Sync upstream while preserving external OIDC login

.changeset/config.json

@@ -18,7 +18,8 @@
       "@executor-js/plugin-openapi",
       "@executor-js/plugin-example",
       "@executor-js/plugin-desktop-settings",
-      "@executor-js/desktop"
+      "@executor-js/desktop",
+      "@executor-js/local"
     ]
   ],
   "linked": [],
@@ -29,7 +30,6 @@
     "onlyUpdatePeerDependentsWhenOutOfRange": true
   },
   "ignore": [
-    "@executor-js/local",
     "@executor-js/host-mcp",
     "@executor-js/ir",
     "@executor-js/runtime-deno-subprocess",

.changeset/first-party-oauth-listing-policy.md

@@ -0,0 +1,5 @@
+---
+"@executor-js/sdk": patch
+---
+
+Allow hosts to control first-party OAuth app listings for each acting user without disrupting existing connections.

.changeset/oauth-client-basic.md

@@ -0,0 +1,5 @@
+---
+"executor": patch
+---
+
+Allow manually registered OAuth apps to use HTTP Basic client authentication for token exchange and refresh.

.changeset/openapi-update-spec-tool.md

@@ -0,0 +1,5 @@
+---
+"@executor-js/plugin-openapi": patch
+---
+
+Expose OpenAPI spec updates as an approval-gated Executor tool so agents can refresh URL-backed integrations without removing their connections.

.changeset/raw-oauth-basic.md

@@ -0,0 +1,5 @@
+---
+"@executor-js/sdk": patch
+---
+
+Add a raw HTTP Basic compatibility mode for OAuth providers that reject form-encoded client credentials.

.changeset/selfhost-sso-sign-in.md

@@ -0,0 +1,9 @@
+---
+"executor": patch
+---
+
+**Self-host: bring-your-own SSO (Google, Okta, any OIDC IdP) with a verified-domain allowlist**
+
+Operators can enable a single OIDC sign-in provider on a self-hosted instance by setting `EXECUTOR_SSO_PROVIDER_ID`, `EXECUTOR_SSO_CLIENT_ID`, `EXECUTOR_SSO_CLIENT_SECRET`, and `EXECUTOR_SSO_ALLOWED_DOMAINS` (comma-separated email domains), plus `EXECUTOR_SSO_DISCOVERY_URL` for providers without a preset (`google` is preset; `EXECUTOR_SSO_PROVIDER_NAME` overrides the button label). The login page renders a "Continue with <provider>" button when configured (discovered through the new unauthenticated `GET /api/auth-config`, which returns provider id + display name only), and the MCP OAuth connect flow's login step gains the same option since it lands on the same page.
+
+The domain allowlist replaces the invite code for SSO sign-ups: a sign-in whose IdP-verified email (`email_verified`) has an allowlisted domain auto-joins the instance organization as a member; unverified emails and any other domain are refused. Enabling the provider without an allowlist is refused at boot, as is a half-configured client id/secret pair, so SSO can never silently become open registration. Email/password sign-in and invite-based signup are unchanged. The end-to-end flow (discovery → redirect → consent → callback → membership) is exercised in tests against an emulated OIDC IdP from `@executor-js/emulate`.

