diff --git a/.changeset/artifact-delete-navigation.md b/.changeset/artifact-delete-navigation.md
deleted file mode 100644
index aa9ba333ad..0000000000
--- a/.changeset/artifact-delete-navigation.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"executor": patch
----
-
-Prevent deleted artifacts from briefly reappearing after returning to the artifact gallery.
diff --git a/.changeset/artifact-external-links.md b/.changeset/artifact-external-links.md
deleted file mode 100644
index 68cf2257a5..0000000000
--- a/.changeset/artifact-external-links.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"executor": patch
----
-
-**Fix: links in generated artifacts (``) did nothing when clicked.** The sandbox iframe deliberately has no `allow-popups`, so the browser blocked the new browsing context and the click went nowhere. A trusted user click is now relayed across the frame boundary to the host's `openLink` capability — guarded by a per-render nonce so generated code cannot forge or observe it — and the host opens only `http`/`https` URLs.
diff --git a/.changeset/artifact-hyphenated-tool-paths.md b/.changeset/artifact-hyphenated-tool-paths.md
deleted file mode 100644
index c659cf6787..0000000000
--- a/.changeset/artifact-hyphenated-tool-paths.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"executor": patch
----
-
-Render artifacts that call integrations or tools with hyphenated slugs.
diff --git a/.changeset/artifact-source-text.md b/.changeset/artifact-source-text.md
deleted file mode 100644
index b87f7d8bba..0000000000
--- a/.changeset/artifact-source-text.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"executor": patch
----
-
-**Fix: `show-artifact` now returns the saved component source to MCP clients that cannot render Apps.** Agents can read the current source and make targeted edits instead of receiving only a link to the artifact.
diff --git a/.changeset/cimd-refresh-token.md b/.changeset/cimd-refresh-token.md
deleted file mode 100644
index 22408ee8d1..0000000000
--- a/.changeset/cimd-refresh-token.md
+++ /dev/null
@@ -1,10 +0,0 @@
----
-"@executor-js/api": patch
----
-
-Advertise refresh-token support in OAuth client ID metadata documents.
-
-OAuth providers may reject the `offline_access` scope when the client's
-metadata declares only the authorization-code grant. Hosted and local client
-metadata now declare both `authorization_code` and `refresh_token`, matching
-Executor's dynamic client registration behavior.
diff --git a/.changeset/cli-approval-public-origin.md b/.changeset/cli-approval-public-origin.md
deleted file mode 100644
index ebe473e9c0..0000000000
--- a/.changeset/cli-approval-public-origin.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"executor": patch
----
-
-Pin CLI browser approval links to `EXECUTOR_WEB_BASE_URL` so a TLS reverse proxy no longer returns an unreachable `http://` URL.
diff --git a/.changeset/completed-mcp-tool-name.md b/.changeset/completed-mcp-tool-name.md
deleted file mode 100644
index 1f97e79c55..0000000000
--- a/.changeset/completed-mcp-tool-name.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"@executor-js/execution": patch
----
-
-Completed MCP execute results now include `toolName` when a script successfully uses exactly one connected tool. Executions that use distinct tools remain unlabeled, and internal call provenance is not exposed in the MCP response.
diff --git a/.changeset/computer-use-remembered-approvals.md b/.changeset/computer-use-remembered-approvals.md
deleted file mode 100644
index 50ab5b6d7e..0000000000
--- a/.changeset/computer-use-remembered-approvals.md
+++ /dev/null
@@ -1,14 +0,0 @@
----
-"@executor-js/sdk": patch
-"@executor-js/execution": patch
-"@executor-js/plugin-mcp": patch
-"@executor-js/api": patch
-"@executor-js/react": patch
-"@executor-js/host-mcp": patch
-"@executor-js/cloudflare": patch
-"executor": patch
----
-
-Carry an approval's persistence choice through elicitation, so Codex Computer Use stops asking to use the same app on every call.
-
-Computer Use offers `persist: ["session", "always"]` in the prompt's terms and remembers the app only when the answer names one. Executor dropped the offer on the way in (the terms projection kept strings only) and the choice on the way out (every adapter rebuilt the reply from `action` and `content`), so each accept was one-time. `ElicitationResponse` now has `meta.persist`; the MCP plugin, the app-server bridge, and the MCP host pass it through; the model-mode `resume` tool and the browser approval page let the approver pick from the offered scopes. Nothing is chosen automatically: a bare accept still approves once.
diff --git a/.changeset/describe-compile-scope.md b/.changeset/describe-compile-scope.md
deleted file mode 100644
index a57cd5853c..0000000000
--- a/.changeset/describe-compile-scope.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"executor": patch
----
-
-Compile `describe.tool` previews against only the definitions a tool references, drop the compiler's per-call retained graph, and fall back to `unknown` for schemas over a node limit. Describing a tool from a large OpenAPI spec no longer burns seconds of CPU or leaks memory in the shared session isolate.
diff --git a/.changeset/describe-tool-annotations.md b/.changeset/describe-tool-annotations.md
deleted file mode 100644
index 127b8f38af..0000000000
--- a/.changeset/describe-tool-annotations.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"executor": patch
----
-
-Return a tool's declared annotations from `tools.schema` and `describe.tool`. Code inside `execute` can now read `requiresApproval`, `approvalDescription` and `mayElicit` without parsing the tool's prose description.
diff --git a/.changeset/great-hoops-repeat.md b/.changeset/great-hoops-repeat.md
deleted file mode 100644
index 9943a92068..0000000000
--- a/.changeset/great-hoops-repeat.md
+++ /dev/null
@@ -1,9 +0,0 @@
----
-"@executor-js/plugin-openapi": patch
----
-
-Fetch Google Analytics Data (`analyticsdata`) Discovery from the service's own
-host. The central directory does not list the GA4 Data API, so the canonical
-`https://www.googleapis.com/discovery/v1/apis/analyticsdata/v1beta/rest` answers
-404 and the source fails to import. Same treatment `forms`, `keep` and
-`photospicker` already get.
diff --git a/.changeset/hubspot-workspace-optional-scopes.md b/.changeset/hubspot-workspace-optional-scopes.md
deleted file mode 100644
index 71af545f24..0000000000
--- a/.changeset/hubspot-workspace-optional-scopes.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"@executor-js/sdk": patch
----
-
-Send HubSpot optional permissions in `optional_scope` for workspace OAuth clients so accounts can connect without optional product features.
diff --git a/.changeset/lost-execution-visibility.md b/.changeset/lost-execution-visibility.md
deleted file mode 100644
index 28e783ab13..0000000000
--- a/.changeset/lost-execution-visibility.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"executor": patch
----
-
-Report an MCP `execute` call that dies with a session reset as a JSON-RPC error instead of a silently closed stream. The front worker answers outstanding request ids when the session socket closes abnormally or a response deadline passes, and a rebuilt session answers ids stranded by a previous incarnation on the next stream. The plain memory-limit reset is now classified as transient.
diff --git a/.changeset/mcp-elicitation-active-deadline.md b/.changeset/mcp-elicitation-active-deadline.md
deleted file mode 100644
index 5e9da731ea..0000000000
--- a/.changeset/mcp-elicitation-active-deadline.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"@executor-js/plugin-mcp": patch
----
-
-Exclude time spent waiting for elicitation from the MCP tool invocation deadline.
diff --git a/.changeset/mcp-http-refusal.md b/.changeset/mcp-http-refusal.md
deleted file mode 100644
index 48a6049f63..0000000000
--- a/.changeset/mcp-http-refusal.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"executor": patch
----
-
-**Fix: an MCP server refusing a tool call with a 4xx HTTP response (for example Stripe's `422` when `stripe_context` is missing) surfaced as `Internal tool error [id]`.** When the body is a JSON object naming the problem, the call now returns a typed `mcp_tool_error` failure with the server's message and status, so the model can fix the arguments instead of reading an outage.
diff --git a/.changeset/mcp-invocation-sdk-failure.md b/.changeset/mcp-invocation-sdk-failure.md
deleted file mode 100644
index f5c6fc726b..0000000000
--- a/.changeset/mcp-invocation-sdk-failure.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"executor": patch
----
-
-Name the MCP SDK rejection (error class and code) in the `Internal tool error` defect log, so an opaque MCP failure can be diagnosed from the trace instead of only naming the tool that failed.
diff --git a/.changeset/mcp-jsonrpc-refusal.md b/.changeset/mcp-jsonrpc-refusal.md
deleted file mode 100644
index 05952c0d72..0000000000
--- a/.changeset/mcp-jsonrpc-refusal.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"executor": patch
----
-
-**Fix: an MCP server refusing a tool call with a JSON-RPC error (for example `-32602 Invalid params`) surfaced as `Internal tool error [id]`.** The server's answer is for the caller, so it now comes back as a typed `mcp_tool_error` failure carrying the server's message and JSON-RPC code, and the model can correct the arguments instead of reading an outage.
diff --git a/.changeset/mcp-passthrough-mode.md b/.changeset/mcp-passthrough-mode.md
deleted file mode 100644
index 9008960f31..0000000000
--- a/.changeset/mcp-passthrough-mode.md
+++ /dev/null
@@ -1,7 +0,0 @@
----
-"@executor-js/sdk": minor
-"@executor-js/execution": minor
-"executor": minor
----
-
-Add a search and invoke MCP mode (`?mode=passthrough`, `executor mcp --mode passthrough`). Search returns bounded pages of matching tool IDs and input schemas. Invoke validates arguments and runs the selected tool, with native client approval and workspace blocks enforced. The MCP catalog stays at two tools regardless of integration count.
diff --git a/.changeset/mcp-session-executor-leak.md b/.changeset/mcp-session-executor-leak.md
deleted file mode 100644
index e8419ec356..0000000000
--- a/.changeset/mcp-session-executor-leak.md
+++ /dev/null
@@ -1,7 +0,0 @@
----
-"@executor-js/host-mcp": patch
-"@executor-js/api": patch
-"executor": patch
----
-
-Shut down scoped executors and tool subprocess resources upon MCP session eviction and disposal in the in-process session store.
diff --git a/.changeset/member-directory-auth-cutover.md b/.changeset/member-directory-auth-cutover.md
deleted file mode 100644
index dec9f04338..0000000000
--- a/.changeset/member-directory-auth-cutover.md
+++ /dev/null
@@ -1,11 +0,0 @@
----
-"@executor-js/cloud": patch
-"@executor-js/api": patch
-"@executor-js/host-selfhost": patch
----
-
-Cloud now authorizes every protected request against the local membership mirror through the shared `MemberDirectory` seam: the per-request org membership check, the admin gates on the account and admin planes, the org switcher's organization list, and the free-organization limit all read the mirror instead of calling WorkOS. WorkOS is now a write target and an event source only. The seam gains `membershipsOf(accountId)` and `membershipById(organizationId, membershipId)` on both hosts.
-
-The mirror is trusted only while it is **ready**: the backfill has written every organization and the Events reconciler has drained the stream within the last ten minutes (both recorded on the `workos_sync` row). Until then the membership check falls back to WorkOS, exactly as before, so a member the backfill has not written yet is not locked out and a member revoked while the reconciler was down is not let in. The deploy runs `scripts/ensure-workos-mirror-ready.ts` after the migrations: it runs the backfill if needed, drains the events stream itself if the reconciler has not recently (so the gate never waits on a cron this same deploy ships), and fails the deploy if the mirror is still not ready. An organization the mirror does not hold at all (one that predates the mirror and nobody has signed in to since) is resolved from WorkOS on demand for a caller WorkOS confirms as its member, so CLI and MCP tokens naming such an organization are not refused. Deleting an organization now cancels billing before deleting the WorkOS organization, and a retry after a partial deletion is admitted from the mirror even while the mirror is not ready.
-
-**Ops step (cloud):** add the `WORKOS_API_KEY` secret to the `production` GitHub environment so the deploy gate can run the backfill.
diff --git a/.changeset/member-directory-readers.md b/.changeset/member-directory-readers.md
deleted file mode 100644
index 6cc71965cc..0000000000
--- a/.changeset/member-directory-readers.md
+++ /dev/null
@@ -1,10 +0,0 @@
----
-"@executor-js/cloud": patch
-"@executor-js/api": patch
-"@executor-js/react": patch
-"@executor-js/sdk": patch
----
-
-Member lists, the admin users page, and seat counts on cloud now read from the local membership mirror through the shared `MemberDirectory` seam instead of fanning out one WorkOS read per member. The admin users page gains an email/name search.
-
-**Deploy prerequisite (cloud):** `bun run --cwd apps/cloud db:backfill-workos-mirror:prod` must complete before this build is deployed, and its printed membership count should match WorkOS. Until the backfill has stamped the mirror's marker, seat reporting to Autumn is skipped with a warning (never a partial count) and member lists show only members who have signed in since the mirror shipped.
diff --git a/.changeset/member-directory-reconciler.md b/.changeset/member-directory-reconciler.md
deleted file mode 100644
index b73bbf8786..0000000000
--- a/.changeset/member-directory-reconciler.md
+++ /dev/null
@@ -1,7 +0,0 @@
----
-"@executor-js/cloud": patch
----
-
-The cloud membership mirror is now reconciled from the WorkOS Events API: an every-minute cron replays user, organization-membership, and organization events from a persisted cursor, so changes made in the WorkOS dashboard (a removed member, a role edit, a profile update) reach the mirror without anyone signing in. A signed webhook at `/api/webhooks/workos` pokes the same reconciler so those changes land in seconds, and `bun run --cwd apps/cloud db:drain-workos-events:prod` runs the same replay out-of-band until the stream is drained.
-
-**Ops steps (cloud):** set the webhook signing secret with `wrangler secret put WORKOS_WEBHOOK_SECRET`, then register `https://executor.sh/api/webhooks/workos` as a webhook endpoint in the WorkOS dashboard for the `user.*`, `organization_membership.*`, `organization.updated`, and `organization.deleted` events. Until the secret is set the route answers 503 and the cron alone keeps the mirror current.
diff --git a/.changeset/mirror-readiness-removal.md b/.changeset/mirror-readiness-removal.md
deleted file mode 100644
index e6ad82e6a5..0000000000
--- a/.changeset/mirror-readiness-removal.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"@executor-js/cloud": patch
----
-
-`authorizeOrganization` now reads the local membership mirror unconditionally: the per-request readiness check (`MirrorReadiness`) and its live WorkOS `listUserMemberships` fallback are gone from the request path entirely. The backfill is complete and permanent, and an organization that predates the mirror is still covered by the existing on-demand scan (`ensureOrganizationBackfilled`). A stalled reconciler is now an operational alert instead of a per-request fallback: after each run, the cron checks the mirror's `drained_at` heartbeat and, if it has fallen behind the lag budget, logs a structured error and reports it to Sentry. The deploy gate (`scripts/ensure-workos-mirror-ready.ts`) is unchanged — it still refuses to ship while the mirror is unready — and `drained_at` keeps being written by every reconciler run.
diff --git a/.changeset/oauth-background-resource-lifetime.md b/.changeset/oauth-background-resource-lifetime.md
deleted file mode 100644
index 2680db0ed6..0000000000
--- a/.changeset/oauth-background-resource-lifetime.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"@executor-js/api": patch
----
-
-Keep request resources alive until background OAuth tool discovery finishes, so slow cloud connections can publish their tools after the callback returns.
diff --git a/.changeset/openapi-transport-unreachable.md b/.changeset/openapi-transport-unreachable.md
deleted file mode 100644
index 05623ff515..0000000000
--- a/.changeset/openapi-transport-unreachable.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-"executor": patch
-"@executor-js/plugin-openapi": patch
----
-
-OpenAPI tools that cannot reach the upstream server now return an `upstream_unreachable` error instead of `Internal tool error [id]`. The message names the integration and origin that could not be reached, `details` carries the sanitized `host` and errno-style `code` (`ECONNREFUSED`, `ENOTFOUND`, …), and the failure is logged with the same classification.
diff --git a/.changeset/openapi-vendor-json-content-type.md b/.changeset/openapi-vendor-json-content-type.md
deleted file mode 100644
index 24c4da544e..0000000000
--- a/.changeset/openapi-vendor-json-content-type.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"@executor-js/plugin-openapi": patch
----
-
-Preserve vendor +json Content-Type on OpenAPI object request bodies.
diff --git a/.changeset/post-health-checks.md b/.changeset/post-health-checks.md
deleted file mode 100644
index 21fd2d0281..0000000000
--- a/.changeset/post-health-checks.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-"@executor-js/plugin-openapi": patch
-"@executor-js/react": patch
----
-
-Support POST health checks for APIs that expose reads through HTTP RPC. Warn that POST can change data, allow validated JSON request bodies, and display the reason when a configured probe cannot run.
diff --git a/.changeset/reduced-motion.md b/.changeset/reduced-motion.md
deleted file mode 100644
index 0ce1a65ad0..0000000000
--- a/.changeset/reduced-motion.md
+++ /dev/null
@@ -1,10 +0,0 @@
----
-"@executor-js/react": patch
----
-
-fix: honor prefers-reduced-motion in the shared stylesheet
-
-Adds a `prefers-reduced-motion: reduce` block to the global stylesheet that
-caps transition/animation durations to 0.01ms and disables smooth scrolling,
-so motion-sensitive users get a stable UI. The loading spinner renders
-statically under reduced motion (its meaning is preserved via `role="status"`).
diff --git a/.changeset/refresh-scope-fallback.md b/.changeset/refresh-scope-fallback.md
deleted file mode 100644
index 88135d1712..0000000000
--- a/.changeset/refresh-scope-fallback.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"@executor-js/sdk": patch
----
-
-Retry a refresh-token grant without `scope` when the authorization server refuses the echoed grant with `invalid_scope`. Railway answers a scope-bearing refresh with "refresh token missing requested scope" even though echoing the granted scope is legal under RFC 6749 §6, so a connection whose refresh token was still live failed every call as `oauth_refresh_failed` and only a hand re-authorization recovered it.
diff --git a/.changeset/remove-integration-cascade.md b/.changeset/remove-integration-cascade.md
deleted file mode 100644
index e970b2a0ae..0000000000
--- a/.changeset/remove-integration-cascade.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"@executor-js/sdk": patch
----
-
-Removing an integration now drops every member's connections and tools under it, not only the remover's own. Tool and connection listings no longer serve rows whose integration is gone from the catalog, invoking such a tool reports the missing integration, and `oauth.start` refuses an unknown integration before creating a session.
diff --git a/.changeset/restart-hosted-invitation-login.md b/.changeset/restart-hosted-invitation-login.md
deleted file mode 100644
index c76b90fa2b..0000000000
--- a/.changeset/restart-hosted-invitation-login.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"@executor-js/cloud": patch
----
-
-Restart hosted invitation logins that return without state, while keeping authorization codes bound to the browser that started the login.
diff --git a/.changeset/self-hosted-fonts.md b/.changeset/self-hosted-fonts.md
deleted file mode 100644
index 4d8e025451..0000000000
--- a/.changeset/self-hosted-fonts.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"executor": patch
----
-
-Bundle the Geist and Geist Mono fonts with the console instead of loading them from Google Fonts. The UI no longer stays blank when a self-hosted deployment cannot reach fonts.googleapis.com.
diff --git a/.changeset/selfhost-admin-area-access.md b/.changeset/selfhost-admin-area-access.md
deleted file mode 100644
index 119284c3e7..0000000000
--- a/.changeset/selfhost-admin-area-access.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"executor": patch
----
-
-Hide the self-hosted Admin area from non-admin members and refuse direct access before member details or invite controls are rendered.
diff --git a/.changeset/strict-explicit-dcr-redirect.md b/.changeset/strict-explicit-dcr-redirect.md
deleted file mode 100644
index efd848b68d..0000000000
--- a/.changeset/strict-explicit-dcr-redirect.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"@executor-js/sdk": patch
----
-
-Treat an explicit dynamic-client redirect URI as authoritative when selecting a reusable OAuth client. Legacy clients with no recorded redirect now remain available to existing connections while a new client is registered for the explicit callback; callers that rely on Executor's configured default retain the previous compatibility behavior.
diff --git a/.changeset/tidy-login-state.md b/.changeset/tidy-login-state.md
deleted file mode 100644
index 7cbf222e3f..0000000000
--- a/.changeset/tidy-login-state.md
+++ /dev/null
@@ -1,17 +0,0 @@
----
-"@executor-js/cloud": patch
----
-
-fix: make login CSRF state mandatory in the WorkOS callback
-
-The callback previously skipped its CSRF check whenever the redirect carried
-no `state` value ("some WorkOS-initiated redirects don't include one"). That
-bypass let an attacker complete their own OAuth round-trip and redirect a
-victim's browser through the callback with the attacker's `code` and no
-`state`, silently signing the victim into the attacker's account (login CSRF).
