunx convex deploy",	12	"deploy": "bunx convex deploy",
12	"codegen": "bunx convex codegen",	13	"codegen": "bunx convex codegen",

executor/scripts/build-release.ts+77−0

@@ -17,6 +17,16 @@ const targets: ReleaseTarget[] = [ · 16 unmodified lines
17	{ platform: "darwin", arch: "arm64", bunTarget: "bun-darwin-arm64" },	17	{ platform: "darwin", arch: "arm64", bunTarget: "bun-darwin-arm64" },
18	];	18	];
19		19
		20	function hostPlatformArch(): { platform: "linux" \| "darwin"; arch: "x64" \| "arm64" } {
		21	if (process.platform !== "linux" && process.platform !== "darwin") {
		22	throw new Error(`Unsupported host platform for web artifact build: ${process.platform}`);
		23	}
		24	if (process.arch !== "x64" && process.arch !== "arm64") {
		25	throw new Error(`Unsupported host architecture for web artifact build: ${process.arch}`);
		26	}
		27	return { platform: process.platform, arch: process.arch };
		28	}
		29
20	function archiveName(platform: ReleaseTarget["platform"], arch: ReleaseTarget["arch"]): string {	30	function archiveName(platform: ReleaseTarget["platform"], arch: ReleaseTarget["arch"]): string {
21	return `executor-${platform}-${arch}.tar.gz`;	31	return `executor-${platform}-${arch}.tar.gz`;
22	}	32	}
@@ -39,6 +49,71 @@ async function runArchiveCommand(command: string[], cwd?: string): Promise<void> · 16 unmodified lines
39	}	49	}
40	}	50	}
41		51
		52	async function pathExists(filePath: string): Promise<boolean> {
		53	try {
		54	await fs.access(filePath);
		55	return true;
		56	} catch {
		57	return false;
		58	}
		59	}
		60
		61	async function runCommand(command: string[], options: { cwd?: string; env?: Record<string, string \| undefined> } = {}): Promise<void> {
		62	const proc = Bun.spawn(command, {
		63	cwd: options.cwd,
		64	env: options.env,
		65	stdin: "inherit",
		66	stdout: "inherit",
		67	stderr: "inherit",
		68	});
		69	const code = await proc.exited;
		70	if (code !== 0) {
		71	throw new Error(`Command failed (${code}): ${command.join(" ")}`);
		72	}
		73	}
		74
		75	async function buildWebArtifact(rootDir: string, releaseDir: string, checksums: string[]): Promise<void> {
		76	const host = hostPlatformArch();
		77	const webAppDir = path.join(rootDir, "apps", "web");
		78	const webArtifactName = `executor-web-${host.platform}-${host.arch}.tar.gz`;
		79	const archivePath = path.join(releaseDir, webArtifactName);
		80
		81	const webBuildEnv = {
		82	...process.env,
		83	EXECUTOR_WEB_CONVEX_URL: "http://127.0.0.1:5410",
		84	NEXT_PUBLIC_LOCAL_MCP_ORIGIN: "http://localhost:5313",
		85	};
		86
		87	await runCommand(["bunx", "next", "build"], {
		88	cwd: webAppDir,
		89	env: webBuildEnv,
		90	});
		91
		92	const standaloneAppRoot = path.join(webAppDir, ".next", "standalone", "executor", "apps", "web");
		93	const staticRoot = path.join(webAppDir, ".next", "static");
		94	const publicRoot = path.join(webAppDir, "public");
		95	const stageRoot = path.join(releaseDir, `executor-web-${host.platform}-${host.arch}`);
		96
		97	if (!(await pathExists(standaloneAppRoot))) {
		98	throw new Error(`Missing standalone output at ${standaloneAppRoot}. Ensure next build output is standalone.`);
		99	}
		100
		101	await fs.rm(stageRoot, { recursive: true, force: true });
		102	await fs.mkdir(stageRoot, { recursive: true });
		103
		104	await fs.cp(standaloneAppRoot, stageRoot, { recursive: true });
		105	await fs.mkdir(path.join(stageRoot, ".next"), { recursive: true });
		106	await fs.cp(staticRoot, path.join(stageRoot, ".next", "static"), { recursive: true });
		107	if (await pathExists(publicRoot)) {
		108	await fs.cp(publicRoot, path.join(stageRoot, "public"), { recursive: true });
		109	}
		110
		111	await runArchiveCommand(["tar", "-czf", archivePath, "-C", stageRoot, "."]);
		112	const digest = await sha256(archivePath);
		113	checksums.push(`${digest} ${path.basename(archivePath)}`);
		114	console.log(`built ${webArtifactName}`);
		115	}
		116
42	async function main(): Promise<void> {	117	async function main(): Promise<void> {
43	const rootDir = path.resolve(import.meta.dir, "..");	118	const rootDir = path.resolve(import.meta.dir, "..");
44	const releaseDir = path.join(rootDir, "dist", "release");	119	const releaseDir = path.join(rootDir, "dist", "release");
@@ -78,6 +153,8 @@ async function main(): Promise<void> { · 33 unmodified lines
78	console.log(`built ${path.basename(archivePath)}`);	153	console.log(`built ${path.basename(archivePath)}`);
79	}	154	}
80		155
		156	await buildWebArtifact(rootDir, releaseDir, checksums);
		157
81	await Bun.write(path.join(releaseDir, "checksums.txt"), `${checksums.join("\n")}\n`);	158	await Bun.write(path.join(releaseDir, "checksums.txt"), `${checksums.join("\n")}\n`);
82	console.log(`wrote ${path.join("dist", "release", "checksums.txt")}`);	159	console.log(`wrote ${path.join("dist", "release", "checksums.txt")}`);
83	}	160	}