.changeset/workspace-writes-admin-only.md

@@ -0,0 +1,52 @@
+---
+"@executor-js/sdk": patch
+"@executor-js/api": patch
+"@executor-js/plugin-graphql": patch
+"@executor-js/plugin-mcp": patch
+"@executor-js/plugin-openapi": patch
+---
+
+**Workspace writes now require an administrator**
+
+Executor bindings accept `orgWrites: "allowed" | "denied" | "request"`.
+Request-aware hosts use `"request"` and bind `CurrentOrgWriteAccess` from the
+authenticated principal for each request. An approval, decline, cancellation,
+or form response also rebinds the paused execution to the resumer's current
+access. Browser approvals derive access from the authenticated browser user's
+live organization membership when that user posts the decision, rather than
+from the earlier MCP request waiting for it or the user's global role. Self-host
+uses the same Better Auth membership lookup for ordinary requests and browser
+decisions. A demotion before either kind of resume therefore takes effect
+before the paused execution can reach a workspace-write sink.
+
+`Principal` now declares its role model explicitly: organization-backed hosts
+carry `orgRoleModel: "organization"` and an optional normalized admin/member
+role, while hosts without roles carry `orgRoleModel: "none"` and cannot also
+carry an organization role. Missing role data under the organization model
+fails closed, including legacy persisted MCP session metadata. Cloud derives
+roles from WorkOS memberships and self-host derives them from Better Auth.
+
+Members may still read and execute shared workspace resources and perform
+operational maintenance such as token refresh and tool-catalog synchronization.
+User-requested workspace mutations now return `OrgWriteDeniedError` (HTTP 403):
+workspace connections and reconnects, organization OAuth clients and connect
+flows, tool policies, and integration add/update/replace/remove/health-check
+operations. Personal connection management remains available.
+
+Pasted connection credentials, OAuth client secrets, OAuth connection tokens,
+and dependent tool discovery run only after the outermost transaction commits
+their row, including when a plugin wraps creation in `ctx.transaction`. Each
+committed row records unique provider item references owned by that write
+attempt. Reads resolve only those recorded references, so the post-commit
+window fails closed with a retryable incomplete-write error and can never
+resolve a predecessor's credential. A process crash leaves detectable missing
+references; a later executor incarnation can atomically replace and retry a
+stranded pasted connection, while OAuth client and connection retries replace
+their rows through their existing update paths.
+
+If credential persistence fails while the process remains alive, row and
+provider compensation restore the prior state where possible and surface
+incomplete cleanup explicitly. Best-effort cleanup can leave inert orphaned
+attempt items, but an attempt never shares an item reference with a successor,
+eliminating the former successor-clobber interval without requiring provider
+compare-and-set support.

.claude/skills/prod-telemetry/SKILL.md

@@ -29,6 +29,20 @@ join the same traces via traceparent).
 
 **Span names worth querying** (and their custom attrs):
 
+- `mcp.execute` / `mcp.execute.resume` — `mcp.execute.mode`
+  (`pausable`/`inline`), `mcp.execute.code_length`, and
+  `mcp.execute.outcome` (`ok`/`fail`/`paused`) with, on failures,
+  `mcp.execute.error_kind` (`type_error` | `reference_error` |
+  `syntax_error` | `range_error` | `tool_error` | `timeout` |
+  `resource_limit` | `serialization_error` | `thrown` | `unknown`).
+  Sandbox script failures ride the MCP success channel, so `status.code`
+  stays OK — filter on these attributes, not span status. Spans from
+  before the attributes shipped carry neither; absence is not success.
+  Also `mcp.execute.result_chars` (compact-JSON size of the returned
+  value, pre-truncation; -1 = unmeasurable), `mcp.execute.log_chars`,
+  `mcp.execute.emitted` — the dump-vs-narrow signal (the model preview
+  truncates at 30k chars, so `result_chars > 30000` means the model tried
+  to pull a truncated blob into context).
 - `executor.tool.execute` — `mcp.tool.name` (full address), and since
   PR #992: `executor.tool.outcome` (`ok`/`fail`),
   `executor.tool.error_code`, `executor.tool.error_status`,
@@ -39,7 +53,10 @@ join the same traces via traceparent).
   `base_url`, and since PR #992 `http.status_code`.
 - `mcp.request` (outer) — `mcp.auth.organization_id`,
   `mcp.auth.account_id`, `mcp.tool.name`, CF edge fields (`cf.country`…),
-  MCP client fingerprint (`mcp.client.name`…).
+  MCP client fingerprint (`mcp.client.name`…), and on managed-cloud
+  `execute`/`execute-action` calls `mcp.execute.code` (the script itself,
+  capped at 10k chars — cloud-only content capture; local/self-host
+  telemetry never records content).
 
