zrm625 · Oct 23, 2026 · Oct 6, 2026 · Oct 6, 2026 · Oct 8, 2026 · Oct 8, 2026
diff --git a/.changeset/account-scoped-tool-policies.md b/.changeset/account-scoped-tool-policies.md
diff --git a/.changeset/connection-oauth-default.md b/.changeset/connection-oauth-default.md
diff --git a/.changeset/cross-session-resume-org-write.md b/.changeset/cross-session-resume-org-write.md
diff --git a/.changeset/fair-admin-integrations.md b/.changeset/fair-admin-integrations.md
diff --git a/.changeset/oauth-discovered-scope-budget.md b/.changeset/oauth-discovered-scope-budget.md
diff --git a/.changeset/organization-settings-verification.md b/.changeset/organization-settings-verification.md
diff --git a/.changeset/quiet-connection-setup.md b/.changeset/quiet-connection-setup.md
diff --git a/.changeset/toolkit-list-scope.md b/.changeset/toolkit-list-scope.md
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -22,9 +22,12 @@ env:
   EXECUTOR_DISABLE_ANALYTICS: "1"
   EXECUTOR_DISABLE_INTEGRATIONS_FETCH: "1"
 
+# Outside contributions are ported into the private repo, which runs the
+# checks there, so fork PRs skip CI here. Jobs that need `changes` skip with it.
 jobs:
   changes:
     name: Changed paths
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 10
     outputs:
@@ -78,6 +81,7 @@ jobs:
 
   format:
     name: Format
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 10
     steps:
@@ -101,6 +105,7 @@ jobs:
 
   lint:
     name: Lint
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 10
     steps:
@@ -124,6 +129,7 @@ jobs:
 
   typecheck:
     name: Typecheck
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 15
     env:
@@ -165,6 +171,7 @@ jobs:
 
   test:
     name: Test
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: blacksmith-16vcpu-ubuntu-2404
     timeout-minutes: 15
     # Run eight independent packages at once and cap each Vitest process at two

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
@@ -106,6 +106,16 @@ jobs:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
 
+      # The unplaced front Worker on the `executor.sh/*` route (src/edge/front.ts).
+      # After executor-cloud, so each deploy changes the edge's settings in
+      # executor-cloud before the Worker in front of it.
+      - name: Deploy executor.sh front Worker
+        run: bun run wrangler deploy -c wrangler.edge.jsonc
+        working-directory: apps/cloud
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+
       # Deploy marker: one event per deploy into the same Axiom dataset the
       # worker traces land in, so a latency step-change lines up with its
       # deploy in one query. Skipped (not failed) when the secret is absent,

diff --git a/.oxfmtrc.json b/.oxfmtrc.json
@@ -14,6 +14,7 @@
     "executor-*.tgz",
     "**/routeTree.gen.ts",
     "**/smoke-harness-bundle.gen.ts",
-    "apps/cloud/src/services/executor-schema.ts"
+    "apps/cloud/src/services/executor-schema.ts",
+    "apps/cloud/src/edge/v2-edge-contract.json"
   ]
 }
diff --git a/apps/cli/CHANGELOG.md b/apps/cli/CHANGELOG.md
@@ -1,5 +1,23 @@
 # executor
 
+## 1.6.11
+
+### Patch Changes
+
+- [#2066](https://github.com/UsefulSoftwareCo/executor/pull/2066) [`c6d1083`](https://github.com/UsefulSoftwareCo/executor/commit/c6d10838f741ece700922fb2469782f79753b7f7) Thanks [@RhysSullivan](https://github.com/RhysSullivan)! - Prefer browser sign-in when a matching OAuth client is available, while preserving a user’s chosen method when clients finish loading.
+
+- [#2254](https://github.com/UsefulSoftwareCo/executor/pull/2254) [`6e768da`](https://github.com/UsefulSoftwareCo/executor/commit/6e768da9dad13c7c469d2c2071bf542157f1033c) Thanks [@RhysSullivan](https://github.com/RhysSullivan)! - Send a default User-Agent on remote MCP requests so servers that reject requests without one accept the connection. A configured User-Agent header still wins.
+
+- [#2258](https://github.com/UsefulSoftwareCo/executor/pull/2258) [`8e4a8a4`](https://github.com/UsefulSoftwareCo/executor/commit/8e4a8a40048e8252f4d7f182456da62ca1d5c296) Thanks [@RhysSullivan](https://github.com/RhysSullivan)! - Send the default User-Agent on the MCP endpoint probe and its OAuth metadata request too, so adding a server that rejects requests without one no longer fails. A configured User-Agent still wins.
+
+- [#2050](https://github.com/UsefulSoftwareCo/executor/pull/2050) [`24adb12`](https://github.com/UsefulSoftwareCo/executor/commit/24adb127f304e2b145b462c3805a9e11b2a524e0) Thanks [@RhysSullivan](https://github.com/RhysSullivan)! - Accept Slack bot and user OAuth token envelopes during sign-in and token refresh.
+
+- Updated dependencies [[`2e5aa16`](https://github.com/UsefulSoftwareCo/executor/commit/2e5aa16bedb4ba74448b3f9338754764b40519a0), [`4a08d8d`](https://github.com/UsefulSoftwareCo/executor/commit/4a08d8db6f74612e07f17494e222ff038d8af944), [`c03c9ad`](https://github.com/UsefulSoftwareCo/executor/commit/c03c9adc1fcd4a3f2b0a839878f7310f5fc835b4)]:
+  - @executor-js/sdk@1.6.11
+  - @executor-js/local@1.6.11
+  - @executor-js/api@1.4.74
+  - @executor-js/runtime-quickjs@1.6.11
+
 ## 1.6.10
 
