Repository navigation
Conversation
The sidebar's Connect becomes Connections. The list shows the full-access URL and each scoped connection as a card with a Connect button. Clicking a scoped card opens one page that replaces the old detail view and editor: the name is edited in place, apps are turned on and scoped right on their rows, and Save appears only after a change. Copy MCP URL, Rename and Revoke sit in a menu. The shared app row no longer repeats an app's only account next to its subtitle, and can show a host link to connect an account when an app has none. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Logos rendered at 17px inside a bordered 34px box. They now fill a rounded white tile with a hairline edge, like the integrations catalog, fetched at a size that stays sharp in the largest tile. The package fallback keeps its bordered box. Pages that shrank the logo image inside the tile no longer do. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Self-host checks for due scheduled runs and for queued provisioning jobs every second, and traced every check: a schedule.dispatch span with its storage and SQL spans, plus a root sql.execute span. An instance with no traffic exported about 800 spans a minute into the bundled Motel store, which reaches its 1 GiB bound within hours and then evicts on every export, writing to disk constantly. A check that finds nothing now records nothing. Each scheduled operation a check finds runs in its own schedule.dispatch trace, so the background work under it keeps its dispatcher root, and each provisioning job is traced as before. Local runs the same scheduler and stops tracing its idle checks too. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Self-host and local look for due event deliveries every two seconds, and traced every pass: an events.dispatch span with its delivery, subscription and retention statements, about 15 spans each. On an instance with no traffic that is about 450 spans a minute in the bundled Motel store, the largest idle source since the event worker arrived. A pass that finds nothing to deliver now records nothing. Each delivery attempt and each subscription a pass expires is still traced, in its own trace. Cloud's coordinator calls the same delivery code with tracing on and is unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The schedule coordinator's database window stayed open for two minutes after each pass, while the retired coordinator's heartbeat and the recovery alarm woke it at least once a minute. The open sockets and the pending idle timer kept the object from ever becoming eligible for hibernation, so it billed duration for every second of the day. An object database now takes the time its window lingers after the last call. The schedules owner passes zero, so its window closes as soon as a pass ends. MCP sessions keep the two-minute window.
The Streamable HTTP client opens a standalone GET event stream after initialization. Some servers answer it with 401 even though every POST succeeds, and transportFetch failed the whole session on that response, so discovery reported the app's credentials as rejected. Hand the refusal back to the SDK instead, which treats it as no stream, as it does without Executor. POSTs and the legacy SSE GET are unchanged. Fixes UsefulSoftwareCo#2306
Password-created owners had no UI path to link an SSO identity. The linking endpoint already existed. This adds a Connect SSO button that starts the same authenticated flow.
A NUL in an app name returned a 500 storage error, and names made only of invisible characters created an app that listed as blank. AppName now refuses control characters and line separators and requires a visible character, and quick-add uses the same schema. Stored names are read with NonEmptyString, so existing apps are unaffected. Co-authored-by: Cursor <cursoragent@cursor.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
