lael-labs/executor

apps/cloud/src/api/protected-api-key-auth.node.test.ts+1−0

@@ -89,6 +89,7 @@ describe("protected API key auth", () => { · 88 unmodified lines
89	);	89	);
90		90
91	expect(identity).toEqual({	91	expect(identity).toEqual({
		92	kind: "member",
92	accountId: "user_123",	93	accountId: "user_123",
93	organizationId: "org_123",	94	organizationId: "org_123",
94	organizationName: "Org org_123",	95	organizationName: "Org org_123",

apps/cloud/src/api/protected-jwt-auth.node.test.ts+1−0

@@ -110,6 +110,7 @@ describe("protected JWT (device-login) auth", () => { · 109 unmodified lines
110	const identity = yield* run(request(token), config);	110	const identity = yield* run(request(token), config);
111		111
112	expect(identity).toEqual({	112	expect(identity).toEqual({
		113	kind: "member",
113	accountId: "user_123",	114	accountId: "user_123",
114	organizationId: "org_123",	115	organizationId: "org_123",
115	organizationName: "Org org_123",	116	organizationName: "Org org_123",

apps/cloud/src/auth/workos-auth-provider.ts+3−0

     if (!org) return yield* new NoOrganization(NO_ORGANIZATION_IN_ACCESS_TOKEN);
     return {
+      kind: "member",
       accountId: verified.accountId,
       organizationId: org.id,
       organizationName: org.name,
     if (!org) return yield* new NoOrganization(NO_ORGANIZATION_IN_API_KEY);
     return {
+      kind: "member",
       accountId: owner.accountId,
       organizationId: org.id,
       organizationName: org.name,
     const org = yield* authorizeOrganizationSelector(session.userId, selector);
     if (!org) return yield* new NoOrganization(NO_ORGANIZATION_IN_SESSION);
     return {
+      kind: "member",
       accountId: session.userId,
       organizationId: org.id,
       organizationName: org.name,

apps/host-cloudflare/src/auth/cloudflare-access.ts+2−0

   const isAdmin = email.length > 0 && config.adminEmails.includes(email.toLowerCase());
   return {
+    kind: "member",
     accountId: sub || email || commonName,
     organizationId: config.organizationId,
     organizationName: config.organizationName,
   // fixed admin. Only when explicitly enabled (and the instance is otherwise
   // unprotected). Mirrors the local app's single-user model.
   const devPrincipal: Principal = {
+    kind: "member",
     accountId: "dev",
     organizationId: config.organizationId,
     organizationName: config.organizationName,

apps/host-selfhost/src/auth/identity.ts+1−0

@@ -67,6 +67,7 @@ export const betterAuthIdentityLayer: Layer.Layer<IdentityProvider, never, Bette · 66 unmodified lines
67	// default to the seeded org rather than rejecting with NoOrganization.	67	// default to the seeded org rather than rejecting with NoOrganization.
68	const resolvedOrganizationId = resolved.session.activeOrganizationId ?? organizationId;	68	const resolvedOrganizationId = resolved.session.activeOrganizationId ?? organizationId;
69	return {	69	return {
		70	kind: "member" as const,
70	accountId: resolved.user.id,	71	accountId: resolved.user.id,
71	organizationId: resolvedOrganizationId,	72	organizationId: resolvedOrganizationId,
72	organizationName,	73	organizationName,

apps/host-selfhost/src/platform-credential.test.ts+17−3

     new Request("http://localhost/api/connections", { headers: platformHeaders }),
   );
   expect(res.status).toBe(200);
-  const raw = await res.text();
+  const body = (await res.json()) as ReadonlyArray<{ readonly name: string }>;
-  // oxlint-disable-next-line executor/no-json-parse -- boundary: test asserts on the raw wire body (for the token sweep) and its parsed form together
+  const raw = JSON.stringify(body);
-  const body = JSON.parse(raw) as ReadonlyArray<{ readonly name: string }>;
   expect(
     body.map((connection) => connection.name),
     "the org-owned connection is visible",
   expect(raw, "no credential material either way").not.toContain("token");
 });
+test("the OAuth callback is refused despite being a GET", async () => {
+  // The one core GET with side effects: completing it would burn an org-owned
+  // in-flight authorization code in an outbound token exchange before the
+  // storage policy could refuse the final write. The safe-request gate excludes
+  // it by name; a platform credential landing here is a clear 403, not a
+  // half-executed flow.
+  const res = await handler(
+    new Request("http://localhost/api/oauth/callback?code=x&state=y", {
+      headers: platformHeaders,
+    }),
+  );
+  expect(res.status, "the callback is not a safe read").toBe(403);
+  expect(await res.text()).toContain("read-only");
+});
 test("every non-GET is refused before a handler runs", async () => {
   const post = await handler(
     new Request("http://localhost/api/connections", {