 ### Patch Changes

diff --git a/apps/cli/package.json b/apps/cli/package.json
@@ -1,6 +1,6 @@
 {
   "name": "executor",
-  "version": "1.6.10",
+  "version": "1.6.11",
   "private": true,
   "bin": {
     "executor": "./bin/executor.ts"

diff --git a/apps/cloud/CHANGELOG.md b/apps/cloud/CHANGELOG.md
@@ -1,5 +1,34 @@
 # @executor-js/cloud
 
+## 1.4.72
+
+### Patch Changes
+
+- [#2099](https://github.com/UsefulSoftwareCo/executor/pull/2099) [`9e143d9`](https://github.com/UsefulSoftwareCo/executor/commit/9e143d99c28f4c26d9e2cb1b136658048fecd3cb) Thanks [@RhysSullivan](https://github.com/RhysSullivan)! - An admin who resumes a paused execution from a different MCP session (for example after the client reconnects) keeps workspace-write access. The forwarded resume now carries the requester's access to the session that owns the execution, so a pending `addServer`, `addSpec`, or similar write no longer fails with `org_write_denied`.
+
+- [#2119](https://github.com/UsefulSoftwareCo/executor/pull/2119) [`4a52307`](https://github.com/UsefulSoftwareCo/executor/commit/4a52307c0bdc7606107c22e15574c24d0254777c) Thanks [@RhysSullivan](https://github.com/RhysSullivan)! - Require authenticator verification for organization settings while preserving shared workspace reads and API-key access.
+
+- [#2266](https://github.com/UsefulSoftwareCo/executor/pull/2266) [`90e415c`](https://github.com/UsefulSoftwareCo/executor/commit/90e415c98c5414e019695e8501439755a8bc838a) Thanks [@RhysSullivan](https://github.com/RhysSullivan)! - Link eligible single-member free organizations to Executor v2's workspace import from the sidebar.
+
+- [#2269](https://github.com/UsefulSoftwareCo/executor/pull/2269) [`49bd295`](https://github.com/UsefulSoftwareCo/executor/commit/49bd2959b4dd203b2a413304f7b3d4d5238d50a4) Thanks [@RhysSullivan](https://github.com/RhysSullivan)! - Tell users when their organization has moved to Executor v2, with a link to it in v2 and a way to say why they are staying on v1.
+
+- Updated dependencies [[`29413d8`](https://github.com/UsefulSoftwareCo/executor/commit/29413d8dafaeabfd9b9f10e5fddd1f5b735ffa30), [`31b24b8`](https://github.com/UsefulSoftwareCo/executor/commit/31b24b8564899b137106baf28f66fb3f15c33633), [`2e5aa16`](https://github.com/UsefulSoftwareCo/executor/commit/2e5aa16bedb4ba74448b3f9338754764b40519a0), [`4a08d8d`](https://github.com/UsefulSoftwareCo/executor/commit/4a08d8db6f74612e07f17494e222ff038d8af944), [`c03c9ad`](https://github.com/UsefulSoftwareCo/executor/commit/c03c9adc1fcd4a3f2b0a839878f7310f5fc835b4)]:
+  - @executor-js/react@1.4.74
+  - @executor-js/sdk@1.6.11
+  - @executor-js/plugin-toolkits@1.5.46
+  - @executor-js/mcp-apps-shell@1.4.22
+  - @executor-js/plugin-graphql@1.6.11
+  - @executor-js/plugin-mcp@1.6.11
+  - @executor-js/plugin-openapi@1.6.11
+  - @executor-js/plugin-workos-vault@0.0.2
+  - @executor-js/api@1.4.74
+  - @executor-js/execution@1.6.11
+  - @executor-js/vite-plugin@0.0.71
+  - @executor-js/cloudflare@0.0.53
+  - @executor-js/host-mcp@1.4.4
+  - @executor-js/runtime-dynamic-worker@1.4.4
+  - @executor-js/runtime-quickjs@1.6.11
+
 ## 1.4.71
 
 ### Patch Changes

diff --git a/apps/cloud/drizzle/0021_org_moved_to_v2.sql b/apps/cloud/drizzle/0021_org_moved_to_v2.sql
@@ -0,0 +1,9 @@
+CREATE TABLE "org_moved_to_v2" (
+	"org_id" text PRIMARY KEY NOT NULL,
+	"state" text NOT NULL,
+	"v2_org_id" text,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "org_moved_to_v2_state_check" CHECK ("org_moved_to_v2"."state" in ('moving', 'moved'))
+);
+--> statement-breakpoint
+ALTER TABLE "org_moved_to_v2" ADD CONSTRAINT "org_moved_to_v2_org_id_organizations_id_fk" FOREIGN KEY ("org_id") REFERENCES "public"."organizations"("id") ON DELETE cascade ON UPDATE no action;