-
-The check is now unconditional: a callback without a state matching the
-`wos-login-state` cookie set on `/login` is rejected with 400. This is a
-breaking change for any client relying on the undocumented no-state entry
-path; server-initiated flows that cannot carry state must be redesigned with
-a signed nonce instead of re-adding the bypass.
diff --git a/.changeset/tidy-trace-secrets.md b/.changeset/tidy-trace-secrets.md
deleted file mode 100644
index 5176244615..0000000000
--- a/.changeset/tidy-trace-secrets.md
+++ /dev/null
@@ -1,8 +0,0 @@
----
-"@executor-js/sdk": patch
-"@executor-js/api": patch
----
-
-Redact redirect, referrer, trace-state, and MCP session headers from outbound HTTP traces.
-
-Allow hosts to require HTTPS for outbound requests and reject redirects to plaintext endpoints. Executor Cloud enables this policy. Explicit private-network development access remains available.
diff --git a/.changeset/toolkits-empty-grid.md b/.changeset/toolkits-empty-grid.md
deleted file mode 100644
index fa868f391f..0000000000
--- a/.changeset/toolkits-empty-grid.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"executor": patch
----
-
-Prevent the empty Toolkits page from scrolling past its visible add cards.
diff --git a/.changeset/update-openapi-yaml-parser.md b/.changeset/update-openapi-yaml-parser.md
deleted file mode 100644
index 2778286b62..0000000000
--- a/.changeset/update-openapi-yaml-parser.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"@executor-js/plugin-openapi": patch
----
-
-Update the YAML parser to include fixes for malformed-input denial of service.
diff --git a/.changeset/vercel-mcp-refresh-token.md b/.changeset/vercel-mcp-refresh-token.md
deleted file mode 100644
index dbcf4e5d2a..0000000000
--- a/.changeset/vercel-mcp-refresh-token.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"@executor-js/sdk": patch
----
-
-Keep Vercel MCP connections renewable by requesting the provider's `offline_access` lifecycle scope during registration and authorization.
diff --git a/apps/cli/CHANGELOG.md b/apps/cli/CHANGELOG.md
index cc3911c2fd..1d6806e6aa 100644
--- a/apps/cli/CHANGELOG.md
+++ b/apps/cli/CHANGELOG.md
@@ -1,5 +1,53 @@
# executor
+## 1.6.9
+
+### Patch Changes
+
+- [#1901](https://github.com/UsefulSoftwareCo/executor/pull/1901) [`de13821`](https://github.com/UsefulSoftwareCo/executor/commit/de13821e4efd3f571ae7f41d46f74d761fae8988) Thanks [@baggiiiie](https://github.com/baggiiiie)! - Prevent deleted artifacts from briefly reappearing after returning to the artifact gallery.
+
+- [#1915](https://github.com/UsefulSoftwareCo/executor/pull/1915) [`5c1d1b4`](https://github.com/UsefulSoftwareCo/executor/commit/5c1d1b4f71be30b5d78d98de10111841d7da4a81) Thanks [@baggiiiie](https://github.com/baggiiiie)! - **Fix: links in generated artifacts (``) did nothing when clicked.** The sandbox iframe deliberately has no `allow-popups`, so the browser blocked the new browsing context and the click went nowhere. A trusted user click is now relayed across the frame boundary to the host's `openLink` capability — guarded by a per-render nonce so generated code cannot forge or observe it — and the host opens only `http`/`https` URLs.
+
+- [#1884](https://github.com/UsefulSoftwareCo/executor/pull/1884) [`3eea03b`](https://github.com/UsefulSoftwareCo/executor/commit/3eea03b580c48ea3d01dd916acea71c0cd45a7cc) Thanks [@GijungKim](https://github.com/GijungKim)! - Render artifacts that call integrations or tools with hyphenated slugs.
+
+- [#1943](https://github.com/UsefulSoftwareCo/executor/pull/1943) [`b5d53cb`](https://github.com/UsefulSoftwareCo/executor/commit/b5d53cbebb6cee98172650c17df81614c6271387) Thanks [@baggiiiie](https://github.com/baggiiiie)! - **Fix: `show-artifact` now returns the saved component source to MCP clients that cannot render Apps.** Agents can read the current source and make targeted edits instead of receiving only a link to the artifact.
+
+- [#1967](https://github.com/UsefulSoftwareCo/executor/pull/1967) [`bfc46e5`](https://github.com/UsefulSoftwareCo/executor/commit/bfc46e5620905a25d5dda6f07d829b5a8cabf309) Thanks [@utpalsinghdev](https://github.com/utpalsinghdev)! - Pin CLI browser approval links to `EXECUTOR_WEB_BASE_URL` so a TLS reverse proxy no longer returns an unreachable `http://` URL.
+
+- [#1976](https://github.com/UsefulSoftwareCo/executor/pull/1976) [`40b2f2e`](https://github.com/UsefulSoftwareCo/executor/commit/40b2f2e38d642843eb7c984c020117e0db52acfc) Thanks [@SunkenInTime](https://github.com/SunkenInTime)! - Carry an approval's persistence choice through elicitation, so Codex Computer Use stops asking to use the same app on every call.
+
+ Computer Use offers `persist: ["session", "always"]` in the prompt's terms and remembers the app only when the answer names one. Executor dropped the offer on the way in (the terms projection kept strings only) and the choice on the way out (every adapter rebuilt the reply from `action` and `content`), so each accept was one-time. `ElicitationResponse` now has `meta.persist`; the MCP plugin, the app-server bridge, and the MCP host pass it through; the model-mode `resume` tool and the browser approval page let the approver pick from the offered scopes. Nothing is chosen automatically: a bare accept still approves once.
+
+- [#1977](https://github.com/UsefulSoftwareCo/executor/pull/1977) [`6870f38`](https://github.com/UsefulSoftwareCo/executor/commit/6870f38438e0729aaf6594f66afa828d118fb13c) Thanks [@RhysSullivan](https://github.com/RhysSullivan)! - Compile `describe.tool` previews against only the definitions a tool references, drop the compiler's per-call retained graph, and fall back to `unknown` for schemas over a node limit. Describing a tool from a large OpenAPI spec no longer burns seconds of CPU or leaks memory in the shared session isolate.
+
+- [#1980](https://github.com/UsefulSoftwareCo/executor/pull/1980) [`b961092`](https://github.com/UsefulSoftwareCo/executor/commit/b961092443435e9cc0796626436f2cc2a8001b3b) Thanks [@daviesayo](https://github.com/daviesayo)! - Return a tool's declared annotations from `tools.schema` and `describe.tool`. Code inside `execute` can now read `requiresApproval`, `approvalDescription` and `mayElicit` without parsing the tool's prose description.
+
+- [#1978](https://github.com/UsefulSoftwareCo/executor/pull/1978) [`f1d95f2`](https://github.com/UsefulSoftwareCo/executor/commit/f1d95f2b657316180992d5a67c24b7b76dc2b0f1) Thanks [@RhysSullivan](https://github.com/RhysSullivan)! - Report an MCP `execute` call that dies with a session reset as a JSON-RPC error instead of a silently closed stream. The front worker answers outstanding request ids when the session socket closes abnormally or a response deadline passes, and a rebuilt session answers ids stranded by a previous incarnation on the next stream. The plain memory-limit reset is now classified as transient.
+
+- [#2016](https://github.com/UsefulSoftwareCo/executor/pull/2016) [`84620aa`](https://github.com/UsefulSoftwareCo/executor/commit/84620aa96ae2b855bbba97d3b4121a1a41f6f4e1) Thanks [@RhysSullivan](https://github.com/RhysSullivan)! - **Fix: an MCP server refusing a tool call with a 4xx HTTP response (for example Stripe's `422` when `stripe_context` is missing) surfaced as `Internal tool error [id]`.** When the body is a JSON object naming the problem, the call now returns a typed `mcp_tool_error` failure with the server's message and status, so the model can fix the arguments instead of reading an outage.
+
+- [#2014](https://github.com/UsefulSoftwareCo/executor/pull/2014) [`f94e5e0`](https://github.com/UsefulSoftwareCo/executor/commit/f94e5e0320c2a472367d4506663d779348877f6c) Thanks [@RhysSullivan](https://github.com/RhysSullivan)! - Name the MCP SDK rejection (error class and code) in the `Internal tool error` defect log, so an opaque MCP failure can be diagnosed from the trace instead of only naming the tool that failed.
+
+- [#2012](https://github.com/UsefulSoftwareCo/executor/pull/2012) [`5b5db98`](https://github.com/UsefulSoftwareCo/executor/commit/5b5db98b1a2751be424e82ba9b8753fa8f855097) Thanks [@RhysSullivan](https://github.com/RhysSullivan)! - **Fix: an MCP server refusing a tool call with a JSON-RPC error (for example `-32602 Invalid params`) surfaced as `Internal tool error [id]`.** The server's answer is for the caller, so it now comes back as a typed `mcp_tool_error` failure carrying the server's message and JSON-RPC code, and the model can correct the arguments instead of reading an outage.
+
+- [#1942](https://github.com/UsefulSoftwareCo/executor/pull/1942) [`3c263d7`](https://github.com/UsefulSoftwareCo/executor/commit/3c263d7580d1d9302a1dc5d63f2fab253fd409c2) Thanks [@RhysSullivan](https://github.com/RhysSullivan)! - Add a search and invoke MCP mode (`?mode=passthrough`, `executor mcp --mode passthrough`). Search returns bounded pages of matching tool IDs and input schemas. Invoke validates arguments and runs the selected tool, with native client approval and workspace blocks enforced. The MCP catalog stays at two tools regardless of integration count.
+
+- [#1971](https://github.com/UsefulSoftwareCo/executor/pull/1971) [`61f71c5`](https://github.com/UsefulSoftwareCo/executor/commit/61f71c56fe799b6e0faa2b2f82a91f631bc6a979) Thanks [@Adityakk9031](https://github.com/Adityakk9031)! - Shut down scoped executors and tool subprocess resources upon MCP session eviction and disposal in the in-process session store.
+
+- [#1960](https://github.com/UsefulSoftwareCo/executor/pull/1960) [`d64639b`](https://github.com/UsefulSoftwareCo/executor/commit/d64639b1a50d2d292235aff8f727ca11fe9e43a6) Thanks [@baggiiiie](https://github.com/baggiiiie)! - OpenAPI tools that cannot reach the upstream server now return an `upstream_unreachable` error instead of `Internal tool error [id]`. The message names the integration and origin that could not be reached, `details` carries the sanitized `host` and errno-style `code` (`ECONNREFUSED`, `ENOTFOUND`, …), and the failure is logged with the same classification.
+
+- [#1963](https://github.com/UsefulSoftwareCo/executor/pull/1963) [`eaa1f3a`](https://github.com/UsefulSoftwareCo/executor/commit/eaa1f3a57ffff88aede8e83783ea7ed4471aec1f) Thanks [@RhysSullivan](https://github.com/RhysSullivan)! - Bundle the Geist and Geist Mono fonts with the console instead of loading them from Google Fonts. The UI no longer stays blank when a self-hosted deployment cannot reach fonts.googleapis.com.
+
+- [#1987](https://github.com/UsefulSoftwareCo/executor/pull/1987) [`347537c`](https://github.com/UsefulSoftwareCo/executor/commit/347537cdd65b2adec0b38b0b98ef764a7c98d279) Thanks [@baggiiiie](https://github.com/baggiiiie)! - Hide the self-hosted Admin area from non-admin members and refuse direct access before member details or invite controls are rendered.
+
+- [#1897](https://github.com/UsefulSoftwareCo/executor/pull/1897) [`f1930dd`](https://github.com/UsefulSoftwareCo/executor/commit/f1930ddbe4fd18d75ce4f67b56200037ec4d6f65) Thanks [@baggiiiie](https://github.com/baggiiiie)! - Prevent the empty Toolkits page from scrolling past its visible add cards.
+
+- Updated dependencies [[`d873caf`](https://github.com/UsefulSoftwareCo/executor/commit/d873caf6fb3aa7408270b42aaad77f53cf9ec090), [`40b2f2e`](https://github.com/UsefulSoftwareCo/executor/commit/40b2f2e38d642843eb7c984c020117e0db52acfc), [`65d939e`](https://github.com/UsefulSoftwareCo/executor/commit/65d939ebab6f77a00a3435fe3575399cd1cd3b7f), [`3c263d7`](https://github.com/UsefulSoftwareCo/executor/commit/3c263d7580d1d9302a1dc5d63f2fab253fd409c2), [`61f71c5`](https://github.com/UsefulSoftwareCo/executor/commit/61f71c56fe799b6e0faa2b2f82a91f631bc6a979), [`a6cdcf1`](https://github.com/UsefulSoftwareCo/executor/commit/a6cdcf1ccfae22e7d3378908c095e5c847c70f90), [`be77521`](https://github.com/UsefulSoftwareCo/executor/commit/be775216cccddac6002b1f9442b3c8151e4f6063), [`f8cfa5f`](https://github.com/UsefulSoftwareCo/executor/commit/f8cfa5f5f475c6b9c14143663ed5861bec8f74af), [`cc0fd8f`](https://github.com/UsefulSoftwareCo/executor/commit/cc0fd8f6099f3d05c73a285ef14932c01ac212fa), [`85cf428`](https://github.com/UsefulSoftwareCo/executor/commit/85cf428905bbd73257fb3c3be5c89e762bf79377), [`38a7725`](https://github.com/UsefulSoftwareCo/executor/commit/38a7725876bcc9c8adeea9c7efbd190c121d3b86), [`3fd28a5`](https://github.com/UsefulSoftwareCo/executor/commit/3fd28a51fabb0fc96d0bf83408021e7cbca70bfe), [`929b233`](https://github.com/UsefulSoftwareCo/executor/commit/929b2338f225b3f80190ac7a6fe1f2473650c58c)]:
+ - @executor-js/api@1.4.72
+ - @executor-js/sdk@1.6.9
+ - @executor-js/local@1.6.9
+ - @executor-js/runtime-quickjs@1.6.9
+
## 1.6.8
### Patch Changes
diff --git a/apps/cli/package.json b/apps/cli/package.json
index c43d00c22c..8f96399565 100644
--- a/apps/cli/package.json
+++ b/apps/cli/package.json
@@ -1,6 +1,6 @@
{
"name": "executor",
- "version": "1.6.8",
+ "version": "1.6.9",
"private": true,
"bin": {
"executor": "./bin/executor.ts"
diff --git a/apps/cloud/CHANGELOG.md b/apps/cloud/CHANGELOG.md
index 09491854a2..407785932d 100644
--- a/apps/cloud/CHANGELOG.md
+++ b/apps/cloud/CHANGELOG.md
@@ -1,5 +1,58 @@
# @executor-js/cloud
+## 1.4.70
+
+### Patch Changes
+
+- [#2026](https://github.com/UsefulSoftwareCo/executor/pull/2026) [`a6cdcf1`](https://github.com/UsefulSoftwareCo/executor/commit/a6cdcf1ccfae22e7d3378908c095e5c847c70f90) Thanks [@RhysSullivan](https://github.com/RhysSullivan)! - Cloud now authorizes every protected request against the local membership mirror through the shared `MemberDirectory` seam: the per-request org membership check, the admin gates on the account and admin planes, the org switcher's organization list, and the free-organization limit all read the mirror instead of calling WorkOS. WorkOS is now a write target and an event source only. The seam gains `membershipsOf(accountId)` and `membershipById(organizationId, membershipId)` on both hosts.
+
+ The mirror is trusted only while it is **ready**: the backfill has written every organization and the Events reconciler has drained the stream within the last ten minutes (both recorded on the `workos_sync` row). Until then the membership check falls back to WorkOS, exactly as before, so a member the backfill has not written yet is not locked out and a member revoked while the reconciler was down is not let in. The deploy runs `scripts/ensure-workos-mirror-ready.ts` after the migrations: it runs the backfill if needed, drains the events stream itself if the reconciler has not recently (so the gate never waits on a cron this same deploy ships), and fails the deploy if the mirror is still not ready. An organization the mirror does not hold at all (one that predates the mirror and nobody has signed in to since) is resolved from WorkOS on demand for a caller WorkOS confirms as its member, so CLI and MCP tokens naming such an organization are not refused. Deleting an organization now cancels billing before deleting the WorkOS organization, and a retry after a partial deletion is admitted from the mirror even while the mirror is not ready.
+
+ **Ops step (cloud):** add the `WORKOS_API_KEY` secret to the `production` GitHub environment so the deploy gate can run the backfill.