apps/host-selfhost/src/testing/test-app.ts+2−0

     IdentityProvider.of({
       authenticate: () =>
         Effect.succeed<Principal>({
+          kind: "member",
           accountId: options.userId,
           organizationId: options.organizationId,
           organizationName: options.organizationName,
       const organizationId = request.headers.get("x-test-org");
       if (!userId || !organizationId) return Effect.fail(new Unauthorized());
       return Effect.succeed<Principal>({
+        kind: "member",
         accountId: userId,
         organizationId,
         organizationName: `Org ${organizationId}`,

apps/local/src/identity.ts+1−0

@@ -31,6 +31,7 @@ import { safeEqual } from "./serve-shared"; · 30 unmodified lines
31	* cwd-derived (in `app.ts`), independent of these ids.	31	* cwd-derived (in `app.ts`), independent of these ids.
32	*/	32	*/
33	export const LOCAL_PRINCIPAL: Principal = {	33	export const LOCAL_PRINCIPAL: Principal = {
		34	kind: "member",
34	accountId: "local",	35	accountId: "local",
35	organizationId: "local",	36	organizationId: "local",
36	organizationName: "Local",	37	organizationName: "Local",

packages/core/api/src/server/execution-stack-middleware.ts+51−26

 // ---------------------------------------------------------------------------
 import { HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/unstable/http";
-import { Context, Effect, Layer } from "effect";
+import { Context, Data, Effect, Layer } from "effect";
 import type * as Cause from "effect/Cause";
 import type { AnyPlugin } from "@executor-js/sdk";
           const webRequest = yield* HttpServerRequest.toWeb(request);
           const resolved = yield* options.strategy.renderFailure(
             options.authenticate(webRequest).pipe(
-              // The PLATFORM branch's method gate lives here, before any
+              // The PLATFORM branch's gate lives here, before any handler: an
-              // handler: an org credential is read-only by construction, so a
+              // org credential is read-only by construction, so anything that
-              // non-GET request is refused as a typed 403 rather than reaching
+              // is not a safe read is refused as a typed 403 rather than
-              // a handler that would bind it to a subject or attempt a write
+              // reaching a handler that would bind it to a subject or attempt
-              // (the storage policy would refuse the write anyway — this makes
+              // a write (the storage policy would refuse the write anyway —
-              // the refusal a clear response instead of a 500).
+              // this makes the refusal a clear response instead of a 500).
               Effect.filterOrFail(
-                (principal): principal is ResolvedPrincipal =>
+                (principal) =>
-                  !isPlatformPrincipal(principal) || webRequest.method === "GET",
+                  !isPlatformPrincipal(principal) ||
+                  isPlatformSafeRequest(webRequest.method, new URL(webRequest.url).pathname),
                 () =>
                   new ReadOnlyCredential({
                     code: "read_only_credential",
           if (isPlatformPrincipal(resolved)) {
             // Org credential: the subject-less, write-refusing platform stack.
             // No `touchSubject` runs, so the credential never mints a phantom
-            // user row in the very lists the admin plane serves.
+            // user row in the very lists the admin plane serves. Neither
+            // `RequestWebOrigin` nor `RequestOrgSlug` is provided: both feed
+            // browser-handoff URL construction, which only interactive member
+            // flows perform, and `makePlatformExecutor` reads neither.
             const { executor } = yield* makePlatformExecutionStack<TPlugins>(
               resolved.organizationId,
             ).pipe(
               Effect.provide(options.stackLayer),
-              Effect.provideService(RequestWebOrigin, {
-                origin: requestWebOriginFromRequest(webRequest),
-              }),
               Effect.withSpan("executor.stack.http.resolve_platform"),
             );
             return yield* httpEffect.pipe(
 ): value is ResolvedPrincipal => !HttpServerResponse.isHttpServerResponse(value);
 /**
- * The engine the platform branch provides: every read answers "nothing here",
