Require MFA for cloud workspace admins

[RhysSullivan]

Require WorkOS TOTP verification for customer admins using the cloud console and its administration APIs. Verification lasts 15 minutes and is bound to the user and session. Members keep their normal access, and existing machine credentials remain supported. OAuth connections can pause for admin verification, then resume the original callback.

Also pin WorkOS JWT verification to RS256 and redact query strings from Cloudflare invocation logs. Tests use the published @executor-js/emulate@0.14.3-mfa.0 package from UsefulSoftwareCo/emulate#27.

Validation: format, lint, typecheck (45 tasks), and the full unit suite (39 tasks) pass. Focused browser/API checks cover MFA enrollment, cancellation, wrong codes, member access, session binding, rate limits, logout, organization changes and OAuth recovery. Three affected browser scenarios pass after fixing the verification-reload race. All 36 GitHub CI jobs pass on cac34277b.

[github-actions]

Cloudflare preview

Console	https://executor-preview-pr-2039.executor-e2e.workers.dev
MCP	https://executor-preview-pr-2039.executor-e2e.workers.dev/mcp
Deployed commit	cac3427

Sign-in is Cloudflare Access (one-time PIN to an allowed email). The preview has its own database and encryption key; it is destroyed when this PR closes.

[pkg-pr-new]

Open in StackBlitz

@executor-js/cli

npm i https://pkg.pr.new/@executor-js/cli@2039

@executor-js/config

npm i https://pkg.pr.new/@executor-js/config@2039

@executor-js/execution

npm i https://pkg.pr.new/@executor-js/execution@2039

@executor-js/sdk

npm i https://pkg.pr.new/@executor-js/sdk@2039

@executor-js/codemode-core

npm i https://pkg.pr.new/@executor-js/codemode-core@2039

@executor-js/runtime-quickjs

npm i https://pkg.pr.new/@executor-js/runtime-quickjs@2039

@executor-js/plugin-file-secrets

npm i https://pkg.pr.new/@executor-js/plugin-file-secrets@2039

@executor-js/plugin-graphql

npm i https://pkg.pr.new/@executor-js/plugin-graphql@2039

@executor-js/plugin-keychain

npm i https://pkg.pr.new/@executor-js/plugin-keychain@2039

@executor-js/plugin-mcp

npm i https://pkg.pr.new/@executor-js/plugin-mcp@2039

@executor-js/plugin-onepassword

npm i https://pkg.pr.new/@executor-js/plugin-onepassword@2039

@executor-js/plugin-openapi

npm i https://pkg.pr.new/@executor-js/plugin-openapi@2039

executor

npm i https://pkg.pr.new/executor@2039

commit: cac3427

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	executor-cloud	cac3427	Sep 17 2026, 06:48 PM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	executor-marketing	cac3427	Commit Preview URL Branch Preview URL	Sep 17 2026, 06:47 PM