+
+- [#2025](https://github.com/UsefulSoftwareCo/executor/pull/2025) [`be77521`](https://github.com/UsefulSoftwareCo/executor/commit/be775216cccddac6002b1f9442b3c8151e4f6063) Thanks [@RhysSullivan](https://github.com/RhysSullivan)! - Member lists, the admin users page, and seat counts on cloud now read from the local membership mirror through the shared `MemberDirectory` seam instead of fanning out one WorkOS read per member. The admin users page gains an email/name search.
+
+ **Deploy prerequisite (cloud):** `bun run --cwd apps/cloud db:backfill-workos-mirror:prod` must complete before this build is deployed, and its printed membership count should match WorkOS. Until the backfill has stamped the mirror's marker, seat reporting to Autumn is skipped with a warning (never a partial count) and member lists show only members who have signed in since the mirror shipped.
+
+- [#2024](https://github.com/UsefulSoftwareCo/executor/pull/2024) [`a97a20c`](https://github.com/UsefulSoftwareCo/executor/commit/a97a20cc848b69dc13759824c6229dcc4766fbf3) Thanks [@RhysSullivan](https://github.com/RhysSullivan)! - The cloud membership mirror is now reconciled from the WorkOS Events API: an every-minute cron replays user, organization-membership, and organization events from a persisted cursor, so changes made in the WorkOS dashboard (a removed member, a role edit, a profile update) reach the mirror without anyone signing in. A signed webhook at `/api/webhooks/workos` pokes the same reconciler so those changes land in seconds, and `bun run --cwd apps/cloud db:drain-workos-events:prod` runs the same replay out-of-band until the stream is drained.
+
+ **Ops steps (cloud):** set the webhook signing secret with `wrangler secret put WORKOS_WEBHOOK_SECRET`, then register `https://executor.sh/api/webhooks/workos` as a webhook endpoint in the WorkOS dashboard for the `user.*`, `organization_membership.*`, `organization.updated`, and `organization.deleted` events. Until the secret is set the route answers 503 and the cron alone keeps the mirror current.
+
+- [#2031](https://github.com/UsefulSoftwareCo/executor/pull/2031) [`a72e51d`](https://github.com/UsefulSoftwareCo/executor/commit/a72e51d138da2e274d397b7f3ed63840c8efb90c) Thanks [@RhysSullivan](https://github.com/RhysSullivan)! - `authorizeOrganization` now reads the local membership mirror unconditionally: the per-request readiness check (`MirrorReadiness`) and its live WorkOS `listUserMemberships` fallback are gone from the request path entirely. The backfill is complete and permanent, and an organization that predates the mirror is still covered by the existing on-demand scan (`ensureOrganizationBackfilled`). A stalled reconciler is now an operational alert instead of a per-request fallback: after each run, the cron checks the mirror's `drained_at` heartbeat and, if it has fallen behind the lag budget, logs a structured error and reports it to Sentry. The deploy gate (`scripts/ensure-workos-mirror-ready.ts`) is unchanged — it still refuses to ship while the mirror is unready — and `drained_at` keeps being written by every reconciler run.
+
+- [#2023](https://github.com/UsefulSoftwareCo/executor/pull/2023) [`9c42444`](https://github.com/UsefulSoftwareCo/executor/commit/9c4244443466fed9365713caf9372b3404df7c6a) Thanks [@RhysSullivan](https://github.com/RhysSullivan)! - Restart hosted invitation logins that return without state, while keeping authorization codes bound to the browser that started the login.
+
+- [#1886](https://github.com/UsefulSoftwareCo/executor/pull/1886) [`5ecb881`](https://github.com/UsefulSoftwareCo/executor/commit/5ecb8812287c96b8ea4c3bf33f3c1ee34badb1df) Thanks [@ra-co88](https://github.com/ra-co88)! - fix: make login CSRF state mandatory in the WorkOS callback
+
+ The callback previously skipped its CSRF check whenever the redirect carried
+ no `state` value ("some WorkOS-initiated redirects don't include one"). That
+ bypass let an attacker complete their own OAuth round-trip and redirect a
+ victim's browser through the callback with the attacker's `code` and no
+ `state`, silently signing the victim into the attacker's account (login CSRF).
+
+ The check is now unconditional: a callback without a state matching the
+ `wos-login-state` cookie set on `/login` is rejected with 400. This is a
+ breaking change for any client relying on the undocumented no-state entry
+ path; server-initiated flows that cannot carry state must be redesigned with
+ a signed nonce instead of re-adding the bypass.
+
+- Updated dependencies [[`d873caf`](https://github.com/UsefulSoftwareCo/executor/commit/d873caf6fb3aa7408270b42aaad77f53cf9ec090), [`89b0f8d`](https://github.com/UsefulSoftwareCo/executor/commit/89b0f8d74cfb7d6a839bf08a267d892fb0cc676e), [`40b2f2e`](https://github.com/UsefulSoftwareCo/executor/commit/40b2f2e38d642843eb7c984c020117e0db52acfc), [`55a8b5e`](https://github.com/UsefulSoftwareCo/executor/commit/55a8b5eaea88c20fa5c5f1852262db613b8ddb9f), [`65d939e`](https://github.com/UsefulSoftwareCo/executor/commit/65d939ebab6f77a00a3435fe3575399cd1cd3b7f), [`0e9d800`](https://github.com/UsefulSoftwareCo/executor/commit/0e9d8004e2f1b35ce948b382bb97c58ebf177911), [`3c263d7`](https://github.com/UsefulSoftwareCo/executor/commit/3c263d7580d1d9302a1dc5d63f2fab253fd409c2), [`61f71c5`](https://github.com/UsefulSoftwareCo/executor/commit/61f71c56fe799b6e0faa2b2f82a91f631bc6a979), [`a6cdcf1`](https://github.com/UsefulSoftwareCo/executor/commit/a6cdcf1ccfae22e7d3378908c095e5c847c70f90), [`be77521`](https://github.com/UsefulSoftwareCo/executor/commit/be775216cccddac6002b1f9442b3c8151e4f6063), [`f8cfa5f`](https://github.com/UsefulSoftwareCo/executor/commit/f8cfa5f5f475c6b9c14143663ed5861bec8f74af), [`d64639b`](https://github.com/UsefulSoftwareCo/executor/commit/d64639b1a50d2d292235aff8f727ca11fe9e43a6), [`e9055c1`](https://github.com/UsefulSoftwareCo/executor/commit/e9055c13bf73bc1860c8eded542fe566b51c3784), [`1f67d83`](https://github.com/UsefulSoftwareCo/executor/commit/1f67d83609b13a73d3dc8d630f48c8f54a02e6ca), [`905e097`](https://github.com/UsefulSoftwareCo/executor/commit/905e0972614aed5a3bb279b51dc060f87f892d75), [`cc0fd8f`](https://github.com/UsefulSoftwareCo/executor/commit/cc0fd8f6099f3d05c73a285ef14932c01ac212fa), [`85cf428`](https://github.com/UsefulSoftwareCo/executor/commit/85cf428905bbd73257fb3c3be5c89e762bf79377), [`38a7725`](https://github.com/UsefulSoftwareCo/executor/commit/38a7725876bcc9c8adeea9c7efbd190c121d3b86), [`3fd28a5`](https://github.com/UsefulSoftwareCo/executor/commit/3fd28a51fabb0fc96d0bf83408021e7cbca70bfe), [`3fd28a5`](https://github.com/UsefulSoftwareCo/executor/commit/3fd28a51fabb0fc96d0bf83408021e7cbca70bfe), [`929b233`](https://github.com/UsefulSoftwareCo/executor/commit/929b2338f225b3f80190ac7a6fe1f2473650c58c)]:
+ - @executor-js/api@1.4.72
+ - @executor-js/execution@1.6.9
+ - @executor-js/sdk@1.6.9
+ - @executor-js/plugin-mcp@1.6.9
+ - @executor-js/react@1.4.72
+ - @executor-js/cloudflare@0.0.51
+ - @executor-js/plugin-openapi@1.6.9
+ - @executor-js/plugin-graphql@1.6.9
+ - @executor-js/plugin-toolkits@1.5.44
+ - @executor-js/host-mcp@1.4.4
+ - @executor-js/mcp-apps-shell@1.4.20
+ - @executor-js/runtime-dynamic-worker@1.4.4
+ - @executor-js/vite-plugin@0.0.69
+ - @executor-js/plugin-workos-vault@0.0.2
+ - @executor-js/runtime-quickjs@1.6.9
+
## 1.4.69
### Patch Changes
diff --git a/apps/cloud/package.json b/apps/cloud/package.json
index b7871ba869..3c1dde605f 100644
--- a/apps/cloud/package.json
+++ b/apps/cloud/package.json
@@ -1,6 +1,6 @@
{
"name": "@executor-js/cloud",
- "version": "1.4.69",
+ "version": "1.4.70",
"private": true,
"type": "module",
"scripts": {
diff --git a/apps/desktop/CHANGELOG.md b/apps/desktop/CHANGELOG.md
index db3943d6aa..01d54c3530 100644
--- a/apps/desktop/CHANGELOG.md
+++ b/apps/desktop/CHANGELOG.md
@@ -1,5 +1,7 @@
# @executor-js/desktop
+## 1.6.9
+
## 1.6.8
## 1.6.7
diff --git a/apps/desktop/package.json b/apps/desktop/package.json
index 3d27a2ad8d..47faabf240 100644
--- a/apps/desktop/package.json
+++ b/apps/desktop/package.json
@@ -1,6 +1,6 @@
{
"name": "@executor-js/desktop",
- "version": "1.6.8",
+ "version": "1.6.9",
"private": true,
"homepage": "https://github.com/UsefulSoftwareCo/executor",
"license": "MIT",
diff --git a/apps/host-selfhost/CHANGELOG.md b/apps/host-selfhost/CHANGELOG.md
index e953f5d3c0..222a2029f8 100644
--- a/apps/host-selfhost/CHANGELOG.md
+++ b/apps/host-selfhost/CHANGELOG.md
@@ -1,5 +1,32 @@
# @executor-js/host-selfhost
+## 0.0.51
+
+### Patch Changes
+
+- [#2026](https://github.com/UsefulSoftwareCo/executor/pull/2026) [`a6cdcf1`](https://github.com/UsefulSoftwareCo/executor/commit/a6cdcf1ccfae22e7d3378908c095e5c847c70f90) Thanks [@RhysSullivan](https://github.com/RhysSullivan)! - Cloud now authorizes every protected request against the local membership mirror through the shared `MemberDirectory` seam: the per-request org membership check, the admin gates on the account and admin planes, the org switcher's organization list, and the free-organization limit all read the mirror instead of calling WorkOS. WorkOS is now a write target and an event source only. The seam gains `membershipsOf(accountId)` and `membershipById(organizationId, membershipId)` on both hosts.
+
+ The mirror is trusted only while it is **ready**: the backfill has written every organization and the Events reconciler has drained the stream within the last ten minutes (both recorded on the `workos_sync` row). Until then the membership check falls back to WorkOS, exactly as before, so a member the backfill has not written yet is not locked out and a member revoked while the reconciler was down is not let in. The deploy runs `scripts/ensure-workos-mirror-ready.ts` after the migrations: it runs the backfill if needed, drains the events stream itself if the reconciler has not recently (so the gate never waits on a cron this same deploy ships), and fails the deploy if the mirror is still not ready. An organization the mirror does not hold at all (one that predates the mirror and nobody has signed in to since) is resolved from WorkOS on demand for a caller WorkOS confirms as its member, so CLI and MCP tokens naming such an organization are not refused. Deleting an organization now cancels billing before deleting the WorkOS organization, and a retry after a partial deletion is admitted from the mirror even while the mirror is not ready.
+
+ **Ops step (cloud):** add the `WORKOS_API_KEY` secret to the `production` GitHub environment so the deploy gate can run the backfill.
+
+- Updated dependencies [[`d873caf`](https://github.com/UsefulSoftwareCo/executor/commit/d873caf6fb3aa7408270b42aaad77f53cf9ec090), [`89b0f8d`](https://github.com/UsefulSoftwareCo/executor/commit/89b0f8d74cfb7d6a839bf08a267d892fb0cc676e), [`40b2f2e`](https://github.com/UsefulSoftwareCo/executor/commit/40b2f2e38d642843eb7c984c020117e0db52acfc), [`55a8b5e`](https://github.com/UsefulSoftwareCo/executor/commit/55a8b5eaea88c20fa5c5f1852262db613b8ddb9f), [`65d939e`](https://github.com/UsefulSoftwareCo/executor/commit/65d939ebab6f77a00a3435fe3575399cd1cd3b7f), [`0e9d800`](https://github.com/UsefulSoftwareCo/executor/commit/0e9d8004e2f1b35ce948b382bb97c58ebf177911), [`3c263d7`](https://github.com/UsefulSoftwareCo/executor/commit/3c263d7580d1d9302a1dc5d63f2fab253fd409c2), [`61f71c5`](https://github.com/UsefulSoftwareCo/executor/commit/61f71c56fe799b6e0faa2b2f82a91f631bc6a979), [`a6cdcf1`](https://github.com/UsefulSoftwareCo/executor/commit/a6cdcf1ccfae22e7d3378908c095e5c847c70f90), [`be77521`](https://github.com/UsefulSoftwareCo/executor/commit/be775216cccddac6002b1f9442b3c8151e4f6063), [`f8cfa5f`](https://github.com/UsefulSoftwareCo/executor/commit/f8cfa5f5f475c6b9c14143663ed5861bec8f74af), [`d64639b`](https://github.com/UsefulSoftwareCo/executor/commit/d64639b1a50d2d292235aff8f727ca11fe9e43a6), [`e9055c1`](https://github.com/UsefulSoftwareCo/executor/commit/e9055c13bf73bc1860c8eded542fe566b51c3784), [`1f67d83`](https://github.com/UsefulSoftwareCo/executor/commit/1f67d83609b13a73d3dc8d630f48c8f54a02e6ca), [`905e097`](https://github.com/UsefulSoftwareCo/executor/commit/905e0972614aed5a3bb279b51dc060f87f892d75), [`cc0fd8f`](https://github.com/UsefulSoftwareCo/executor/commit/cc0fd8f6099f3d05c73a285ef14932c01ac212fa), [`85cf428`](https://github.com/UsefulSoftwareCo/executor/commit/85cf428905bbd73257fb3c3be5c89e762bf79377), [`38a7725`](https://github.com/UsefulSoftwareCo/executor/commit/38a7725876bcc9c8adeea9c7efbd190c121d3b86), [`3fd28a5`](https://github.com/UsefulSoftwareCo/executor/commit/3fd28a51fabb0fc96d0bf83408021e7cbca70bfe), [`3fd28a5`](https://github.com/UsefulSoftwareCo/executor/commit/3fd28a51fabb0fc96d0bf83408021e7cbca70bfe), [`929b233`](https://github.com/UsefulSoftwareCo/executor/commit/929b2338f225b3f80190ac7a6fe1f2473650c58c)]:
+ - @executor-js/api@1.4.72
+ - @executor-js/execution@1.6.9
+ - @executor-js/sdk@1.6.9
+ - @executor-js/plugin-mcp@1.6.9
+ - @executor-js/react@1.4.72
+ - @executor-js/plugin-openapi@1.6.9
+ - @executor-js/plugin-graphql@1.6.9
+ - @executor-js/plugin-toolkits@1.5.44
+ - @executor-js/analytics@0.1.16
+ - @executor-js/host-mcp@1.4.4
+ - @executor-js/mcp-apps-shell@1.4.20
+ - @executor-js/app@1.4.4
+ - @executor-js/plugin-encrypted-secrets@0.0.51
+ - @executor-js/plugin-provider-service-split@0.0.23
+ - @executor-js/runtime-quickjs@1.6.9
+
## 0.0.50
### Patch Changes
diff --git a/apps/host-selfhost/package.json b/apps/host-selfhost/package.json
index 9d4da00172..d91eaae8bf 100644
--- a/apps/host-selfhost/package.json
+++ b/apps/host-selfhost/package.json
@@ -1,6 +1,6 @@
{
"name": "@executor-js/host-selfhost",
- "version": "0.0.50",
+ "version": "0.0.51",
"private": true,
"type": "module",
"exports": {
diff --git a/apps/local/CHANGELOG.md b/apps/local/CHANGELOG.md
index ffcb425ada..a13966fc3a 100644
--- a/apps/local/CHANGELOG.md
+++ b/apps/local/CHANGELOG.md
@@ -1,5 +1,32 @@
# @executor-js/local
+## 1.6.9
+
+### Patch Changes
+