+ * Whether a request is a SAFE READ the platform branch may serve. The method
- * honestly — the platform view owns no executions and pauses none. The
+ * check (GET, plus HEAD — the router serves HEAD off the GET route) is
- * execute/resume members exist only to satisfy the service shape; they sit
+ * necessary but NOT sufficient: `GET /oauth/callback` is the one core GET with
- * behind the middleware's GET-only gate, so reaching one is a wiring bug and
+ * side effects — completing it reads an org-owned oauth session, performs an
- * dies as a defect rather than failing with a typed error a client could
+ * outbound authorization-code exchange with the org's client credentials, and
- * mistake for a product answer.
+ * then attempts the connection write. A read-only credential must be refused
+ * BEFORE that exchange burns the in-flight code, not after the storage policy
+ * rejects the final write, so the callback path is excluded by name. It is a
+ * browser-redirect surface — no legitimate machine-credential caller lands on
+ * it with a Bearer header.
+ */
+const isPlatformSafeRequest = (method: string, pathname: string): boolean =>
+  (method === "GET" || method === "HEAD") && !pathname.endsWith("/oauth/callback");
+/** Reaching an engine member the platform branch cannot honestly serve is a
+ *  wiring bug (the safe-request gate keeps those paths unreachable), so it
+ *  dies as a tagged defect rather than failing with a typed error a client
+ *  could mistake for a product answer. */
+class PlatformEngineUnavailable extends Data.TaggedError("PlatformEngineUnavailable")<{
+  readonly member: string;
+}> {}
+/**
+ * The engine the platform branch provides. The one member a safe read can
+ * actually reach — `getPausedExecution`, via `GET /executions/:id` — answers
+ * null (a 404), honestly: the platform view owns no executions. The paused
+ * counters answer the same empty story for any future reader. Everything else
+ * (execute, resume, the MCP tool description) exists to satisfy the service
+ * shape, sits behind the middleware's safe-request gate, and dies if reached.
  */
 const readOnlyExecutionEngine: ExecutionEngine<Cause.YieldableError> = {
-  // oxlint-disable-next-line executor/no-effect-escape-hatch -- boundary: unreachable behind the middleware's GET-only gate; reaching it is a wiring bug, not a typed product outcome
+  // oxlint-disable-next-line executor/no-effect-escape-hatch -- boundary: unreachable behind the middleware's safe-request gate; reaching it is a wiring bug, not a typed product outcome
-  execute: () => Effect.die("platform credential: execution engine unavailable"),
+  execute: () => Effect.die(new PlatformEngineUnavailable({ member: "execute" })),
-  // oxlint-disable-next-line executor/no-effect-escape-hatch -- boundary: unreachable behind the middleware's GET-only gate; reaching it is a wiring bug, not a typed product outcome
+  // oxlint-disable-next-line executor/no-effect-escape-hatch -- boundary: unreachable behind the middleware's safe-request gate; reaching it is a wiring bug, not a typed product outcome
-  executeWithPause: () => Effect.die("platform credential: execution engine unavailable"),
+  executeWithPause: () => Effect.die(new PlatformEngineUnavailable({ member: "executeWithPause" })),
-  // oxlint-disable-next-line executor/no-effect-escape-hatch -- boundary: unreachable behind the middleware's GET-only gate; reaching it is a wiring bug, not a typed product outcome
+  // oxlint-disable-next-line executor/no-effect-escape-hatch -- boundary: unreachable behind the middleware's safe-request gate; reaching it is a wiring bug, not a typed product outcome
-  resume: () => Effect.die("platform credential: execution engine unavailable"),
+  resume: () => Effect.die(new PlatformEngineUnavailable({ member: "resume" })),
   getPausedExecution: () => Effect.succeed(null),
   pausedExecutionCount: () => Effect.succeed(0),
   hasPausedExecutions: () => Effect.succeed(false),
-  getDescription: Effect.succeed(""),
+  // oxlint-disable-next-line executor/no-effect-escape-hatch -- boundary: only the MCP tool server reads this, and the MCP plane never serves a platform credential
+  getDescription: Effect.die(new PlatformEngineUnavailable({ member: "getDescription" })),
 };
 const LOOPBACK_HOSTNAMES = new Set(["localhost", "127.0.0.1", "::1", "[::1]"]);