 **Recipe — error signatures by class (the daily-digest query):**
 

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,100 @@
+name: Bug report
+description: Something in Executor does not work as expected.
+title: "[bug] "
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Please update to the latest version first — the bug may already be fixed.
+        If the desktop app crashes, will not start, or shows a blank window, use the
+        **[Desktop app crash](?template=desktop-crash.yml)** template instead.
+  - type: input
+    id: version
+    attributes:
+      label: Executor version
+      description: Run `executor --version`, or open the About menu in the desktop app.
+      placeholder: "1.5.4"
+    validations:
+      required: true
+  - type: dropdown
+    id: surface
+    attributes:
+      label: How do you run Executor?
+      options:
+        - Executor Cloud
+        - CLI
+        - Desktop app
+        - Self-host (Docker)
+        - Self-host (Cloudflare)
+    validations:
+      required: true
+  - type: dropdown
+    id: os
+    attributes:
+      label: Operating system
+      description: For Executor Cloud, select the system you browse from.
+      options:
+        - macOS (Apple Silicon)
+        - macOS (Intel)
+        - Windows
+        - Linux
+    validations:
+      required: true
+  - type: input
+    id: integration
+    attributes:
+      label: Integration involved
+      description: The integration or source type, if the bug is specific to one.
+      placeholder: "MCP server, OpenAPI spec, GraphQL API, …"
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened
+      description: Describe the behaviour you saw.
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: What you expected
+      description: Describe the behaviour you wanted instead.
+    validations:
+      required: true
+  - type: textarea
+    id: repro
+    attributes:
+      label: Steps to reproduce
+      description: The smallest sequence that shows the bug. Include the commands you ran.
+      value: |
+        1.
+        2.
+        3.
+    validations:
+      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: Diagnostics / logs
+      description: |
+        In the desktop app, open the **Executor** menu → **Export Diagnostics…** and attach
+        the zip — it has everything we need and no secrets.
+
+        Otherwise attach the relevant log:
+        - CLI / self-host: `~/.executor/logs/` (run `executor service status` for the exact path)
+        - macOS desktop: `~/Library/Logs/Executor/main.log`
+        - Windows desktop: `%APPDATA%\Executor\logs\main.log`
+        - Linux desktop: `~/.config/Executor/logs/main.log`
+
+        (Please don't attach anything else from `~/.executor` — that's where your data and
+        secrets live. Remove API keys and tokens from anything you paste.)
+      placeholder: Drag the diagnostics zip or log file here.
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Before you submit
+      options:
+        - label: I searched the open issues for a duplicate.
+          required: true
+        - label: I removed all keys, tokens, and credentials from this report.
+          required: true

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,51 @@
+name: Feature request
+description: Suggest a capability or an improvement for Executor.
+title: "[feature] "
+labels: ["enhancement"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Tell us the task you want to do and why Executor cannot do it today.
+        A concrete example helps more than a general proposal.
+  - type: textarea
+    id: problem
+    attributes:
+      label: The problem
+      description: What are you trying to do, and where does Executor stop you?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed shape
+      description: |
+        The change you want, as concretely as you can describe it. Name the command,
+        the setting, or the screen where it would live.
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives
+      description: Workarounds you tried, and why they are not sufficient.
+  - type: dropdown
+    id: surface
+    attributes:
+      label: Where it belongs
+      description: Select every form of Executor this applies to.
+      options:
+        - Executor Cloud
+        - CLI
+        - Desktop app
+        - Self-host (Docker)
+        - Self-host (Cloudflare)
+        - Not sure
+      multiple: true
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Before you submit
+      options:
+        - label: I searched the open issues for a duplicate.
+          required: true

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,30 @@
+<!-- Keep this short and plain. Delete the sections that do not apply. -->
+
+## Summary
+
+<!-- What does this change do, and why? One or two sentences. -->
+
+## Linked issue
+
+Fixes #
+
+## Verification
+
+<!--
+Say what you ran and what it showed. File paths alone are not evidence.
+User-visible work needs a specific e2e run or a browsable dev instance, plus
+the recording or trace that shows what to inspect. Add an e2e scenario when
+none covers the changed behaviour.
+-->
+
+- [ ] `bun run format:check`
+- [ ] `bun run lint`
+- [ ] `bun run typecheck`
+- [ ] `bun run test`
+- [ ] e2e — name the scenario, and link the recording or trace:
+
+## Checklist
+
+- [ ] Added a changeset (`bun run changeset`), or this change needs none.
+- [ ] Added or updated tests for the new behaviour.
+- [ ] No secrets, credentials, or private data in the diff.