+- Updated dependencies [[`d873caf`](https://github.com/UsefulSoftwareCo/executor/commit/d873caf6fb3aa7408270b42aaad77f53cf9ec090), [`89b0f8d`](https://github.com/UsefulSoftwareCo/executor/commit/89b0f8d74cfb7d6a839bf08a267d892fb0cc676e), [`40b2f2e`](https://github.com/UsefulSoftwareCo/executor/commit/40b2f2e38d642843eb7c984c020117e0db52acfc), [`55a8b5e`](https://github.com/UsefulSoftwareCo/executor/commit/55a8b5eaea88c20fa5c5f1852262db613b8ddb9f), [`65d939e`](https://github.com/UsefulSoftwareCo/executor/commit/65d939ebab6f77a00a3435fe3575399cd1cd3b7f), [`0e9d800`](https://github.com/UsefulSoftwareCo/executor/commit/0e9d8004e2f1b35ce948b382bb97c58ebf177911), [`3c263d7`](https://github.com/UsefulSoftwareCo/executor/commit/3c263d7580d1d9302a1dc5d63f2fab253fd409c2), [`61f71c5`](https://github.com/UsefulSoftwareCo/executor/commit/61f71c56fe799b6e0faa2b2f82a91f631bc6a979), [`a6cdcf1`](https://github.com/UsefulSoftwareCo/executor/commit/a6cdcf1ccfae22e7d3378908c095e5c847c70f90), [`be77521`](https://github.com/UsefulSoftwareCo/executor/commit/be775216cccddac6002b1f9442b3c8151e4f6063), [`f8cfa5f`](https://github.com/UsefulSoftwareCo/executor/commit/f8cfa5f5f475c6b9c14143663ed5861bec8f74af), [`d64639b`](https://github.com/UsefulSoftwareCo/executor/commit/d64639b1a50d2d292235aff8f727ca11fe9e43a6), [`e9055c1`](https://github.com/UsefulSoftwareCo/executor/commit/e9055c13bf73bc1860c8eded542fe566b51c3784), [`1f67d83`](https://github.com/UsefulSoftwareCo/executor/commit/1f67d83609b13a73d3dc8d630f48c8f54a02e6ca), [`905e097`](https://github.com/UsefulSoftwareCo/executor/commit/905e0972614aed5a3bb279b51dc060f87f892d75), [`cc0fd8f`](https://github.com/UsefulSoftwareCo/executor/commit/cc0fd8f6099f3d05c73a285ef14932c01ac212fa), [`85cf428`](https://github.com/UsefulSoftwareCo/executor/commit/85cf428905bbd73257fb3c3be5c89e762bf79377), [`38a7725`](https://github.com/UsefulSoftwareCo/executor/commit/38a7725876bcc9c8adeea9c7efbd190c121d3b86), [`3fd28a5`](https://github.com/UsefulSoftwareCo/executor/commit/3fd28a51fabb0fc96d0bf83408021e7cbca70bfe), [`3fd28a5`](https://github.com/UsefulSoftwareCo/executor/commit/3fd28a51fabb0fc96d0bf83408021e7cbca70bfe), [`929b233`](https://github.com/UsefulSoftwareCo/executor/commit/929b2338f225b3f80190ac7a6fe1f2473650c58c)]:
+ - @executor-js/api@1.4.72
+ - @executor-js/execution@1.6.9
+ - @executor-js/sdk@1.6.9
+ - @executor-js/plugin-mcp@1.6.9
+ - @executor-js/react@1.4.72
+ - @executor-js/plugin-openapi@1.6.9
+ - @executor-js/plugin-graphql@1.6.9
+ - @executor-js/plugin-onepassword@1.6.9
+ - @executor-js/plugin-toolkits@1.5.44
+ - @executor-js/analytics@0.1.16
+ - @executor-js/host-mcp@1.4.4
+ - @executor-js/mcp-apps-shell@1.4.20
+ - @executor-js/app@1.4.4
+ - @executor-js/config@1.6.9
+ - @executor-js/vite-plugin@0.0.69
+ - @executor-js/plugin-desktop-settings@1.6.9
+ - @executor-js/plugin-example@1.6.9
+ - @executor-js/plugin-file-secrets@1.6.9
+ - @executor-js/plugin-keychain@1.6.9
+ - @executor-js/plugin-provider-service-split@0.0.23
+ - @executor-js/runtime-quickjs@1.6.9
+
## 1.6.8
### Patch Changes
diff --git a/apps/local/package.json b/apps/local/package.json
index 79bebeef85..c1df3307be 100644
--- a/apps/local/package.json
+++ b/apps/local/package.json
@@ -1,6 +1,6 @@
{
"name": "@executor-js/local",
- "version": "1.6.8",
+ "version": "1.6.9",
"private": true,
"type": "module",
"exports": {
diff --git a/bun.lock b/bun.lock
index 52aac3adf6..02fa988dae 100644
--- a/bun.lock
+++ b/bun.lock
@@ -31,7 +31,7 @@
},
"apps/cli": {
"name": "executor",
- "version": "1.6.8",
+ "version": "1.6.9",
"bin": {
"executor": "./bin/executor.ts",
},
@@ -60,7 +60,7 @@
},
"apps/cloud": {
"name": "@executor-js/cloud",
- "version": "1.4.69",
+ "version": "1.4.70",
"dependencies": {
"@cloudflare/vite-plugin": "^1.31.1",
"@effect/atom-react": "catalog:",
@@ -133,7 +133,7 @@
},
"apps/desktop": {
"name": "@executor-js/desktop",
- "version": "1.6.8",
+ "version": "1.6.9",
"dependencies": {
"@sentry/bun": "^10.57.0",
"@sentry/electron": "7.19.0",
@@ -220,7 +220,7 @@
},
"apps/host-selfhost": {
"name": "@executor-js/host-selfhost",
- "version": "0.0.50",
+ "version": "0.0.51",
"dependencies": {
"@better-auth/api-key": "^1.6.11",
"@cloudflare/worker-bundler": "0.2.1",
@@ -273,7 +273,7 @@
},
"apps/local": {
"name": "@executor-js/local",
- "version": "1.6.8",
+ "version": "1.6.9",
"dependencies": {
"@effect/atom-react": "catalog:",
"@effect/platform-node": "catalog:",
@@ -353,7 +353,7 @@
},
"e2e": {
"name": "@executor-js/e2e",
- "version": "0.0.48",
+ "version": "0.0.49",
"dependencies": {
"@executor-js/api": "workspace:*",
"@executor-js/emulate": "^0.14.2",
@@ -388,7 +388,7 @@
},
"examples/all-plugins": {
"name": "@executor-js/example-all-plugins",
- "version": "0.0.69",
+ "version": "0.0.70",
"dependencies": {
"@executor-js/plugin-file-secrets": "workspace:*",
"@executor-js/plugin-graphql": "workspace:*",
@@ -407,7 +407,7 @@
},
"examples/docs-sdk-quickstart": {
"name": "@executor-js/example-docs-sdk-quickstart",
- "version": "0.0.54",
+ "version": "0.0.55",
"dependencies": {
"@executor-js/plugin-openapi": "workspace:*",
"@executor-js/sdk": "workspace:*",
@@ -464,7 +464,7 @@
},
"packages/core/analytics": {
"name": "@executor-js/analytics",
- "version": "0.1.15",
+ "version": "0.1.16",
"dependencies": {
"@effect/platform-node": "catalog:",
"@executor-js/execution": "workspace:*",
@@ -480,7 +480,7 @@
},
"packages/core/api": {
"name": "@executor-js/api",
- "version": "1.4.71",
+ "version": "1.4.72",
"dependencies": {
"@executor-js/execution": "workspace:*",
"@executor-js/host-mcp": "workspace:*",
@@ -497,7 +497,7 @@
},
"packages/core/cli": {
"name": "@executor-js/cli",
- "version": "0.2.58",
+ "version": "0.2.59",
"bin": {
"executor-sdk": "./dist/index.js",
},
@@ -518,7 +518,7 @@
},
"packages/core/config": {
"name": "@executor-js/config",
- "version": "1.6.8",
+ "version": "1.6.9",
"dependencies": {
"@executor-js/sdk": "workspace:*",
"jiti": "^2.6.1",
@@ -539,7 +539,7 @@
},
"packages/core/execution": {
"name": "@executor-js/execution",
- "version": "1.6.8",
+ "version": "1.6.9",
"dependencies": {
"@executor-js/codemode-core": "workspace:*",
"@executor-js/sdk": "workspace:*",
@@ -605,7 +605,7 @@
},
"packages/core/sdk": {
"name": "@executor-js/sdk",
- "version": "1.6.8",
+ "version": "1.6.9",
"dependencies": {
"@executor-js/fumadb": "workspace:*",
"@standard-schema/spec": "^1.1.0",
@@ -658,7 +658,7 @@
},
"packages/core/vite-plugin": {
"name": "@executor-js/vite-plugin",
- "version": "0.0.68",
+ "version": "0.0.69",
"dependencies": {
"@executor-js/sdk": "workspace:*",
"jiti": "^2.6.1",
@@ -678,7 +678,7 @@
},
"packages/hosts/cloudflare": {
"name": "@executor-js/cloudflare",
- "version": "0.0.50",
+ "version": "0.0.51",
"dependencies": {
"@executor-js/api": "workspace:*",
"@executor-js/execution": "workspace:*",
@@ -719,7 +719,7 @@
},
"packages/hosts/mcp-apps-shell": {
"name": "@executor-js/mcp-apps-shell",
- "version": "1.4.19",
+ "version": "1.4.20",
"dependencies": {
"@executor-js/react": "workspace:*",
"@executor-js/runtime-quickjs": "workspace:*",
@@ -757,7 +757,7 @@
},
"packages/kernel/core": {
"name": "@executor-js/codemode-core",
- "version": "1.6.8",
+ "version": "1.6.9",
"dependencies": {
"@babel/parser": "^7.29.2",
"@standard-schema/spec": "^1.0.0",
@@ -830,7 +830,7 @@
},
"packages/kernel/runtime-quickjs": {
"name": "@executor-js/runtime-quickjs",
- "version": "1.6.8",
+ "version": "1.6.9",
"dependencies": {
"@executor-js/codemode-core": "workspace:*",
"quickjs-emscripten": "catalog:",
@@ -850,7 +850,7 @@
},
"packages/kernel/runtime-workerd-subprocess": {
"name": "@executor-js/runtime-workerd-subprocess",
- "version": "0.0.23",
+ "version": "0.0.24",
"dependencies": {
"@executor-js/codemode-core": "workspace:*",
"effect": "catalog:",
@@ -865,7 +865,7 @@
},
"packages/onboarding-demo": {
"name": "@executor-js/onboarding-demo",
- "version": "0.0.3",
+ "version": "0.0.4",
"dependencies": {
"@executor-js/plugin-mcp": "workspace:*",
"@executor-js/plugin-openapi": "workspace:*",
@@ -889,7 +889,7 @@
},
"packages/plugins/desktop-settings": {
"name": "@executor-js/plugin-desktop-settings",
- "version": "1.6.8",
+ "version": "1.6.9",
"dependencies": {
"@executor-js/sdk": "workspace:*",
"react": "catalog:",
@@ -902,7 +902,7 @@
},
"packages/plugins/encrypted-secrets": {
"name": "@executor-js/plugin-encrypted-secrets",
- "version": "0.0.50",
+ "version": "0.0.51",
"dependencies": {
"@executor-js/sdk": "workspace:*",
"effect": "catalog:",
@@ -917,7 +917,7 @@
},
"packages/plugins/example": {
"name": "@executor-js/plugin-example",
- "version": "1.6.8",
+ "version": "1.6.9",
"dependencies": {
"@executor-js/sdk": "workspace:*",
},
@@ -940,7 +940,7 @@
},
"packages/plugins/file-secrets": {
"name": "@executor-js/plugin-file-secrets",
- "version": "1.6.8",
+ "version": "1.6.9",
"dependencies": {
"@executor-js/sdk": "workspace:*",
},
@@ -957,7 +957,7 @@
},
"packages/plugins/graphql": {
"name": "@executor-js/plugin-graphql",
- "version": "1.6.8",
+ "version": "1.6.9",
"dependencies": {
"@effect/platform-node": "catalog:",
"@executor-js/config": "workspace:*",
@@ -996,7 +996,7 @@
},
"packages/plugins/keychain": {
"name": "@executor-js/plugin-keychain",
- "version": "1.6.8",
+ "version": "1.6.9",
"dependencies": {
"@executor-js/sdk": "workspace:*",
"@napi-rs/keyring": "^1.2.0",
@@ -1015,7 +1015,7 @@
},
"packages/plugins/mcp": {
"name": "@executor-js/plugin-mcp",
- "version": "1.6.8",
+ "version": "1.6.9",
"dependencies": {
"@cfworker/json-schema": "^4.1.1",
"@effect/platform-node": "catalog:",
@@ -1059,7 +1059,7 @@
},
"packages/plugins/onepassword": {
"name": "@executor-js/plugin-onepassword",
- "version": "1.6.8",
+ "version": "1.6.9",
"dependencies": {
"@1password/sdk": "^0.4.1-beta.1",
"@effect/atom-react": "catalog:",
@@ -1092,7 +1092,7 @@
},
"packages/plugins/openapi": {
"name": "@executor-js/plugin-openapi",
- "version": "1.6.8",
+ "version": "1.6.9",
"dependencies": {
"@effect/platform-node": "catalog:",
"@executor-js/config": "workspace:*",
@@ -1133,7 +1133,7 @@
},
"packages/plugins/provider-service-split": {
"name": "@executor-js/plugin-provider-service-split",
- "version": "0.0.22",
+ "version": "0.0.23",
"dependencies": {
"@executor-js/plugin-openapi": "workspace:*",
"@executor-js/sdk": "workspace:*",
@@ -1150,7 +1150,7 @@
},
"packages/plugins/toolkits": {
"name": "@executor-js/plugin-toolkits",
- "version": "1.5.43",
+ "version": "1.5.44",
"dependencies": {
"@executor-js/sdk": "workspace:*",
},
@@ -1219,7 +1219,7 @@
},
"packages/react": {
"name": "@executor-js/react",
- "version": "1.4.71",
+ "version": "1.4.72",
"dependencies": {
"@base-ui/react": "^1.3.0",
"@effect/atom-react": "catalog:",
diff --git a/e2e/CHANGELOG.md b/e2e/CHANGELOG.md
index 3050deeac5..625d796924 100644
--- a/e2e/CHANGELOG.md
+++ b/e2e/CHANGELOG.md
@@ -1,5 +1,17 @@
# @executor-js/e2e
+## 0.0.49
+
+### Patch Changes
+
+- Updated dependencies [[`d873caf`](https://github.com/UsefulSoftwareCo/executor/commit/d873caf6fb3aa7408270b42aaad77f53cf9ec090), [`40b2f2e`](https://github.com/UsefulSoftwareCo/executor/commit/40b2f2e38d642843eb7c984c020117e0db52acfc), [`55a8b5e`](https://github.com/UsefulSoftwareCo/executor/commit/55a8b5eaea88c20fa5c5f1852262db613b8ddb9f), [`65d939e`](https://github.com/UsefulSoftwareCo/executor/commit/65d939ebab6f77a00a3435fe3575399cd1cd3b7f), [`0e9d800`](https://github.com/UsefulSoftwareCo/executor/commit/0e9d8004e2f1b35ce948b382bb97c58ebf177911), [`3c263d7`](https://github.com/UsefulSoftwareCo/executor/commit/3c263d7580d1d9302a1dc5d63f2fab253fd409c2), [`61f71c5`](https://github.com/UsefulSoftwareCo/executor/commit/61f71c56fe799b6e0faa2b2f82a91f631bc6a979), [`a6cdcf1`](https://github.com/UsefulSoftwareCo/executor/commit/a6cdcf1ccfae22e7d3378908c095e5c847c70f90), [`be77521`](https://github.com/UsefulSoftwareCo/executor/commit/be775216cccddac6002b1f9442b3c8151e4f6063), [`f8cfa5f`](https://github.com/UsefulSoftwareCo/executor/commit/f8cfa5f5f475c6b9c14143663ed5861bec8f74af), [`d64639b`](https://github.com/UsefulSoftwareCo/executor/commit/d64639b1a50d2d292235aff8f727ca11fe9e43a6), [`e9055c1`](https://github.com/UsefulSoftwareCo/executor/commit/e9055c13bf73bc1860c8eded542fe566b51c3784), [`1f67d83`](https://github.com/UsefulSoftwareCo/executor/commit/1f67d83609b13a73d3dc8d630f48c8f54a02e6ca), [`cc0fd8f`](https://github.com/UsefulSoftwareCo/executor/commit/cc0fd8f6099f3d05c73a285ef14932c01ac212fa), [`85cf428`](https://github.com/UsefulSoftwareCo/executor/commit/85cf428905bbd73257fb3c3be5c89e762bf79377), [`38a7725`](https://github.com/UsefulSoftwareCo/executor/commit/38a7725876bcc9c8adeea9c7efbd190c121d3b86), [`3fd28a5`](https://github.com/UsefulSoftwareCo/executor/commit/3fd28a51fabb0fc96d0bf83408021e7cbca70bfe), [`3fd28a5`](https://github.com/UsefulSoftwareCo/executor/commit/3fd28a51fabb0fc96d0bf83408021e7cbca70bfe), [`929b233`](https://github.com/UsefulSoftwareCo/executor/commit/929b2338f225b3f80190ac7a6fe1f2473650c58c)]:
+ - @executor-js/api@1.4.72
+ - @executor-js/sdk@1.6.9
+ - @executor-js/plugin-mcp@1.6.9
+ - @executor-js/plugin-openapi@1.6.9
+ - @executor-js/plugin-graphql@1.6.9
+ - @executor-js/plugin-toolkits@1.5.44
+
## 0.0.48
### Patch Changes
diff --git a/e2e/package.json b/e2e/package.json
index d605fedf77..2671745d08 100644
--- a/e2e/package.json
+++ b/e2e/package.json
@@ -1,6 +1,6 @@
{
"name": "@executor-js/e2e",
- "version": "0.0.48",
+ "version": "0.0.49",
"private": true,
"type": "module",
"scripts": {
diff --git a/examples/all-plugins/CHANGELOG.md b/examples/all-plugins/CHANGELOG.md
index ea34eec8bb..e980998560 100644
--- a/examples/all-plugins/CHANGELOG.md
+++ b/examples/all-plugins/CHANGELOG.md
@@ -1,5 +1,19 @@
# @executor-js/example-all-plugins
+## 0.0.70
+
+### Patch Changes
+
+- Updated dependencies [[`40b2f2e`](https://github.com/UsefulSoftwareCo/executor/commit/40b2f2e38d642843eb7c984c020117e0db52acfc), [`55a8b5e`](https://github.com/UsefulSoftwareCo/executor/commit/55a8b5eaea88c20fa5c5f1852262db613b8ddb9f), [`65d939e`](https://github.com/UsefulSoftwareCo/executor/commit/65d939ebab6f77a00a3435fe3575399cd1cd3b7f), [`0e9d800`](https://github.com/UsefulSoftwareCo/executor/commit/0e9d8004e2f1b35ce948b382bb97c58ebf177911), [`3c263d7`](https://github.com/UsefulSoftwareCo/executor/commit/3c263d7580d1d9302a1dc5d63f2fab253fd409c2), [`be77521`](https://github.com/UsefulSoftwareCo/executor/commit/be775216cccddac6002b1f9442b3c8151e4f6063), [`d64639b`](https://github.com/UsefulSoftwareCo/executor/commit/d64639b1a50d2d292235aff8f727ca11fe9e43a6), [`e9055c1`](https://github.com/UsefulSoftwareCo/executor/commit/e9055c13bf73bc1860c8eded542fe566b51c3784), [`1f67d83`](https://github.com/UsefulSoftwareCo/executor/commit/1f67d83609b13a73d3dc8d630f48c8f54a02e6ca), [`cc0fd8f`](https://github.com/UsefulSoftwareCo/executor/commit/cc0fd8f6099f3d05c73a285ef14932c01ac212fa), [`85cf428`](https://github.com/UsefulSoftwareCo/executor/commit/85cf428905bbd73257fb3c3be5c89e762bf79377), [`38a7725`](https://github.com/UsefulSoftwareCo/executor/commit/38a7725876bcc9c8adeea9c7efbd190c121d3b86), [`3fd28a5`](https://github.com/UsefulSoftwareCo/executor/commit/3fd28a51fabb0fc96d0bf83408021e7cbca70bfe), [`3fd28a5`](https://github.com/UsefulSoftwareCo/executor/commit/3fd28a51fabb0fc96d0bf83408021e7cbca70bfe), [`929b233`](https://github.com/UsefulSoftwareCo/executor/commit/929b2338f225b3f80190ac7a6fe1f2473650c58c)]:
+ - @executor-js/sdk@1.6.9
+ - @executor-js/plugin-mcp@1.6.9
+ - @executor-js/plugin-openapi@1.6.9
+ - @executor-js/plugin-graphql@1.6.9
+ - @executor-js/plugin-onepassword@1.6.9
+ - @executor-js/plugin-file-secrets@1.6.9
+ - @executor-js/plugin-keychain@1.6.9
+ - @executor-js/plugin-workos-vault@0.0.2
+
## 0.0.69
### Patch Changes
diff --git a/examples/all-plugins/package.json b/examples/all-plugins/package.json
index 5fbf3eda2b..4022ceddd2 100644
--- a/examples/all-plugins/package.json
+++ b/examples/all-plugins/package.json
@@ -1,6 +1,6 @@
{
"name": "@executor-js/example-all-plugins",
- "version": "0.0.69",
+ "version": "0.0.70",
"private": true,
"type": "module",
"scripts": {
diff --git a/examples/docs-sdk-quickstart/CHANGELOG.md b/examples/docs-sdk-quickstart/CHANGELOG.md
index 25d71bbeb5..058f39683f 100644
--- a/examples/docs-sdk-quickstart/CHANGELOG.md