cloudObservability already removes query strings from request URLs in native logs and traces. The Edge, InvocationTelemetry and AppOutbound Workers set no observability, so their invocation logs kept full URLs, including unsubscribe links, sign-in codes and app outbound searches. They now share the same redacted log settings. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… watcher An app page's own files, such as its stylesheet, went through the whole page route: caller account resolution, account health reads and an app_viewed usage event, before the route noticed the path named a file. Files are now answered right after the session check and version read. The version watcher, a constant 756-byte script that only went through the stack for the session check, is inlined into the already authorized document as a module script, which keeps its deferred timing and removes one request per page load. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Brings in 137 upstream commits since 54bfc1a. 34 files conflicted; each was resolved by keeping both sides' behavior: - Fork sharedRuntime + upstream hostApi on invocations (sdk runtime, workflow-runtime, account-health, app-runner, app-runtime, app-storage, skills, tools, webhooks, workflows): both fields kept; app Worker identity drops accounts for shared runtimes and appends the host API revision. - tools.ts resume: fork's asRequester/approver wrapper kept; upstream's confirmed-read (readOf), hostApi, observeFailure and catch-with-read applied. - declarations.ts: fork checksOf kept, using upstream's batched accountsUsable. - schedules.ts: fork CurrentCaller plus upstream CallFailureSources/sources. - hosted mcp-http.ts: fork connection-bound authenticate + CurrentCaller with upstream caller span attributes; bearer-access/events imports unioned. - resource-policy.ts: fork visibleAppAccesses (empty-list membership check) kept over upstream's equivalent batched visibleApps. - app-management http.ts: fork narrowed org registry kept when the host supplies one; otherwise upstream wire-revision mapping. cli.ts: fork `apps call` adapted to upstream's Host/withHost local-server resolution. - UI: upstream connection cards + per-connection page, with fork connection key create/list/revoke moved onto the per-connection page; catalog keeps fork published-apps list inside upstream's CatalogPageFrame; add-app and approvals/navigation keep fork routes with upstream components/labels. - package-runtime.ts: fork split product/apps processes, plus upstream no_brotli_content_encoding flags. - e2e: test-plan union; docker-release keeps fork's skip of remote registry checks; empty-states combines both; connection-keys opens the card link. - packages/apps version and bun.lock take upstream's (as earlier syncs did); skill digests regenerated; unused ToolName import dropped.
The fork carries its own apps releases as <upstream base>.shuv.N (tags apps-v0.0.1-beta.100.shuv.1..3). The upstream/v2 merge moved the base to 0.0.1-beta.119, and no beta.119 fork release exists yet, so N is 1. apps/cli stays at upstream's 2.0.0-beta.34: the fork never suffixes it and ReleaseVersion accepts only 2.x.y(-beta.N). Version only; nothing is published or tagged.
Owner
Author
E2E results for head
|
shuv1337
marked this pull request as ready for review
November 3, 2026 09:31
This was referenced Nov 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Syncs the fork with upstream
UsefulSoftwareCo/executorv2and versions the fork'sappspackage on the new base. Draft until local and CI e2e pass. Not for merge/deploy without the Executor Owner's sign-off.Commits and SHAs
6e3357b5031e3d6522d93e769cfdbd7a64420a69(6e3357b)54bfc1a59bf558a3405d53a02d8e972c6cf506f26e3357b5031e3d6522d93e769cfdbd7a64420a69cd6048d26b618b6a349a945f96f65823153c6684a84cf12f6— Merge upstream/v2 (cd6048d) into the fork534821d1e— apps0.0.1-beta.119.shuv.1Upstream brought 137 commits since
54bfc1a59; the fork had 147 of its own.Conflicts: 34, not the expected 0
The 0-conflict expectation did not hold:
git merge --no-ff upstream/v2stopped with 34 conflicted files (~60 hunks). Each was resolved by keeping both sides' behavior:apps/hosted/self-host/scripts/package-runtime.ts— fork's split product/apps process configs kept; upstream'sno_brotli_content_encodingflag added to product, apps and workflows Workers.apps/hosted/server/src/implementation/bearer-access.ts— imports unioned (forkConnectionKeyRefused+ upstreamcallerSpanAttributes).apps/hosted/server/src/implementation/events.ts— forkpatConnectionPolicyimport kept with upstream's batchedaccountAccesses/resourceAuthorityForApp.apps/hosted/server/src/implementation/mcp-http.ts— forkAuthenticationUnavailable/CurrentCaller/mcpCaller+ connection-boundauthenticate(…, address.connection)kept, wrapped in upstream'sEffect.annotateSpans(caller).apps/hosted/server/src/implementation/resource-policy.ts— forkvisibleAppAccesses(also checks membership for an empty app list) kept over upstream's equivalent batchedvisibleApps; upstream'susableLinks/usableAppLinksrewrite merged cleanly beneath it.apps/hosted/web/src/contracts/navigation.ts— fork "Review request" title forapps/<id>/approvekept; upstream's "App catalog" title forapps/add(theadd/customroute is gone upstream).apps/hosted/web/src/implementation/pages/add-app.tsx— fork publication install flow kept; upstreamAddAppBack/MakeYourOwncomponents replace the inline back link and custom-service button.apps/hosted/web/src/implementation/pages/approvals.tsx— forkAppApprovalFrameimport kept alongside upstream'sapprovalsPageReads.apps/hosted/web/src/implementation/pages/connect.tsx— upstream's shareduseConnectionBindings; fork'smintKeyandkeysbindings added to it.bun.lock— regenerated bybun install(fork workspace deps kept);appsversion then set in the version commit.e2e/test-plan.ts— both sides' new scenarios kept (fork syncro/native/team-registry/registry-migration + upstreamstorageMigrationDiagnostics).e2e/tests/docker-release.spec.ts— fork's skip of the remote-registry failure checks kept (the fork's self-host serves an org-only registry).e2e/tests/empty-states.spec.ts— upstream'sCan’t reach Executor|Unable to complete…regex plus the fork's.first().packages/app-management/src/cli.ts— upstream'sHost/withHostlocal-server resolution; forkapps callcommand (callTool,AppLookupFailed) adapted to take aHost; upstreamnotSignedIntext.packages/app-management/src/http.ts— a host that supplies the fork's narrowed org registry keeps it (copy/catalog/publicationSource and the fail-closed anonymous routes); otherwise upstream's wire-revision mapping (registryForRevision,packageNameFromRevision) applies.packages/app-templates/src/implementation/executor-skill-digests.gen.ts— regenerated withbun run executor:intro.packages/apps/package.json— upstream base0.0.1-beta.119taken in the merge, then0.0.1-beta.119.shuv.1in the version commit.packages/mcp/src/contracts/execute.ts— forkAdvertisedInteractionIdimport kept; itsToolNameimport dropped because upstream removedApprovalTooLarge, its only user.packages/mcp/src/implementation/server.ts— upstreamwithOperationSpan("mcp.describe")plus the fork'spersonLink.packages/sdk/src/contracts/runtime.ts(9 hunks) — both forksharedRuntimeand upstreamhostApifields kept on every invocation type.packages/sdk/src/contracts/workflow-runtime.ts— bothsharedRuntimeandhostApi.packages/sdk/src/implementation/account-health.ts(2) — both fields passed.packages/sdk/src/implementation/app-runner.ts— Worker identity drops accounts for a shared runtime (fork) and appends the host-API revision (upstream).packages/sdk/src/implementation/app-runtime.ts— migration invocations sethostApi: undefinedandsharedRuntime: false.packages/sdk/src/implementation/app-storage.ts— forkactiveDatasuperseded-version guard +sharesRuntimekept with upstreamhostApiplumbing.packages/sdk/src/implementation/declarations.ts— forkchecksOfkept, now using upstream's batchedaccountsUsable.packages/sdk/src/implementation/schedules.ts(2) — forkCurrentCaller(schedule system caller) plus upstreamCallFailureSources/sources.source.packages/sdk/src/implementation/skills.ts— both fields.packages/sdk/src/implementation/tools.ts(2) — both fields; on resume, the fork'sasRequester/approver wrapper kept and upstream'sreadOf,hostApi,executeRenewing(read),observeFailureand confirmed-read failure mapping re-applied inside it.packages/sdk/src/implementation/webhooks.ts— imports unioned (sharesRuntime+declarationLimits).packages/sdk/src/implementation/workflows.ts(3) —callerContext,sharedRuntimeandhostApiall kept.packages/ui/src/implementation/dashboard/catalog.tsx(2) — upstreamCatalogPageFrame/MissingApp; fork "Published apps" section andPublishedAppskept inside it.packages/ui/src/implementation/dashboard/scoped-connections.tsx(5) — upstream's connection cards + per-connection page as the base; fork's connection-key create dialog and key list/revoke moved onto the per-connection page.scripts/e2e-npm-packages.ts— union of bothappsbeta lists (adds 35 and 95).Outside the conflict hunks:
e2e/tests/connection-keys.spec.tsnow opens a connection through its card link (upstream turned the button into a link).Upstream ancestors (all present)
git merge-base --is-ancestor <sha> HEAD: c089e1d yes · 0e8a57d yes · ffb55ee yes · fe1afa8 yes · a6f9b43 yes · fb49ec6 yesUpstream UsefulSoftwareCo#2402 / UsefulSoftwareCo#2403 are not ported
UsefulSoftwareCo#2402 (
56aec8b) and UsefulSoftwareCo#2403 are on upstreammain, whose layout (packages/core/sdk,apps/cloud,apps/local, drizzle migrations) does not exist in v2: all 8 cherry-pick conflicts were modify/delete. UsefulSoftwareCo#2403's tests are unit tests, which this repo bans outsidee2e/.v2 already avoids the bug UsefulSoftwareCo#2402 fixes on main: it reuses a dynamically registered (DCR) client only when the full registration request matches, including the sorted scope set (
packages/sdk/src/implementation/oauth.ts:1103,packages/sdk/src/implementation/stored-oauth-client-credentials.ts:184). A server that adds scopes therefore gets a new registration rather than an old client it would refuse withinvalid_scope.Not in v2: persisting the scopes the server actually registered (RFC 7591 §3.2.1) and limiting later sign-ins to them. That is a follow-up needing a storage migration and an e2e scenario; the Executor Owner will file the issue.
Does UsefulSoftwareCo#2403's bug apply to v2? No: v2 reuses a DCR client only when the full registration request, including the sorted scope set, matches (
oauth.ts:1103looks the client up byautomaticKey;stored-oauth-client-credentials.ts:184hashes[...new Set(scopes)].sort()into that key), so the stale-clientinvalid_scopereuse cannot happen. Scope persistence/limiting is the follow-up.FYI (access policy):
canUselets an app's creator and the organization owner always use group-audience apps (apps/hosted/server/src/implementation/resource-policy.ts:91-99; comment at 91-92, expression 93-99). This is the fork's rule (present at6e3357b), kept through the merge; upstreamcd6048dgrants group-audience use only viagranted.Versioning
packages/apps:0.0.1-beta.119.shuv.1— upstream's new base with the fork suffix. Existing fork tags areapps-v0.0.1-beta.100.shuv.1..3; nobeta.119fork release exists, so N = 1.apps/clistays at upstream's2.0.0-beta.34: the fork has never suffixed it, andReleaseVersion(packages/utils/src/release-version.ts) accepts only2.x.y(-beta.N). Nothing is published or tagged by this PR.Staging smoke checklist
?token=redaction in logs?token=redaction: c089e1d redacts only in Cloud Workers (git show --stat c089e1dtouches onlyapps/hosted/cloud/src/edge.ts,infrastructure/app-outbound.ts,infrastructure/telemetry.ts,invocation-telemetry.ts), so self-host logs need their own check before deploy.mcp-httpconnection-key sign-in check (connection-boundauthenticate(…, address.connection),apps/hosted/server/src/implementation/mcp-http.ts:241).batch-authentication.tsidentity reuse across one dashboard batch request.usableLinks/usableAppLinksSQL against Postgres (apps/hosted/server/src/implementation/resource-policy.ts:217,:242).Review risks
executor.user.idnow in spans (apps/hosted/server/src/contracts/auth.ts:176,apps/hosted/server/src/implementation/mcp-http.ts:236).mcp-http.ts:240.batch-authentication.tsreuses identity checks across one dashboard batch request.usableLinks/usableAppLinksSQL rewrite (resource-policy.ts:~217) under the fork'sresourceAuthorityForLinksOfApps: runtime check (SQL is not typechecked).Post-merge release step
apps-v0.0.1-beta.119.shuv.1on the mergedv2commit.appstgz attached.Not done by this PR; needs the Executor Owner's go-ahead.
Verification
bun run checkexits 0 on the head commit (format, oxlint, typecheck 9/9 projects with 0 errors, protocols, telemetry, boundary). Local and CI e2e results are reported in the PR comments.