packages/core/api/src/server/execution-stack.ts+7−6

@@ -147,12 +147,13 @@ export const makeExecutionStack = < · 146 unmodified lines
147		147
148	// ---------------------------------------------------------------------------	148	// ---------------------------------------------------------------------------
149	// makePlatformExecutionStack — the org-credential sibling: a subject-less,	149	// makePlatformExecutionStack — the org-credential sibling: a subject-less,
150	// write-refusing executor (`makePlatformExecutor`) and NO engine. An org key is	150	// write-refusing executor (`makePlatformExecutor`) and no REAL engine. An org
151	// an observer; the execution engine exists to run code as an acting member, so	151	// key is an observer; the execution engine exists to run code as an acting
152	// rather than building one that would fail on use, the middleware refuses	152	// member, so no engine is built here. The middleware still provides
153	// non-GET requests up front and never provides `ExecutionEngineService` on this	153	// `ExecutionEngineService` (handlers' service requirements demand one) — as a
154	// branch. Read-only handlers never read the engine, so the platform branch	154	// stub whose reachable reads answer "nothing here" and whose execute/resume
155	// serves them unchanged.	155	// members sit behind the middleware's safe-request gate (see
		156	// `readOnlyExecutionEngine` in ./execution-stack-middleware.ts).
156	// ---------------------------------------------------------------------------	157	// ---------------------------------------------------------------------------
157		158
158	export const makePlatformExecutionStack = <	159	export const makePlatformExecutionStack = <

packages/core/api/src/server/identity.ts+14−7

  * resolver already yielded it) AND `roles` (cloud supplies `[]`).
  */
 export interface Principal {
+  /** Discriminant of {@link ResolvedPrincipal}: an acting member, as opposed
+   *  to the org-level `"platform"` credential. Required so every construction
+   *  site declares which arm it is, and the union matches on a literal tag
+   *  instead of probing for a property's presence. */
+  readonly kind: "member";
   readonly accountId: string;
   readonly organizationId: string;
   readonly organizationName: string;
 export type ResolvedPrincipal = Principal | PlatformPrincipal;
 export const isPlatformPrincipal = (value: ResolvedPrincipal): value is PlatformPrincipal =>
-  "kind" in value && value.kind === "platform";
+  value.kind === "platform";
 /**
  * The single `AuthContext` every executor-API handler reads. The roles-bearing
  * tag from self-host is the model; cloud now provides `roles: []` on it, which
  * is forward-compatible (cloud handlers never read roles today).
  *
- * `accountId` is `null` for an org-level platform credential — there is no
+ * `accountId` and `email` are `null` for an org-level platform credential —
- * acting member behind it. Nullable rather than a sentinel so any handler that
+ * there is no acting member behind it. Nullable rather than sentinel-valued so
- * needs a member has to say so (and refuse), instead of silently acting as a
+ * any handler that needs a member has to say so (and refuse), instead of
- * user that does not exist.
+ * silently acting as a user that does not exist. (`email: ""` on the member
+ * api-key path is the pre-existing "member with no resolved email" value and
+ * unrelated to this.)
  */
 export class AuthContext extends Context.Service<
   AuthContext,
   {
     readonly accountId: string | null;
     readonly organizationId: string;
-    readonly email: string;
+    readonly email: string | null;
     readonly name: string | null;
     readonly avatarUrl: string | null;
     readonly roles: readonly string[];
 export const authContextFromPlatform = (principal: PlatformPrincipal): AuthContext["Service"] => ({
   accountId: null,
   organizationId: principal.organizationId,
-  email: "",
+  email: null,
   name: null,
   avatarUrl: null,
   roles: [],

packages/core/sdk/src/executor.ts+7−0

@@ -3585,6 +3585,13 @@ export const createExecutor = <const TPlugins extends readonly AnyPlugin[] = rea · 3584 unmodified lines
3585	// Best-effort: a failed rebuild leaves the stale-but-working catalog in	3585	// Best-effort: a failed rebuild leaves the stale-but-working catalog in
3586	// place and retries on the next read.	3586	// place and retries on the next read.
3587	const syncStaleConnectionTools = Effect.gen(function* () {	3587	const syncStaleConnectionTools = Effect.gen(function* () {
		3588	// The platform view can never persist a rebuilt catalog (writes are
		3589	// denied at the storage boundary), so attempting the sync would only
		3590	// fire upstream `resolveTools` calls whose results are thrown away —
		3591	// network side effects on a read-only credential. Skip it entirely:
		3592	// read-only-ness of the platform read path is a stated invariant here,
		3593	// not an accident of the best-effort catch below.
		3594	if (config.platformView === true) return;
3588	const integrations = yield* core.findMany("integration", {});	3595	const integrations = yield* core.findMany("integration", {});
3589	if (integrations.length === 0) return;	3596	if (integrations.length === 0) return;
3590	const integrationBySlug = new Map(integrations.map((row) => [row.slug, row] as const));	3597	const integrationBySlug = new Map(integrations.map((row) => [row.slug, row] as const));