+++ b/examples/docs-sdk-quickstart/CHANGELOG.md
@@ -1,5 +1,13 @@
# @executor-js/example-docs-sdk-quickstart
+## 0.0.55
+
+### Patch Changes
+
+- Updated dependencies [[`40b2f2e`](https://github.com/UsefulSoftwareCo/executor/commit/40b2f2e38d642843eb7c984c020117e0db52acfc), [`55a8b5e`](https://github.com/UsefulSoftwareCo/executor/commit/55a8b5eaea88c20fa5c5f1852262db613b8ddb9f), [`65d939e`](https://github.com/UsefulSoftwareCo/executor/commit/65d939ebab6f77a00a3435fe3575399cd1cd3b7f), [`3c263d7`](https://github.com/UsefulSoftwareCo/executor/commit/3c263d7580d1d9302a1dc5d63f2fab253fd409c2), [`be77521`](https://github.com/UsefulSoftwareCo/executor/commit/be775216cccddac6002b1f9442b3c8151e4f6063), [`d64639b`](https://github.com/UsefulSoftwareCo/executor/commit/d64639b1a50d2d292235aff8f727ca11fe9e43a6), [`e9055c1`](https://github.com/UsefulSoftwareCo/executor/commit/e9055c13bf73bc1860c8eded542fe566b51c3784), [`1f67d83`](https://github.com/UsefulSoftwareCo/executor/commit/1f67d83609b13a73d3dc8d630f48c8f54a02e6ca), [`cc0fd8f`](https://github.com/UsefulSoftwareCo/executor/commit/cc0fd8f6099f3d05c73a285ef14932c01ac212fa), [`85cf428`](https://github.com/UsefulSoftwareCo/executor/commit/85cf428905bbd73257fb3c3be5c89e762bf79377), [`38a7725`](https://github.com/UsefulSoftwareCo/executor/commit/38a7725876bcc9c8adeea9c7efbd190c121d3b86), [`3fd28a5`](https://github.com/UsefulSoftwareCo/executor/commit/3fd28a51fabb0fc96d0bf83408021e7cbca70bfe), [`3fd28a5`](https://github.com/UsefulSoftwareCo/executor/commit/3fd28a51fabb0fc96d0bf83408021e7cbca70bfe), [`929b233`](https://github.com/UsefulSoftwareCo/executor/commit/929b2338f225b3f80190ac7a6fe1f2473650c58c)]:
+ - @executor-js/sdk@1.6.9
+ - @executor-js/plugin-openapi@1.6.9
+
## 0.0.54
### Patch Changes
diff --git a/examples/docs-sdk-quickstart/package.json b/examples/docs-sdk-quickstart/package.json
index 60147d100c..da8f8f480d 100644
--- a/examples/docs-sdk-quickstart/package.json
+++ b/examples/docs-sdk-quickstart/package.json
@@ -1,6 +1,6 @@
{
"name": "@executor-js/example-docs-sdk-quickstart",
- "version": "0.0.54",
+ "version": "0.0.55",
"private": true,
"type": "module",
"scripts": {
diff --git a/packages/core/analytics/CHANGELOG.md b/packages/core/analytics/CHANGELOG.md
index a1344d6a94..4827f67b1f 100644
--- a/packages/core/analytics/CHANGELOG.md
+++ b/packages/core/analytics/CHANGELOG.md
@@ -1,5 +1,12 @@
# @executor-js/analytics
+## 0.1.16
+
+### Patch Changes
+
+- Updated dependencies [[`89b0f8d`](https://github.com/UsefulSoftwareCo/executor/commit/89b0f8d74cfb7d6a839bf08a267d892fb0cc676e), [`40b2f2e`](https://github.com/UsefulSoftwareCo/executor/commit/40b2f2e38d642843eb7c984c020117e0db52acfc), [`3c263d7`](https://github.com/UsefulSoftwareCo/executor/commit/3c263d7580d1d9302a1dc5d63f2fab253fd409c2)]:
+ - @executor-js/execution@1.6.9
+
## 0.1.15
### Patch Changes
diff --git a/packages/core/analytics/package.json b/packages/core/analytics/package.json
index ce2ba75668..9b8baf18eb 100644
--- a/packages/core/analytics/package.json
+++ b/packages/core/analytics/package.json
@@ -1,6 +1,6 @@
{
"name": "@executor-js/analytics",
- "version": "0.1.15",
+ "version": "0.1.16",
"private": true,
"homepage": "https://github.com/UsefulSoftwareCo/executor/tree/main/packages/core/analytics",
"bugs": {
diff --git a/packages/core/api/CHANGELOG.md b/packages/core/api/CHANGELOG.md
index 15730394d3..7910d9a3cf 100644
--- a/packages/core/api/CHANGELOG.md
+++ b/packages/core/api/CHANGELOG.md
@@ -1,5 +1,43 @@
# @executor-js/api
+## 1.4.72
+
+### Patch Changes
+
+- [#1974](https://github.com/UsefulSoftwareCo/executor/pull/1974) [`d873caf`](https://github.com/UsefulSoftwareCo/executor/commit/d873caf6fb3aa7408270b42aaad77f53cf9ec090) Thanks [@baggiiiie](https://github.com/baggiiiie)! - Advertise refresh-token support in OAuth client ID metadata documents.
+
+ OAuth providers may reject the `offline_access` scope when the client's
+ metadata declares only the authorization-code grant. Hosted and local client
+ metadata now declare both `authorization_code` and `refresh_token`, matching
+ Executor's dynamic client registration behavior.
+
+- [#1976](https://github.com/UsefulSoftwareCo/executor/pull/1976) [`40b2f2e`](https://github.com/UsefulSoftwareCo/executor/commit/40b2f2e38d642843eb7c984c020117e0db52acfc) Thanks [@SunkenInTime](https://github.com/SunkenInTime)! - Carry an approval's persistence choice through elicitation, so Codex Computer Use stops asking to use the same app on every call.
+
+ Computer Use offers `persist: ["session", "always"]` in the prompt's terms and remembers the app only when the answer names one. Executor dropped the offer on the way in (the terms projection kept strings only) and the choice on the way out (every adapter rebuilt the reply from `action` and `content`), so each accept was one-time. `ElicitationResponse` now has `meta.persist`; the MCP plugin, the app-server bridge, and the MCP host pass it through; the model-mode `resume` tool and the browser approval page let the approver pick from the offered scopes. Nothing is chosen automatically: a bare accept still approves once.
+
+- [#1971](https://github.com/UsefulSoftwareCo/executor/pull/1971) [`61f71c5`](https://github.com/UsefulSoftwareCo/executor/commit/61f71c56fe799b6e0faa2b2f82a91f631bc6a979) Thanks [@Adityakk9031](https://github.com/Adityakk9031)! - Shut down scoped executors and tool subprocess resources upon MCP session eviction and disposal in the in-process session store.
+
+- [#2026](https://github.com/UsefulSoftwareCo/executor/pull/2026) [`a6cdcf1`](https://github.com/UsefulSoftwareCo/executor/commit/a6cdcf1ccfae22e7d3378908c095e5c847c70f90) Thanks [@RhysSullivan](https://github.com/RhysSullivan)! - Cloud now authorizes every protected request against the local membership mirror through the shared `MemberDirectory` seam: the per-request org membership check, the admin gates on the account and admin planes, the org switcher's organization list, and the free-organization limit all read the mirror instead of calling WorkOS. WorkOS is now a write target and an event source only. The seam gains `membershipsOf(accountId)` and `membershipById(organizationId, membershipId)` on both hosts.
+
+ The mirror is trusted only while it is **ready**: the backfill has written every organization and the Events reconciler has drained the stream within the last ten minutes (both recorded on the `workos_sync` row). Until then the membership check falls back to WorkOS, exactly as before, so a member the backfill has not written yet is not locked out and a member revoked while the reconciler was down is not let in. The deploy runs `scripts/ensure-workos-mirror-ready.ts` after the migrations: it runs the backfill if needed, drains the events stream itself if the reconciler has not recently (so the gate never waits on a cron this same deploy ships), and fails the deploy if the mirror is still not ready. An organization the mirror does not hold at all (one that predates the mirror and nobody has signed in to since) is resolved from WorkOS on demand for a caller WorkOS confirms as its member, so CLI and MCP tokens naming such an organization are not refused. Deleting an organization now cancels billing before deleting the WorkOS organization, and a retry after a partial deletion is admitted from the mirror even while the mirror is not ready.
+
+ **Ops step (cloud):** add the `WORKOS_API_KEY` secret to the `production` GitHub environment so the deploy gate can run the backfill.
+
+- [#2025](https://github.com/UsefulSoftwareCo/executor/pull/2025) [`be77521`](https://github.com/UsefulSoftwareCo/executor/commit/be775216cccddac6002b1f9442b3c8151e4f6063) Thanks [@RhysSullivan](https://github.com/RhysSullivan)! - Member lists, the admin users page, and seat counts on cloud now read from the local membership mirror through the shared `MemberDirectory` seam instead of fanning out one WorkOS read per member. The admin users page gains an email/name search.
+
+ **Deploy prerequisite (cloud):** `bun run --cwd apps/cloud db:backfill-workos-mirror:prod` must complete before this build is deployed, and its printed membership count should match WorkOS. Until the backfill has stamped the mirror's marker, seat reporting to Autumn is skipped with a warning (never a partial count) and member lists show only members who have signed in since the mirror shipped.
+
+- [#2028](https://github.com/UsefulSoftwareCo/executor/pull/2028) [`f8cfa5f`](https://github.com/UsefulSoftwareCo/executor/commit/f8cfa5f5f475c6b9c14143663ed5861bec8f74af) Thanks [@RhysSullivan](https://github.com/RhysSullivan)! - Keep request resources alive until background OAuth tool discovery finishes, so slow cloud connections can publish their tools after the callback returns.
+
+- [#2000](https://github.com/UsefulSoftwareCo/executor/pull/2000) [`3fd28a5`](https://github.com/UsefulSoftwareCo/executor/commit/3fd28a51fabb0fc96d0bf83408021e7cbca70bfe) Thanks [@RhysSullivan](https://github.com/RhysSullivan)! - Redact redirect, referrer, trace-state, and MCP session headers from outbound HTTP traces.
+
+ Allow hosts to require HTTPS for outbound requests and reject redirects to plaintext endpoints. Executor Cloud enables this policy. Explicit private-network development access remains available.
+
+- Updated dependencies [[`89b0f8d`](https://github.com/UsefulSoftwareCo/executor/commit/89b0f8d74cfb7d6a839bf08a267d892fb0cc676e), [`40b2f2e`](https://github.com/UsefulSoftwareCo/executor/commit/40b2f2e38d642843eb7c984c020117e0db52acfc), [`65d939e`](https://github.com/UsefulSoftwareCo/executor/commit/65d939ebab6f77a00a3435fe3575399cd1cd3b7f), [`3c263d7`](https://github.com/UsefulSoftwareCo/executor/commit/3c263d7580d1d9302a1dc5d63f2fab253fd409c2), [`be77521`](https://github.com/UsefulSoftwareCo/executor/commit/be775216cccddac6002b1f9442b3c8151e4f6063), [`cc0fd8f`](https://github.com/UsefulSoftwareCo/executor/commit/cc0fd8f6099f3d05c73a285ef14932c01ac212fa), [`85cf428`](https://github.com/UsefulSoftwareCo/executor/commit/85cf428905bbd73257fb3c3be5c89e762bf79377), [`38a7725`](https://github.com/UsefulSoftwareCo/executor/commit/38a7725876bcc9c8adeea9c7efbd190c121d3b86), [`3fd28a5`](https://github.com/UsefulSoftwareCo/executor/commit/3fd28a51fabb0fc96d0bf83408021e7cbca70bfe), [`929b233`](https://github.com/UsefulSoftwareCo/executor/commit/929b2338f225b3f80190ac7a6fe1f2473650c58c)]:
+ - @executor-js/execution@1.6.9
+ - @executor-js/sdk@1.6.9
+ - @executor-js/host-mcp@1.4.4
+
## 1.4.71
### Patch Changes
diff --git a/packages/core/api/package.json b/packages/core/api/package.json
index ae47232599..8205bb886e 100644
--- a/packages/core/api/package.json
+++ b/packages/core/api/package.json
@@ -1,6 +1,6 @@
{
"name": "@executor-js/api",
- "version": "1.4.71",
+ "version": "1.4.72",
"private": true,
"type": "module",
"exports": {
diff --git a/packages/core/cli/CHANGELOG.md b/packages/core/cli/CHANGELOG.md
index d16e731974..adb1299ba0 100644
--- a/packages/core/cli/CHANGELOG.md
+++ b/packages/core/cli/CHANGELOG.md
@@ -1,5 +1,12 @@
# @executor-js/cli
+## 0.2.59
+
+### Patch Changes
+
+- Updated dependencies [[`40b2f2e`](https://github.com/UsefulSoftwareCo/executor/commit/40b2f2e38d642843eb7c984c020117e0db52acfc), [`65d939e`](https://github.com/UsefulSoftwareCo/executor/commit/65d939ebab6f77a00a3435fe3575399cd1cd3b7f), [`3c263d7`](https://github.com/UsefulSoftwareCo/executor/commit/3c263d7580d1d9302a1dc5d63f2fab253fd409c2), [`be77521`](https://github.com/UsefulSoftwareCo/executor/commit/be775216cccddac6002b1f9442b3c8151e4f6063), [`cc0fd8f`](https://github.com/UsefulSoftwareCo/executor/commit/cc0fd8f6099f3d05c73a285ef14932c01ac212fa), [`85cf428`](https://github.com/UsefulSoftwareCo/executor/commit/85cf428905bbd73257fb3c3be5c89e762bf79377), [`38a7725`](https://github.com/UsefulSoftwareCo/executor/commit/38a7725876bcc9c8adeea9c7efbd190c121d3b86), [`3fd28a5`](https://github.com/UsefulSoftwareCo/executor/commit/3fd28a51fabb0fc96d0bf83408021e7cbca70bfe), [`929b233`](https://github.com/UsefulSoftwareCo/executor/commit/929b2338f225b3f80190ac7a6fe1f2473650c58c)]:
+ - @executor-js/sdk@1.6.9
+
## 0.2.58
### Patch Changes
diff --git a/packages/core/cli/package.json b/packages/core/cli/package.json
index a93dbad7db..f5477f210b 100644
--- a/packages/core/cli/package.json
+++ b/packages/core/cli/package.json
@@ -1,6 +1,6 @@
{
"name": "@executor-js/cli",
- "version": "0.2.58",
+ "version": "0.2.59",
"description": "CLI for the executor SDK — schema generation, migrations",
"homepage": "https://github.com/UsefulSoftwareCo/executor/tree/main/packages/core/cli",
"bugs": {
diff --git a/packages/core/config/CHANGELOG.md b/packages/core/config/CHANGELOG.md
index 27183622f3..20701aaeb9 100644
--- a/packages/core/config/CHANGELOG.md
+++ b/packages/core/config/CHANGELOG.md
@@ -1,5 +1,12 @@
# @executor-js/config
+## 1.6.9
+
+### Patch Changes
+
+- Updated dependencies [[`40b2f2e`](https://github.com/UsefulSoftwareCo/executor/commit/40b2f2e38d642843eb7c984c020117e0db52acfc), [`65d939e`](https://github.com/UsefulSoftwareCo/executor/commit/65d939ebab6f77a00a3435fe3575399cd1cd3b7f), [`3c263d7`](https://github.com/UsefulSoftwareCo/executor/commit/3c263d7580d1d9302a1dc5d63f2fab253fd409c2), [`be77521`](https://github.com/UsefulSoftwareCo/executor/commit/be775216cccddac6002b1f9442b3c8151e4f6063), [`cc0fd8f`](https://github.com/UsefulSoftwareCo/executor/commit/cc0fd8f6099f3d05c73a285ef14932c01ac212fa), [`85cf428`](https://github.com/UsefulSoftwareCo/executor/commit/85cf428905bbd73257fb3c3be5c89e762bf79377), [`38a7725`](https://github.com/UsefulSoftwareCo/executor/commit/38a7725876bcc9c8adeea9c7efbd190c121d3b86), [`3fd28a5`](https://github.com/UsefulSoftwareCo/executor/commit/3fd28a51fabb0fc96d0bf83408021e7cbca70bfe), [`929b233`](https://github.com/UsefulSoftwareCo/executor/commit/929b2338f225b3f80190ac7a6fe1f2473650c58c)]:
+ - @executor-js/sdk@1.6.9
+
## 1.6.8
### Patch Changes
diff --git a/packages/core/config/package.json b/packages/core/config/package.json
index 76156bea13..dfd10bd38a 100644
--- a/packages/core/config/package.json
+++ b/packages/core/config/package.json
@@ -1,6 +1,6 @@
{
"name": "@executor-js/config",
- "version": "1.6.8",
+ "version": "1.6.9",
"homepage": "https://github.com/UsefulSoftwareCo/executor/tree/main/packages/core/config",
"bugs": {
"url": "https://github.com/UsefulSoftwareCo/executor/issues"
diff --git a/packages/core/execution/CHANGELOG.md b/packages/core/execution/CHANGELOG.md
index 2d48c42691..cbfa89cdb7 100644
--- a/packages/core/execution/CHANGELOG.md
+++ b/packages/core/execution/CHANGELOG.md
@@ -1,5 +1,21 @@
# @executor-js/execution
+## 1.6.9
+
+### Patch Changes
+
+- [#1964](https://github.com/UsefulSoftwareCo/executor/pull/1964) [`89b0f8d`](https://github.com/UsefulSoftwareCo/executor/commit/89b0f8d74cfb7d6a839bf08a267d892fb0cc676e) Thanks [@dhairyashiil](https://github.com/dhairyashiil)! - Completed MCP execute results now include `toolName` when a script successfully uses exactly one connected tool. Executions that use distinct tools remain unlabeled, and internal call provenance is not exposed in the MCP response.
