Move product access rules out of the SDK

[RhysSullivan]

Summary

Move personal/organization access rules into @executor-js/product-access. Both SDK APIs now require access: ExecutorAccess; core enforces the supplied visibility, settings, storage, and tool-policy decisions while retaining tenant and subject isolation. All hosts, callers, examples, and test helpers use the new boundary, with no legacy fallback or stored-data migration.

Remove orgWrites and platformView. Recheck tool policy and retained connection/tool rows after approval, and enforce narrowed access and read-only storage on plugin blobs. Include package build/release wiring and migration guidance.

Verification

• bun run format:check and bun run lint
• bun run typecheck — 46 tasks passed
• TURBO_TEST_CONCURRENCY=1 bun run test --continue=always — 40 tasks passed; earlier intermittent failures passed on rerun without assertion or timeout changes
• Public package build/pack; product-access exports and declarations checked from installed tarballs with required peers; Promise SDK construct/close probe passed
• Cloud isolation, policy, and artifact-approval scenarios — 10 tests passed; selfhost workspace permissions and MCP approval role/ownership scenarios — 3 tests passed
• changeset status --since main validates this branch's release plan

The existing cloud MCP browser-approval org-scope scenario remains skipped because its OAuth test setup times out before the assertions. The full repository release plan separately has an existing mixed ignored-package error in computer-use-remembered-approvals; this branch does not change that changeset.

Checklist

• Added a changeset and migration guidance.
• Added regressions for access enforcement and approval rechecks.
• No secrets, credentials, or private data in the diff.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	executor-marketing	c676e56	Commit Preview URL Branch Preview URL	Sep 17 2026, 05:01 AM

[github-actions]

Cloudflare preview

Console	https://executor-preview-pr-2034.executor-e2e.workers.dev
MCP	https://executor-preview-pr-2034.executor-e2e.workers.dev/mcp
Deployed commit	c676e56

Sign-in is Cloudflare Access (one-time PIN to an allowed email). The preview has its own database and encryption key; it is destroyed when this PR closes.

[pkg-pr-new]

Open in StackBlitz

@executor-js/cli

npm i https://pkg.pr.new/UsefulSoftwareCo/executor/@executor-js/cli@2034

@executor-js/config

npm i https://pkg.pr.new/UsefulSoftwareCo/executor/@executor-js/config@2034

@executor-js/execution

npm i https://pkg.pr.new/UsefulSoftwareCo/executor/@executor-js/execution@2034

@executor-js/product-access

npm i https://pkg.pr.new/UsefulSoftwareCo/executor/@executor-js/product-access@2034

@executor-js/sdk

npm i https://pkg.pr.new/UsefulSoftwareCo/executor/@executor-js/sdk@2034

@executor-js/codemode-core

npm i https://pkg.pr.new/UsefulSoftwareCo/executor/@executor-js/codemode-core@2034

@executor-js/runtime-quickjs

npm i https://pkg.pr.new/UsefulSoftwareCo/executor/@executor-js/runtime-quickjs@2034

@executor-js/plugin-file-secrets

npm i https://pkg.pr.new/UsefulSoftwareCo/executor/@executor-js/plugin-file-secrets@2034

@executor-js/plugin-graphql

npm i https://pkg.pr.new/UsefulSoftwareCo/executor/@executor-js/plugin-graphql@2034

@executor-js/plugin-keychain

npm i https://pkg.pr.new/UsefulSoftwareCo/executor/@executor-js/plugin-keychain@2034

@executor-js/plugin-mcp

npm i https://pkg.pr.new/UsefulSoftwareCo/executor/@executor-js/plugin-mcp@2034

@executor-js/plugin-onepassword

npm i https://pkg.pr.new/UsefulSoftwareCo/executor/@executor-js/plugin-onepassword@2034

@executor-js/plugin-openapi

npm i https://pkg.pr.new/UsefulSoftwareCo/executor/@executor-js/plugin-openapi@2034

executor

npm i https://pkg.pr.new/UsefulSoftwareCo/executor@2034

commit: c676e56

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	executor-cloud	c676e56	Sep 17 2026, 05:04 AM