executor/uninstall+68−0

@@ -0,0 +1,68 @@
	1	#!/usr/bin/env bash
	2	set -euo pipefail
	3
	4	INSTALL_DIR="${EXECUTOR_INSTALL_DIR:-$HOME/.executor/bin}"
	5	RUNTIME_DIR="${EXECUTOR_RUNTIME_DIR:-$HOME/.executor/runtime}"
	6	LEGACY_WEB_DIR="${EXECUTOR_LEGACY_WEB_DIR:-$HOME/.executor/web}"
	7	EXECUTOR_HOME="${EXECUTOR_HOME_DIR:-$HOME/.executor}"
	8	ASSUME_YES="0"
	9
	10	usage() {
	11	cat <<EOF
	12	Executor uninstaller
	13
	14	Usage:
	15	bash executor/uninstall [--yes]
	16
	17	Options:
	18	-y, --yes Skip confirmation prompt
	19	-h, --help Show this help
	20	EOF
	21	}
	22
	23	while [[ $# -gt 0 ]]; do
	24	case "$1" in
	25	-y\|--yes)
	26	ASSUME_YES="1"
	27	shift
	28	;;
	29	-h\|--help)
	30	usage
	31	exit 0
	32	;;
	33	*)
	34	echo "Unknown option: $1"
	35	exit 1
	36	;;
	37	esac
	38	done
	39
	40	if [[ "$ASSUME_YES" != "1" ]]; then
	41	echo "This will remove:"
	42	echo " - $INSTALL_DIR/executor"
	43	echo " - $RUNTIME_DIR"
	44	echo " - $LEGACY_WEB_DIR"
	45	echo ""
	46	read -r -p "Continue? [y/N] " response
	47	if [[ ! "$response" =~ ^[Yy]$ ]]; then
	48	echo "Cancelled."
	49	exit 0
	50	fi
	51	fi
	52
	53	rm -f "$INSTALL_DIR/executor"
	54	rm -rf "$RUNTIME_DIR"
	55	rm -rf "$LEGACY_WEB_DIR"
	56
	57	if [[ -d "$INSTALL_DIR" ]]; then
	58	rmdir "$INSTALL_DIR" 2>/dev/null \|\| true
	59	fi
	60
	61	if [[ -d "$EXECUTOR_HOME" ]]; then
	62	rmdir "$EXECUTOR_HOME" 2>/dev/null \|\| true
	63	fi
	64
	65	echo "Executor uninstall complete."
	66	echo ""
	67	echo "If you previously added PATH manually, remove this line from your shell rc:"
	68	echo " export PATH=$INSTALL_DIR:\$PATH"