+
+- [#1976](https://github.com/UsefulSoftwareCo/executor/pull/1976) [`40b2f2e`](https://github.com/UsefulSoftwareCo/executor/commit/40b2f2e38d642843eb7c984c020117e0db52acfc) Thanks [@SunkenInTime](https://github.com/SunkenInTime)! - Carry an approval's persistence choice through elicitation, so Codex Computer Use stops asking to use the same app on every call.
+
+ Computer Use offers `persist: ["session", "always"]` in the prompt's terms and remembers the app only when the answer names one. Executor dropped the offer on the way in (the terms projection kept strings only) and the choice on the way out (every adapter rebuilt the reply from `action` and `content`), so each accept was one-time. `ElicitationResponse` now has `meta.persist`; the MCP plugin, the app-server bridge, and the MCP host pass it through; the model-mode `resume` tool and the browser approval page let the approver pick from the offered scopes. Nothing is chosen automatically: a bare accept still approves once.
+
+- [#1942](https://github.com/UsefulSoftwareCo/executor/pull/1942) [`3c263d7`](https://github.com/UsefulSoftwareCo/executor/commit/3c263d7580d1d9302a1dc5d63f2fab253fd409c2) Thanks [@RhysSullivan](https://github.com/RhysSullivan)! - Add a search and invoke MCP mode (`?mode=passthrough`, `executor mcp --mode passthrough`). Search returns bounded pages of matching tool IDs and input schemas. Invoke validates arguments and runs the selected tool, with native client approval and workspace blocks enforced. The MCP catalog stays at two tools regardless of integration count.
+
+- Updated dependencies [[`40b2f2e`](https://github.com/UsefulSoftwareCo/executor/commit/40b2f2e38d642843eb7c984c020117e0db52acfc), [`65d939e`](https://github.com/UsefulSoftwareCo/executor/commit/65d939ebab6f77a00a3435fe3575399cd1cd3b7f), [`3c263d7`](https://github.com/UsefulSoftwareCo/executor/commit/3c263d7580d1d9302a1dc5d63f2fab253fd409c2), [`be77521`](https://github.com/UsefulSoftwareCo/executor/commit/be775216cccddac6002b1f9442b3c8151e4f6063), [`cc0fd8f`](https://github.com/UsefulSoftwareCo/executor/commit/cc0fd8f6099f3d05c73a285ef14932c01ac212fa), [`85cf428`](https://github.com/UsefulSoftwareCo/executor/commit/85cf428905bbd73257fb3c3be5c89e762bf79377), [`38a7725`](https://github.com/UsefulSoftwareCo/executor/commit/38a7725876bcc9c8adeea9c7efbd190c121d3b86), [`3fd28a5`](https://github.com/UsefulSoftwareCo/executor/commit/3fd28a51fabb0fc96d0bf83408021e7cbca70bfe), [`929b233`](https://github.com/UsefulSoftwareCo/executor/commit/929b2338f225b3f80190ac7a6fe1f2473650c58c)]:
+ - @executor-js/sdk@1.6.9
+ - @executor-js/codemode-core@1.6.9
+
## 1.6.8
### Patch Changes
diff --git a/packages/core/execution/package.json b/packages/core/execution/package.json
index c5c21f5e57..0891004b15 100644
--- a/packages/core/execution/package.json
+++ b/packages/core/execution/package.json
@@ -1,6 +1,6 @@
{
"name": "@executor-js/execution",
- "version": "1.6.8",
+ "version": "1.6.9",
"homepage": "https://github.com/UsefulSoftwareCo/executor/tree/main/packages/core/execution",
"bugs": {
"url": "https://github.com/UsefulSoftwareCo/executor/issues"
diff --git a/packages/core/sdk/CHANGELOG.md b/packages/core/sdk/CHANGELOG.md
index f8f07862de..4a1f1d2334 100644
--- a/packages/core/sdk/CHANGELOG.md
+++ b/packages/core/sdk/CHANGELOG.md
@@ -1,5 +1,33 @@
# @executor-js/sdk
+## 1.6.9
+
+### Patch Changes
+
+- [#1976](https://github.com/UsefulSoftwareCo/executor/pull/1976) [`40b2f2e`](https://github.com/UsefulSoftwareCo/executor/commit/40b2f2e38d642843eb7c984c020117e0db52acfc) Thanks [@SunkenInTime](https://github.com/SunkenInTime)! - Carry an approval's persistence choice through elicitation, so Codex Computer Use stops asking to use the same app on every call.
+
+ Computer Use offers `persist: ["session", "always"]` in the prompt's terms and remembers the app only when the answer names one. Executor dropped the offer on the way in (the terms projection kept strings only) and the choice on the way out (every adapter rebuilt the reply from `action` and `content`), so each accept was one-time. `ElicitationResponse` now has `meta.persist`; the MCP plugin, the app-server bridge, and the MCP host pass it through; the model-mode `resume` tool and the browser approval page let the approver pick from the offered scopes. Nothing is chosen automatically: a bare accept still approves once.
+
+- [#1898](https://github.com/UsefulSoftwareCo/executor/pull/1898) [`65d939e`](https://github.com/UsefulSoftwareCo/executor/commit/65d939ebab6f77a00a3435fe3575399cd1cd3b7f) Thanks [@LloydVickeryASI](https://github.com/LloydVickeryASI)! - Send HubSpot optional permissions in `optional_scope` for workspace OAuth clients so accounts can connect without optional product features.
+
+- [#1942](https://github.com/UsefulSoftwareCo/executor/pull/1942) [`3c263d7`](https://github.com/UsefulSoftwareCo/executor/commit/3c263d7580d1d9302a1dc5d63f2fab253fd409c2) Thanks [@RhysSullivan](https://github.com/RhysSullivan)! - Add a search and invoke MCP mode (`?mode=passthrough`, `executor mcp --mode passthrough`). Search returns bounded pages of matching tool IDs and input schemas. Invoke validates arguments and runs the selected tool, with native client approval and workspace blocks enforced. The MCP catalog stays at two tools regardless of integration count.
+
+- [#2025](https://github.com/UsefulSoftwareCo/executor/pull/2025) [`be77521`](https://github.com/UsefulSoftwareCo/executor/commit/be775216cccddac6002b1f9442b3c8151e4f6063) Thanks [@RhysSullivan](https://github.com/RhysSullivan)! - Member lists, the admin users page, and seat counts on cloud now read from the local membership mirror through the shared `MemberDirectory` seam instead of fanning out one WorkOS read per member. The admin users page gains an email/name search.
+
+ **Deploy prerequisite (cloud):** `bun run --cwd apps/cloud db:backfill-workos-mirror:prod` must complete before this build is deployed, and its printed membership count should match WorkOS. Until the backfill has stamped the mirror's marker, seat reporting to Autumn is skipped with a warning (never a partial count) and member lists show only members who have signed in since the mirror shipped.
+
+- [#1982](https://github.com/UsefulSoftwareCo/executor/pull/1982) [`cc0fd8f`](https://github.com/UsefulSoftwareCo/executor/commit/cc0fd8f6099f3d05c73a285ef14932c01ac212fa) Thanks [@mmarabel](https://github.com/mmarabel)! - Retry a refresh-token grant without `scope` when the authorization server refuses the echoed grant with `invalid_scope`. Railway answers a scope-bearing refresh with "refresh token missing requested scope" even though echoing the granted scope is legal under RFC 6749 §6, so a connection whose refresh token was still live failed every call as `oauth_refresh_failed` and only a hand re-authorization recovered it.
+
+- [#1991](https://github.com/UsefulSoftwareCo/executor/pull/1991) [`85cf428`](https://github.com/UsefulSoftwareCo/executor/commit/85cf428905bbd73257fb3c3be5c89e762bf79377) Thanks [@RhysSullivan](https://github.com/RhysSullivan)! - Removing an integration now drops every member's connections and tools under it, not only the remover's own. Tool and connection listings no longer serve rows whose integration is gone from the catalog, invoking such a tool reports the missing integration, and `oauth.start` refuses an unknown integration before creating a session.
+
+- [#2032](https://github.com/UsefulSoftwareCo/executor/pull/2032) [`38a7725`](https://github.com/UsefulSoftwareCo/executor/commit/38a7725876bcc9c8adeea9c7efbd190c121d3b86) Thanks [@SwedishChef1](https://github.com/SwedishChef1)! - Treat an explicit dynamic-client redirect URI as authoritative when selecting a reusable OAuth client. Legacy clients with no recorded redirect now remain available to existing connections while a new client is registered for the explicit callback; callers that rely on Executor's configured default retain the previous compatibility behavior.
+
+- [#2000](https://github.com/UsefulSoftwareCo/executor/pull/2000) [`3fd28a5`](https://github.com/UsefulSoftwareCo/executor/commit/3fd28a51fabb0fc96d0bf83408021e7cbca70bfe) Thanks [@RhysSullivan](https://github.com/RhysSullivan)! - Redact redirect, referrer, trace-state, and MCP session headers from outbound HTTP traces.
+
+ Allow hosts to require HTTPS for outbound requests and reject redirects to plaintext endpoints. Executor Cloud enables this policy. Explicit private-network development access remains available.
+
+- [#1951](https://github.com/UsefulSoftwareCo/executor/pull/1951) [`929b233`](https://github.com/UsefulSoftwareCo/executor/commit/929b2338f225b3f80190ac7a6fe1f2473650c58c) Thanks [@nidhi-singh02](https://github.com/nidhi-singh02)! - Keep Vercel MCP connections renewable by requesting the provider's `offline_access` lifecycle scope during registration and authorization.
+
## 1.6.8
### Patch Changes
diff --git a/packages/core/sdk/package.json b/packages/core/sdk/package.json
index 52f5ebced7..9412d9d4da 100644
--- a/packages/core/sdk/package.json
+++ b/packages/core/sdk/package.json
@@ -1,6 +1,6 @@
{
"name": "@executor-js/sdk",
- "version": "1.6.8",
+ "version": "1.6.9",
"homepage": "https://github.com/UsefulSoftwareCo/executor/tree/main/packages/core/sdk",
"bugs": {
"url": "https://github.com/UsefulSoftwareCo/executor/issues"
diff --git a/packages/core/vite-plugin/CHANGELOG.md b/packages/core/vite-plugin/CHANGELOG.md
index 7f0075f53a..ab73ab229f 100644
--- a/packages/core/vite-plugin/CHANGELOG.md
+++ b/packages/core/vite-plugin/CHANGELOG.md
@@ -1,5 +1,12 @@
# @executor-js/vite-plugin
+## 0.0.69
+
+### Patch Changes
+
+- Updated dependencies [[`40b2f2e`](https://github.com/UsefulSoftwareCo/executor/commit/40b2f2e38d642843eb7c984c020117e0db52acfc), [`65d939e`](https://github.com/UsefulSoftwareCo/executor/commit/65d939ebab6f77a00a3435fe3575399cd1cd3b7f), [`3c263d7`](https://github.com/UsefulSoftwareCo/executor/commit/3c263d7580d1d9302a1dc5d63f2fab253fd409c2), [`be77521`](https://github.com/UsefulSoftwareCo/executor/commit/be775216cccddac6002b1f9442b3c8151e4f6063), [`cc0fd8f`](https://github.com/UsefulSoftwareCo/executor/commit/cc0fd8f6099f3d05c73a285ef14932c01ac212fa), [`85cf428`](https://github.com/UsefulSoftwareCo/executor/commit/85cf428905bbd73257fb3c3be5c89e762bf79377), [`38a7725`](https://github.com/UsefulSoftwareCo/executor/commit/38a7725876bcc9c8adeea9c7efbd190c121d3b86), [`3fd28a5`](https://github.com/UsefulSoftwareCo/executor/commit/3fd28a51fabb0fc96d0bf83408021e7cbca70bfe), [`929b233`](https://github.com/UsefulSoftwareCo/executor/commit/929b2338f225b3f80190ac7a6fe1f2473650c58c)]:
+ - @executor-js/sdk@1.6.9
+
## 0.0.68
### Patch Changes
diff --git a/packages/core/vite-plugin/package.json b/packages/core/vite-plugin/package.json
index 626833e99f..8d013f6dd6 100644
--- a/packages/core/vite-plugin/package.json
+++ b/packages/core/vite-plugin/package.json
@@ -1,6 +1,6 @@
{
"name": "@executor-js/vite-plugin",
- "version": "0.0.68",
+ "version": "0.0.69",
"homepage": "https://github.com/UsefulSoftwareCo/executor/tree/main/packages/core/vite-plugin",
"bugs": {
"url": "https://github.com/UsefulSoftwareCo/executor/issues"
diff --git a/packages/hosts/cloudflare/CHANGELOG.md b/packages/hosts/cloudflare/CHANGELOG.md
index 7ebbda17f9..8d548affc0 100644
--- a/packages/hosts/cloudflare/CHANGELOG.md
+++ b/packages/hosts/cloudflare/CHANGELOG.md
@@ -1,5 +1,19 @@
# @executor-js/cloudflare
+## 0.0.51
+
+### Patch Changes
+
+- [#1976](https://github.com/UsefulSoftwareCo/executor/pull/1976) [`40b2f2e`](https://github.com/UsefulSoftwareCo/executor/commit/40b2f2e38d642843eb7c984c020117e0db52acfc) Thanks [@SunkenInTime](https://github.com/SunkenInTime)! - Carry an approval's persistence choice through elicitation, so Codex Computer Use stops asking to use the same app on every call.
+
+ Computer Use offers `persist: ["session", "always"]` in the prompt's terms and remembers the app only when the answer names one. Executor dropped the offer on the way in (the terms projection kept strings only) and the choice on the way out (every adapter rebuilt the reply from `action` and `content`), so each accept was one-time. `ElicitationResponse` now has `meta.persist`; the MCP plugin, the app-server bridge, and the MCP host pass it through; the model-mode `resume` tool and the browser approval page let the approver pick from the offered scopes. Nothing is chosen automatically: a bare accept still approves once.
+
+- Updated dependencies [[`d873caf`](https://github.com/UsefulSoftwareCo/executor/commit/d873caf6fb3aa7408270b42aaad77f53cf9ec090), [`89b0f8d`](https://github.com/UsefulSoftwareCo/executor/commit/89b0f8d74cfb7d6a839bf08a267d892fb0cc676e), [`40b2f2e`](https://github.com/UsefulSoftwareCo/executor/commit/40b2f2e38d642843eb7c984c020117e0db52acfc), [`65d939e`](https://github.com/UsefulSoftwareCo/executor/commit/65d939ebab6f77a00a3435fe3575399cd1cd3b7f), [`3c263d7`](https://github.com/UsefulSoftwareCo/executor/commit/3c263d7580d1d9302a1dc5d63f2fab253fd409c2), [`61f71c5`](https://github.com/UsefulSoftwareCo/executor/commit/61f71c56fe799b6e0faa2b2f82a91f631bc6a979), [`a6cdcf1`](https://github.com/UsefulSoftwareCo/executor/commit/a6cdcf1ccfae22e7d3378908c095e5c847c70f90), [`be77521`](https://github.com/UsefulSoftwareCo/executor/commit/be775216cccddac6002b1f9442b3c8151e4f6063), [`f8cfa5f`](https://github.com/UsefulSoftwareCo/executor/commit/f8cfa5f5f475c6b9c14143663ed5861bec8f74af), [`cc0fd8f`](https://github.com/UsefulSoftwareCo/executor/commit/cc0fd8f6099f3d05c73a285ef14932c01ac212fa), [`85cf428`](https://github.com/UsefulSoftwareCo/executor/commit/85cf428905bbd73257fb3c3be5c89e762bf79377), [`38a7725`](https://github.com/UsefulSoftwareCo/executor/commit/38a7725876bcc9c8adeea9c7efbd190c121d3b86), [`3fd28a5`](https://github.com/UsefulSoftwareCo/executor/commit/3fd28a51fabb0fc96d0bf83408021e7cbca70bfe), [`929b233`](https://github.com/UsefulSoftwareCo/executor/commit/929b2338f225b3f80190ac7a6fe1f2473650c58c)]:
+ - @executor-js/api@1.4.72
+ - @executor-js/execution@1.6.9
+ - @executor-js/sdk@1.6.9
+ - @executor-js/host-mcp@1.4.4
+
## 0.0.50
### Patch Changes
diff --git a/packages/hosts/cloudflare/package.json b/packages/hosts/cloudflare/package.json
index b5856dc12c..d18022c193 100644
--- a/packages/hosts/cloudflare/package.json
+++ b/packages/hosts/cloudflare/package.json
@@ -1,6 +1,6 @@
{
"name": "@executor-js/cloudflare",
- "version": "0.0.50",
+ "version": "0.0.51",
"private": true,
"type": "module",
"exports": {
diff --git a/packages/hosts/mcp-apps-shell/CHANGELOG.md b/packages/hosts/mcp-apps-shell/CHANGELOG.md
index 59690c13dc..4c7426080c 100644
--- a/packages/hosts/mcp-apps-shell/CHANGELOG.md
+++ b/packages/hosts/mcp-apps-shell/CHANGELOG.md
@@ -1,5 +1,13 @@
# @executor-js/mcp-apps-shell
+## 1.4.20
+
+### Patch Changes
+
+- Updated dependencies [[`40b2f2e`](https://github.com/UsefulSoftwareCo/executor/commit/40b2f2e38d642843eb7c984c020117e0db52acfc), [`be77521`](https://github.com/UsefulSoftwareCo/executor/commit/be775216cccddac6002b1f9442b3c8151e4f6063), [`1f67d83`](https://github.com/UsefulSoftwareCo/executor/commit/1f67d83609b13a73d3dc8d630f48c8f54a02e6ca), [`905e097`](https://github.com/UsefulSoftwareCo/executor/commit/905e0972614aed5a3bb279b51dc060f87f892d75)]:
+ - @executor-js/react@1.4.72
+ - @executor-js/runtime-quickjs@1.6.9
+
## 1.4.19
### Patch Changes
diff --git a/packages/hosts/mcp-apps-shell/package.json b/packages/hosts/mcp-apps-shell/package.json
index 8bc62bb65e..abd6616b7f 100644
--- a/packages/hosts/mcp-apps-shell/package.json
+++ b/packages/hosts/mcp-apps-shell/package.json
@@ -1,6 +1,6 @@
{
"name": "@executor-js/mcp-apps-shell",
- "version": "1.4.19",
+ "version": "1.4.20",
"private": true,
"type": "module",
"exports": {
diff --git a/packages/kernel/core/CHANGELOG.md b/packages/kernel/core/CHANGELOG.md
index 2db3b212cd..ff5850ac6a 100644
--- a/packages/kernel/core/CHANGELOG.md
+++ b/packages/kernel/core/CHANGELOG.md
@@ -1,5 +1,7 @@
# @executor-js/codemode-core
+## 1.6.9
+
## 1.6.8
## 1.6.7
diff --git a/packages/kernel/core/package.json b/packages/kernel/core/package.json
index f0d482a042..d2952db08a 100644
--- a/packages/kernel/core/package.json
+++ b/packages/kernel/core/package.json
@@ -1,6 +1,6 @@
{
"name": "@executor-js/codemode-core",
- "version": "1.6.8",
+ "version": "1.6.9",
"homepage": "https://github.com/UsefulSoftwareCo/executor/tree/main/packages/kernel/core",
"bugs": {
"url": "https://github.com/UsefulSoftwareCo/executor/issues"
diff --git a/packages/kernel/runtime-quickjs/CHANGELOG.md b/packages/kernel/runtime-quickjs/CHANGELOG.md
index d814456f7e..19a9cde4ea 100644
--- a/packages/kernel/runtime-quickjs/CHANGELOG.md
+++ b/packages/kernel/runtime-quickjs/CHANGELOG.md
@@ -1,5 +1,12 @@
# @executor-js/runtime-quickjs
+## 1.6.9
+
+### Patch Changes
+
+- Updated dependencies []:
+ - @executor-js/codemode-core@1.6.9
+
## 1.6.8
### Patch Changes
diff --git a/packages/kernel/runtime-quickjs/package.json b/packages/kernel/runtime-quickjs/package.json
index 44fa56433b..082895092f 100644
--- a/packages/kernel/runtime-quickjs/package.json
+++ b/packages/kernel/runtime-quickjs/package.json
@@ -1,6 +1,6 @@
{
"name": "@executor-js/runtime-quickjs",
- "version": "1.6.8",
+ "version": "1.6.9",
"homepage": "https://github.com/UsefulSoftwareCo/executor/tree/main/packages/kernel/runtime-quickjs",
"bugs": {
"url": "https://github.com/UsefulSoftwareCo/executor/issues"
diff --git a/packages/kernel/runtime-workerd-subprocess/CHANGELOG.md b/packages/kernel/runtime-workerd-subprocess/CHANGELOG.md
index 1a8afce102..0c0aa1bcab 100644
--- a/packages/kernel/runtime-workerd-subprocess/CHANGELOG.md
+++ b/packages/kernel/runtime-workerd-subprocess/CHANGELOG.md
@@ -1,5 +1,12 @@
# @executor-js/runtime-workerd-subprocess
+## 0.0.24
+
+### Patch Changes
+
+- Updated dependencies []:
+ - @executor-js/codemode-core@1.6.9
+
## 0.0.23
### Patch Changes
diff --git a/packages/kernel/runtime-workerd-subprocess/package.json b/packages/kernel/runtime-workerd-subprocess/package.json
index 28ef9ae214..cb98709333 100644
--- a/packages/kernel/runtime-workerd-subprocess/package.json
+++ b/packages/kernel/runtime-workerd-subprocess/package.json
@@ -1,6 +1,6 @@
{
"name": "@executor-js/runtime-workerd-subprocess",
- "version": "0.0.23",
+ "version": "0.0.24",
"private": true,
"type": "module",
"exports": {
diff --git a/packages/onboarding-demo/CHANGELOG.md b/packages/onboarding-demo/CHANGELOG.md
index e653ccd022..886ee25d63 100644
--- a/packages/onboarding-demo/CHANGELOG.md
+++ b/packages/onboarding-demo/CHANGELOG.md
@@ -1,5 +1,15 @@
# @executor-js/onboarding-demo
+## 0.0.4
+
+### Patch Changes
+
+- Updated dependencies [[`40b2f2e`](https://github.com/UsefulSoftwareCo/executor/commit/40b2f2e38d642843eb7c984c020117e0db52acfc), [`55a8b5e`](https://github.com/UsefulSoftwareCo/executor/commit/55a8b5eaea88c20fa5c5f1852262db613b8ddb9f), [`65d939e`](https://github.com/UsefulSoftwareCo/executor/commit/65d939ebab6f77a00a3435fe3575399cd1cd3b7f), [`0e9d800`](https://github.com/UsefulSoftwareCo/executor/commit/0e9d8004e2f1b35ce948b382bb97c58ebf177911), [`3c263d7`](https://github.com/UsefulSoftwareCo/executor/commit/3c263d7580d1d9302a1dc5d63f2fab253fd409c2), [`be77521`](https://github.com/UsefulSoftwareCo/executor/commit/be775216cccddac6002b1f9442b3c8151e4f6063), [`d64639b`](https://github.com/UsefulSoftwareCo/executor/commit/d64639b1a50d2d292235aff8f727ca11fe9e43a6), [`e9055c1`](https://github.com/UsefulSoftwareCo/executor/commit/e9055c13bf73bc1860c8eded542fe566b51c3784), [`1f67d83`](https://github.com/UsefulSoftwareCo/executor/commit/1f67d83609b13a73d3dc8d630f48c8f54a02e6ca), [`905e097`](https://github.com/UsefulSoftwareCo/executor/commit/905e0972614aed5a3bb279b51dc060f87f892d75), [`cc0fd8f`](https://github.com/UsefulSoftwareCo/executor/commit/cc0fd8f6099f3d05c73a285ef14932c01ac212fa), [`85cf428`](https://github.com/UsefulSoftwareCo/executor/commit/85cf428905bbd73257fb3c3be5c89e762bf79377), [`38a7725`](https://github.com/UsefulSoftwareCo/executor/commit/38a7725876bcc9c8adeea9c7efbd190c121d3b86), [`3fd28a5`](https://github.com/UsefulSoftwareCo/executor/commit/3fd28a51fabb0fc96d0bf83408021e7cbca70bfe), [`3fd28a5`](https://github.com/UsefulSoftwareCo/executor/commit/3fd28a51fabb0fc96d0bf83408021e7cbca70bfe), [`929b233`](https://github.com/UsefulSoftwareCo/executor/commit/929b2338f225b3f80190ac7a6fe1f2473650c58c)]:
+ - @executor-js/sdk@1.6.9
+ - @executor-js/plugin-mcp@1.6.9
+ - @executor-js/react@1.4.72
+ - @executor-js/plugin-openapi@1.6.9
+
## 0.0.3
### Patch Changes
diff --git a/packages/onboarding-demo/package.json b/packages/onboarding-demo/package.json
index 9656473764..5e6fbf4b00 100644
--- a/packages/onboarding-demo/package.json
+++ b/packages/onboarding-demo/package.json
@@ -1,6 +1,6 @@
{
"name": "@executor-js/onboarding-demo",
- "version": "0.0.3",
+ "version": "0.0.4",
"private": true,
"type": "module",
"scripts": {
diff --git a/packages/plugins/desktop-settings/CHANGELOG.md b/packages/plugins/desktop-settings/CHANGELOG.md
index 324508ab5d..38975d5802 100644
--- a/packages/plugins/desktop-settings/CHANGELOG.md
+++ b/packages/plugins/desktop-settings/CHANGELOG.md
@@ -1,5 +1,12 @@
# @executor-js/plugin-desktop-settings
+## 1.6.9
+
+### Patch Changes
+
+- Updated dependencies [[`40b2f2e`](https://github.com/UsefulSoftwareCo/executor/commit/40b2f2e38d642843eb7c984c020117e0db52acfc), [`65d939e`](https://github.com/UsefulSoftwareCo/executor/commit/65d939ebab6f77a00a3435fe3575399cd1cd3b7f), [`3c263d7`](https://github.com/UsefulSoftwareCo/executor/commit/3c263d7580d1d9302a1dc5d63f2fab253fd409c2), [`be77521`](https://github.com/UsefulSoftwareCo/executor/commit/be775216cccddac6002b1f9442b3c8151e4f6063), [`cc0fd8f`](https://github.com/UsefulSoftwareCo/executor/commit/cc0fd8f6099f3d05c73a285ef14932c01ac212fa), [`85cf428`](https://github.com/UsefulSoftwareCo/executor/commit/85cf428905bbd73257fb3c3be5c89e762bf79377), [`38a7725`](https://github.com/UsefulSoftwareCo/executor/commit/38a7725876bcc9c8adeea9c7efbd190c121d3b86), [`3fd28a5`](https://github.com/UsefulSoftwareCo/executor/commit/3fd28a51fabb0fc96d0bf83408021e7cbca70bfe), [`929b233`](https://github.com/UsefulSoftwareCo/executor/commit/929b2338f225b3f80190ac7a6fe1f2473650c58c)]:
+ - @executor-js/sdk@1.6.9
+
## 1.6.8
### Patch Changes
diff --git a/packages/plugins/desktop-settings/package.json b/packages/plugins/desktop-settings/package.json
index cb8af09f23..aba4e2a3f5 100644
--- a/packages/plugins/desktop-settings/package.json
+++ b/packages/plugins/desktop-settings/package.json
@@ -1,6 +1,6 @@
{
"name": "@executor-js/plugin-desktop-settings",
- "version": "1.6.8",
+ "version": "1.6.9",
"homepage": "https://github.com/UsefulSoftwareCo/executor/tree/main/packages/plugins/desktop-settings",
"bugs": {
"url": "https://github.com/UsefulSoftwareCo/executor/issues"
diff --git a/packages/plugins/encrypted-secrets/CHANGELOG.md b/packages/plugins/encrypted-secrets/CHANGELOG.md
index f4e8607a74..4fc7c36721 100644
--- a/packages/plugins/encrypted-secrets/CHANGELOG.md
+++ b/packages/plugins/encrypted-secrets/CHANGELOG.md
@@ -1,5 +1,12 @@
# @executor-js/plugin-encrypted-secrets
+## 0.0.51
+
+### Patch Changes
+
+- Updated dependencies [[`40b2f2e`](https://github.com/UsefulSoftwareCo/executor/commit/40b2f2e38d642843eb7c984c020117e0db52acfc), [`65d939e`](https://github.com/UsefulSoftwareCo/executor/commit/65d939ebab6f77a00a3435fe3575399cd1cd3b7f), [`3c263d7`](https://github.com/UsefulSoftwareCo/executor/commit/3c263d7580d1d9302a1dc5d63f2fab253fd409c2), [`be77521`](https://github.com/UsefulSoftwareCo/executor/commit/be775216cccddac6002b1f9442b3c8151e4f6063), [`cc0fd8f`](https://github.com/UsefulSoftwareCo/executor/commit/cc0fd8f6099f3d05c73a285ef14932c01ac212fa), [`85cf428`](https://github.com/UsefulSoftwareCo/executor/commit/85cf428905bbd73257fb3c3be5c89e762bf79377), [`38a7725`](https://github.com/UsefulSoftwareCo/executor/commit/38a7725876bcc9c8adeea9c7efbd190c121d3b86), [`3fd28a5`](https://github.com/UsefulSoftwareCo/executor/commit/3fd28a51fabb0fc96d0bf83408021e7cbca70bfe), [`929b233`](https://github.com/UsefulSoftwareCo/executor/commit/929b2338f225b3f80190ac7a6fe1f2473650c58c)]:
+ - @executor-js/sdk@1.6.9
+
## 0.0.50
### Patch Changes
diff --git a/packages/plugins/encrypted-secrets/package.json b/packages/plugins/encrypted-secrets/package.json
index 3bc9fb1f10..d47049b036 100644
--- a/packages/plugins/encrypted-secrets/package.json
+++ b/packages/plugins/encrypted-secrets/package.json
@@ -1,6 +1,6 @@
{
"name": "@executor-js/plugin-encrypted-secrets",
- "version": "0.0.50",
+ "version": "0.0.51",
"private": true,
"type": "module",
"exports": {
diff --git a/packages/plugins/example/CHANGELOG.md b/packages/plugins/example/CHANGELOG.md
index 3d4746cba0..84188a7a3e 100644
--- a/packages/plugins/example/CHANGELOG.md
+++ b/packages/plugins/example/CHANGELOG.md
@@ -1,5 +1,12 @@
# @executor-js/plugin-example
+## 1.6.9
+
+### Patch Changes
+
+- Updated dependencies [[`40b2f2e`](https://github.com/UsefulSoftwareCo/executor/commit/40b2f2e38d642843eb7c984c020117e0db52acfc), [`65d939e`](https://github.com/UsefulSoftwareCo/executor/commit/65d939ebab6f77a00a3435fe3575399cd1cd3b7f), [`3c263d7`](https://github.com/UsefulSoftwareCo/executor/commit/3c263d7580d1d9302a1dc5d63f2fab253fd409c2), [`be77521`](https://github.com/UsefulSoftwareCo/executor/commit/be775216cccddac6002b1f9442b3c8151e4f6063), [`cc0fd8f`](https://github.com/UsefulSoftwareCo/executor/commit/cc0fd8f6099f3d05c73a285ef14932c01ac212fa), [`85cf428`](https://github.com/UsefulSoftwareCo/executor/commit/85cf428905bbd73257fb3c3be5c89e762bf79377), [`38a7725`](https://github.com/UsefulSoftwareCo/executor/commit/38a7725876bcc9c8adeea9c7efbd190c121d3b86), [`3fd28a5`](https://github.com/UsefulSoftwareCo/executor/commit/3fd28a51fabb0fc96d0bf83408021e7cbca70bfe), [`929b233`](https://github.com/UsefulSoftwareCo/executor/commit/929b2338f225b3f80190ac7a6fe1f2473650c58c)]:
+ - @executor-js/sdk@1.6.9
+
## 1.6.8
### Patch Changes
diff --git a/packages/plugins/example/package.json b/packages/plugins/example/package.json
index c4b80de977..61e2cc5f18 100644
--- a/packages/plugins/example/package.json
+++ b/packages/plugins/example/package.json
@@ -1,6 +1,6 @@
{
"name": "@executor-js/plugin-example",
- "version": "1.6.8",
+ "version": "1.6.9",
"homepage": "https://github.com/UsefulSoftwareCo/executor/tree/main/packages/plugins/example",
"bugs": {
"url": "https://github.com/UsefulSoftwareCo/executor/issues"
diff --git a/packages/plugins/file-secrets/CHANGELOG.md b/packages/plugins/file-secrets/CHANGELOG.md
index 78b2cdc608..4fb028a45f 100644
--- a/packages/plugins/file-secrets/CHANGELOG.md
+++ b/packages/plugins/file-secrets/CHANGELOG.md
@@ -1,5 +1,12 @@
# @executor-js/plugin-file-secrets
+## 1.6.9
+
+### Patch Changes
+
+- Updated dependencies [[`40b2f2e`](https://github.com/UsefulSoftwareCo/executor/commit/40b2f2e38d642843eb7c984c020117e0db52acfc), [`65d939e`](https://github.com/UsefulSoftwareCo/executor/commit/65d939ebab6f77a00a3435fe3575399cd1cd3b7f), [`3c263d7`](https://github.com/UsefulSoftwareCo/executor/commit/3c263d7580d1d9302a1dc5d63f2fab253fd409c2), [`be77521`](https://github.com/UsefulSoftwareCo/executor/commit/be775216cccddac6002b1f9442b3c8151e4f6063), [`cc0fd8f`](https://github.com/UsefulSoftwareCo/executor/commit/cc0fd8f6099f3d05c73a285ef14932c01ac212fa), [`85cf428`](https://github.com/UsefulSoftwareCo/executor/commit/85cf428905bbd73257fb3c3be5c89e762bf79377), [`38a7725`](https://github.com/UsefulSoftwareCo/executor/commit/38a7725876bcc9c8adeea9c7efbd190c121d3b86), [`3fd28a5`](https://github.com/UsefulSoftwareCo/executor/commit/3fd28a51fabb0fc96d0bf83408021e7cbca70bfe), [`929b233`](https://github.com/UsefulSoftwareCo/executor/commit/929b2338f225b3f80190ac7a6fe1f2473650c58c)]:
+ - @executor-js/sdk@1.6.9
+
## 1.6.8
### Patch Changes
diff --git a/packages/plugins/file-secrets/package.json b/packages/plugins/file-secrets/package.json
index b12a393017..dc783a98bd 100644
--- a/packages/plugins/file-secrets/package.json
+++ b/packages/plugins/file-secrets/package.json
@@ -1,6 +1,6 @@
{
"name": "@executor-js/plugin-file-secrets",
- "version": "1.6.8",
+ "version": "1.6.9",
"homepage": "https://github.com/UsefulSoftwareCo/executor/tree/main/packages/plugins/file-secrets",
"bugs": {
"url": "https://github.com/UsefulSoftwareCo/executor/issues"
diff --git a/packages/plugins/graphql/CHANGELOG.md b/packages/plugins/graphql/CHANGELOG.md
index 393faa3aaf..b063c836e2 100644
--- a/packages/plugins/graphql/CHANGELOG.md
+++ b/packages/plugins/graphql/CHANGELOG.md
@@ -1,5 +1,15 @@
# @executor-js/plugin-graphql
+## 1.6.9
+
+### Patch Changes
+
+- Updated dependencies [[`d873caf`](https://github.com/UsefulSoftwareCo/executor/commit/d873caf6fb3aa7408270b42aaad77f53cf9ec090), [`40b2f2e`](https://github.com/UsefulSoftwareCo/executor/commit/40b2f2e38d642843eb7c984c020117e0db52acfc), [`65d939e`](https://github.com/UsefulSoftwareCo/executor/commit/65d939ebab6f77a00a3435fe3575399cd1cd3b7f), [`3c263d7`](https://github.com/UsefulSoftwareCo/executor/commit/3c263d7580d1d9302a1dc5d63f2fab253fd409c2), [`61f71c5`](https://github.com/UsefulSoftwareCo/executor/commit/61f71c56fe799b6e0faa2b2f82a91f631bc6a979), [`a6cdcf1`](https://github.com/UsefulSoftwareCo/executor/commit/a6cdcf1ccfae22e7d3378908c095e5c847c70f90), [`be77521`](https://github.com/UsefulSoftwareCo/executor/commit/be775216cccddac6002b1f9442b3c8151e4f6063), [`f8cfa5f`](https://github.com/UsefulSoftwareCo/executor/commit/f8cfa5f5f475c6b9c14143663ed5861bec8f74af), [`1f67d83`](https://github.com/UsefulSoftwareCo/executor/commit/1f67d83609b13a73d3dc8d630f48c8f54a02e6ca), [`905e097`](https://github.com/UsefulSoftwareCo/executor/commit/905e0972614aed5a3bb279b51dc060f87f892d75), [`cc0fd8f`](https://github.com/UsefulSoftwareCo/executor/commit/cc0fd8f6099f3d05c73a285ef14932c01ac212fa), [`85cf428`](https://github.com/UsefulSoftwareCo/executor/commit/85cf428905bbd73257fb3c3be5c89e762bf79377), [`38a7725`](https://github.com/UsefulSoftwareCo/executor/commit/38a7725876bcc9c8adeea9c7efbd190c121d3b86), [`3fd28a5`](https://github.com/UsefulSoftwareCo/executor/commit/3fd28a51fabb0fc96d0bf83408021e7cbca70bfe), [`929b233`](https://github.com/UsefulSoftwareCo/executor/commit/929b2338f225b3f80190ac7a6fe1f2473650c58c)]:
+ - @executor-js/api@1.4.72
+ - @executor-js/sdk@1.6.9
+ - @executor-js/react@1.4.72
+ - @executor-js/config@1.6.9
+
## 1.6.8
### Patch Changes
diff --git a/packages/plugins/graphql/package.json b/packages/plugins/graphql/package.json
index e08e541116..c1de04eaa7 100644
--- a/packages/plugins/graphql/package.json
+++ b/packages/plugins/graphql/package.json
@@ -1,6 +1,6 @@
{
"name": "@executor-js/plugin-graphql",
- "version": "1.6.8",
+ "version": "1.6.9",
"homepage": "https://github.com/UsefulSoftwareCo/executor/tree/main/packages/plugins/graphql",
"bugs": {
"url": "https://github.com/UsefulSoftwareCo/executor/issues"
diff --git a/packages/plugins/keychain/CHANGELOG.md b/packages/plugins/keychain/CHANGELOG.md
index ce95d64212..68c8f47d50 100644
--- a/packages/plugins/keychain/CHANGELOG.md
+++ b/packages/plugins/keychain/CHANGELOG.md
@@ -1,5 +1,12 @@
# @executor-js/plugin-keychain
+## 1.6.9
+
+### Patch Changes
+
+- Updated dependencies [[`40b2f2e`](https://github.com/UsefulSoftwareCo/executor/commit/40b2f2e38d642843eb7c984c020117e0db52acfc), [`65d939e`](https://github.com/UsefulSoftwareCo/executor/commit/65d939ebab6f77a00a3435fe3575399cd1cd3b7f), [`3c263d7`](https://github.com/UsefulSoftwareCo/executor/commit/3c263d7580d1d9302a1dc5d63f2fab253fd409c2), [`be77521`](https://github.com/UsefulSoftwareCo/executor/commit/be775216cccddac6002b1f9442b3c8151e4f6063), [`cc0fd8f`](https://github.com/UsefulSoftwareCo/executor/commit/cc0fd8f6099f3d05c73a285ef14932c01ac212fa), [`85cf428`](https://github.com/UsefulSoftwareCo/executor/commit/85cf428905bbd73257fb3c3be5c89e762bf79377), [`38a7725`](https://github.com/UsefulSoftwareCo/executor/commit/38a7725876bcc9c8adeea9c7efbd190c121d3b86), [`3fd28a5`](https://github.com/UsefulSoftwareCo/executor/commit/3fd28a51fabb0fc96d0bf83408021e7cbca70bfe), [`929b233`](https://github.com/UsefulSoftwareCo/executor/commit/929b2338f225b3f80190ac7a6fe1f2473650c58c)]:
+ - @executor-js/sdk@1.6.9
+
## 1.6.8
### Patch Changes
diff --git a/packages/plugins/keychain/package.json b/packages/plugins/keychain/package.json
index 3b59251b97..d28235f142 100644
--- a/packages/plugins/keychain/package.json
+++ b/packages/plugins/keychain/package.json
@@ -1,6 +1,6 @@
{
"name": "@executor-js/plugin-keychain",
- "version": "1.6.8",
+ "version": "1.6.9",
"homepage": "https://github.com/UsefulSoftwareCo/executor/tree/main/packages/plugins/keychain",
"bugs": {
"url": "https://github.com/UsefulSoftwareCo/executor/issues"
diff --git a/packages/plugins/mcp/CHANGELOG.md b/packages/plugins/mcp/CHANGELOG.md
index 37f06fb09c..54cc8691f5 100644
--- a/packages/plugins/mcp/CHANGELOG.md
+++ b/packages/plugins/mcp/CHANGELOG.md
@@ -1,5 +1,21 @@
# @executor-js/plugin-mcp
+## 1.6.9
+
+### Patch Changes
+
+- [#1976](https://github.com/UsefulSoftwareCo/executor/pull/1976) [`40b2f2e`](https://github.com/UsefulSoftwareCo/executor/commit/40b2f2e38d642843eb7c984c020117e0db52acfc) Thanks [@SunkenInTime](https://github.com/SunkenInTime)! - Carry an approval's persistence choice through elicitation, so Codex Computer Use stops asking to use the same app on every call.
+
+ Computer Use offers `persist: ["session", "always"]` in the prompt's terms and remembers the app only when the answer names one. Executor dropped the offer on the way in (the terms projection kept strings only) and the choice on the way out (every adapter rebuilt the reply from `action` and `content`), so each accept was one-time. `ElicitationResponse` now has `meta.persist`; the MCP plugin, the app-server bridge, and the MCP host pass it through; the model-mode `resume` tool and the browser approval page let the approver pick from the offered scopes. Nothing is chosen automatically: a bare accept still approves once.
+
+- [#1956](https://github.com/UsefulSoftwareCo/executor/pull/1956) [`0e9d800`](https://github.com/UsefulSoftwareCo/executor/commit/0e9d8004e2f1b35ce948b382bb97c58ebf177911) Thanks [@mikemikimike](https://github.com/mikemikimike)! - Exclude time spent waiting for elicitation from the MCP tool invocation deadline.
+
+- Updated dependencies [[`d873caf`](https://github.com/UsefulSoftwareCo/executor/commit/d873caf6fb3aa7408270b42aaad77f53cf9ec090), [`40b2f2e`](https://github.com/UsefulSoftwareCo/executor/commit/40b2f2e38d642843eb7c984c020117e0db52acfc), [`65d939e`](https://github.com/UsefulSoftwareCo/executor/commit/65d939ebab6f77a00a3435fe3575399cd1cd3b7f), [`3c263d7`](https://github.com/UsefulSoftwareCo/executor/commit/3c263d7580d1d9302a1dc5d63f2fab253fd409c2), [`61f71c5`](https://github.com/UsefulSoftwareCo/executor/commit/61f71c56fe799b6e0faa2b2f82a91f631bc6a979), [`a6cdcf1`](https://github.com/UsefulSoftwareCo/executor/commit/a6cdcf1ccfae22e7d3378908c095e5c847c70f90), [`be77521`](https://github.com/UsefulSoftwareCo/executor/commit/be775216cccddac6002b1f9442b3c8151e4f6063), [`f8cfa5f`](https://github.com/UsefulSoftwareCo/executor/commit/f8cfa5f5f475c6b9c14143663ed5861bec8f74af), [`1f67d83`](https://github.com/UsefulSoftwareCo/executor/commit/1f67d83609b13a73d3dc8d630f48c8f54a02e6ca), [`905e097`](https://github.com/UsefulSoftwareCo/executor/commit/905e0972614aed5a3bb279b51dc060f87f892d75), [`cc0fd8f`](https://github.com/UsefulSoftwareCo/executor/commit/cc0fd8f6099f3d05c73a285ef14932c01ac212fa), [`85cf428`](https://github.com/UsefulSoftwareCo/executor/commit/85cf428905bbd73257fb3c3be5c89e762bf79377), [`38a7725`](https://github.com/UsefulSoftwareCo/executor/commit/38a7725876bcc9c8adeea9c7efbd190c121d3b86), [`3fd28a5`](https://github.com/UsefulSoftwareCo/executor/commit/3fd28a51fabb0fc96d0bf83408021e7cbca70bfe), [`929b233`](https://github.com/UsefulSoftwareCo/executor/commit/929b2338f225b3f80190ac7a6fe1f2473650c58c)]:
+ - @executor-js/api@1.4.72
+ - @executor-js/sdk@1.6.9
+ - @executor-js/react@1.4.72
+ - @executor-js/config@1.6.9
+
## 1.6.8
### Patch Changes
diff --git a/packages/plugins/mcp/package.json b/packages/plugins/mcp/package.json
index 6671783b79..b10e9909d2 100644
--- a/packages/plugins/mcp/package.json
+++ b/packages/plugins/mcp/package.json
@@ -1,6 +1,6 @@
{
"name": "@executor-js/plugin-mcp",
- "version": "1.6.8",
+ "version": "1.6.9",
"homepage": "https://github.com/UsefulSoftwareCo/executor/tree/main/packages/plugins/mcp",
"bugs": {
"url": "https://github.com/UsefulSoftwareCo/executor/issues"
diff --git a/packages/plugins/onepassword/CHANGELOG.md b/packages/plugins/onepassword/CHANGELOG.md
index 71f0314120..5af3bed5d1 100644
--- a/packages/plugins/onepassword/CHANGELOG.md
+++ b/packages/plugins/onepassword/CHANGELOG.md
@@ -1,5 +1,14 @@
# @executor-js/plugin-onepassword
+## 1.6.9
+
+### Patch Changes
+
+- Updated dependencies [[`d873caf`](https://github.com/UsefulSoftwareCo/executor/commit/d873caf6fb3aa7408270b42aaad77f53cf9ec090), [`40b2f2e`](https://github.com/UsefulSoftwareCo/executor/commit/40b2f2e38d642843eb7c984c020117e0db52acfc), [`65d939e`](https://github.com/UsefulSoftwareCo/executor/commit/65d939ebab6f77a00a3435fe3575399cd1cd3b7f), [`3c263d7`](https://github.com/UsefulSoftwareCo/executor/commit/3c263d7580d1d9302a1dc5d63f2fab253fd409c2), [`61f71c5`](https://github.com/UsefulSoftwareCo/executor/commit/61f71c56fe799b6e0faa2b2f82a91f631bc6a979), [`a6cdcf1`](https://github.com/UsefulSoftwareCo/executor/commit/a6cdcf1ccfae22e7d3378908c095e5c847c70f90), [`be77521`](https://github.com/UsefulSoftwareCo/executor/commit/be775216cccddac6002b1f9442b3c8151e4f6063), [`f8cfa5f`](https://github.com/UsefulSoftwareCo/executor/commit/f8cfa5f5f475c6b9c14143663ed5861bec8f74af), [`1f67d83`](https://github.com/UsefulSoftwareCo/executor/commit/1f67d83609b13a73d3dc8d630f48c8f54a02e6ca), [`905e097`](https://github.com/UsefulSoftwareCo/executor/commit/905e0972614aed5a3bb279b51dc060f87f892d75), [`cc0fd8f`](https://github.com/UsefulSoftwareCo/executor/commit/cc0fd8f6099f3d05c73a285ef14932c01ac212fa), [`85cf428`](https://github.com/UsefulSoftwareCo/executor/commit/85cf428905bbd73257fb3c3be5c89e762bf79377), [`38a7725`](https://github.com/UsefulSoftwareCo/executor/commit/38a7725876bcc9c8adeea9c7efbd190c121d3b86), [`3fd28a5`](https://github.com/UsefulSoftwareCo/executor/commit/3fd28a51fabb0fc96d0bf83408021e7cbca70bfe), [`929b233`](https://github.com/UsefulSoftwareCo/executor/commit/929b2338f225b3f80190ac7a6fe1f2473650c58c)]:
+ - @executor-js/api@1.4.72
+ - @executor-js/sdk@1.6.9
+ - @executor-js/react@1.4.72
+
## 1.6.8
### Patch Changes
diff --git a/packages/plugins/onepassword/package.json b/packages/plugins/onepassword/package.json
index 5cfeb0e0fa..a52acd00df 100644
--- a/packages/plugins/onepassword/package.json
+++ b/packages/plugins/onepassword/package.json
@@ -1,6 +1,6 @@
{
"name": "@executor-js/plugin-onepassword",
- "version": "1.6.8",
+ "version": "1.6.9",
"homepage": "https://github.com/UsefulSoftwareCo/executor/tree/main/packages/plugins/onepassword",
"bugs": {
"url": "https://github.com/UsefulSoftwareCo/executor/issues"
diff --git a/packages/plugins/openapi/CHANGELOG.md b/packages/plugins/openapi/CHANGELOG.md
index 561c9d6f81..29dcdb2f4f 100644
--- a/packages/plugins/openapi/CHANGELOG.md
+++ b/packages/plugins/openapi/CHANGELOG.md
@@ -1,5 +1,29 @@
# @executor-js/plugin-openapi
+## 1.6.9
+
+### Patch Changes
+
+- [#1955](https://github.com/UsefulSoftwareCo/executor/pull/1955) [`55a8b5e`](https://github.com/UsefulSoftwareCo/executor/commit/55a8b5eaea88c20fa5c5f1852262db613b8ddb9f) Thanks [@smrht](https://github.com/smrht)! - Fetch Google Analytics Data (`analyticsdata`) Discovery from the service's own
+ host. The central directory does not list the GA4 Data API, so the canonical
+ `https://www.googleapis.com/discovery/v1/apis/analyticsdata/v1beta/rest` answers
+ 404 and the source fails to import. Same treatment `forms`, `keep` and
+ `photospicker` already get.
+
+- [#1960](https://github.com/UsefulSoftwareCo/executor/pull/1960) [`d64639b`](https://github.com/UsefulSoftwareCo/executor/commit/d64639b1a50d2d292235aff8f727ca11fe9e43a6) Thanks [@baggiiiie](https://github.com/baggiiiie)! - OpenAPI tools that cannot reach the upstream server now return an `upstream_unreachable` error instead of `Internal tool error [id]`. The message names the integration and origin that could not be reached, `details` carries the sanitized `host` and errno-style `code` (`ECONNREFUSED`, `ENOTFOUND`, …), and the failure is logged with the same classification.
+
+- [#1937](https://github.com/UsefulSoftwareCo/executor/pull/1937) [`e9055c1`](https://github.com/UsefulSoftwareCo/executor/commit/e9055c13bf73bc1860c8eded542fe566b51c3784) Thanks [@The-AarushiSingh](https://github.com/The-AarushiSingh)! - Preserve vendor +json Content-Type on OpenAPI object request bodies.
+
+- [#1952](https://github.com/UsefulSoftwareCo/executor/pull/1952) [`1f67d83`](https://github.com/UsefulSoftwareCo/executor/commit/1f67d83609b13a73d3dc8d630f48c8f54a02e6ca) Thanks [@Karavil](https://github.com/Karavil)! - Support POST health checks for APIs that expose reads through HTTP RPC. Warn that POST can change data, allow validated JSON request bodies, and display the reason when a configured probe cannot run.
+
+- [#2000](https://github.com/UsefulSoftwareCo/executor/pull/2000) [`3fd28a5`](https://github.com/UsefulSoftwareCo/executor/commit/3fd28a51fabb0fc96d0bf83408021e7cbca70bfe) Thanks [@RhysSullivan](https://github.com/RhysSullivan)! - Update the YAML parser to include fixes for malformed-input denial of service.
+
+- Updated dependencies [[`d873caf`](https://github.com/UsefulSoftwareCo/executor/commit/d873caf6fb3aa7408270b42aaad77f53cf9ec090), [`40b2f2e`](https://github.com/UsefulSoftwareCo/executor/commit/40b2f2e38d642843eb7c984c020117e0db52acfc), [`65d939e`](https://github.com/UsefulSoftwareCo/executor/commit/65d939ebab6f77a00a3435fe3575399cd1cd3b7f), [`3c263d7`](https://github.com/UsefulSoftwareCo/executor/commit/3c263d7580d1d9302a1dc5d63f2fab253fd409c2), [`61f71c5`](https://github.com/UsefulSoftwareCo/executor/commit/61f71c56fe799b6e0faa2b2f82a91f631bc6a979), [`a6cdcf1`](https://github.com/UsefulSoftwareCo/executor/commit/a6cdcf1ccfae22e7d3378908c095e5c847c70f90), [`be77521`](https://github.com/UsefulSoftwareCo/executor/commit/be775216cccddac6002b1f9442b3c8151e4f6063), [`f8cfa5f`](https://github.com/UsefulSoftwareCo/executor/commit/f8cfa5f5f475c6b9c14143663ed5861bec8f74af), [`1f67d83`](https://github.com/UsefulSoftwareCo/executor/commit/1f67d83609b13a73d3dc8d630f48c8f54a02e6ca), [`905e097`](https://github.com/UsefulSoftwareCo/executor/commit/905e0972614aed5a3bb279b51dc060f87f892d75), [`cc0fd8f`](https://github.com/UsefulSoftwareCo/executor/commit/cc0fd8f6099f3d05c73a285ef14932c01ac212fa), [`85cf428`](https://github.com/UsefulSoftwareCo/executor/commit/85cf428905bbd73257fb3c3be5c89e762bf79377), [`38a7725`](https://github.com/UsefulSoftwareCo/executor/commit/38a7725876bcc9c8adeea9c7efbd190c121d3b86), [`3fd28a5`](https://github.com/UsefulSoftwareCo/executor/commit/3fd28a51fabb0fc96d0bf83408021e7cbca70bfe), [`929b233`](https://github.com/UsefulSoftwareCo/executor/commit/929b2338f225b3f80190ac7a6fe1f2473650c58c)]:
+ - @executor-js/api@1.4.72
+ - @executor-js/sdk@1.6.9
+ - @executor-js/react@1.4.72
+ - @executor-js/config@1.6.9
+
## 1.6.8
### Patch Changes
diff --git a/packages/plugins/openapi/package.json b/packages/plugins/openapi/package.json
index cfc9c0cd24..57e8d4320b 100644
--- a/packages/plugins/openapi/package.json
+++ b/packages/plugins/openapi/package.json
@@ -1,6 +1,6 @@
{
"name": "@executor-js/plugin-openapi",
- "version": "1.6.8",
+ "version": "1.6.9",
"homepage": "https://github.com/UsefulSoftwareCo/executor/tree/main/packages/plugins/openapi",
"bugs": {
"url": "https://github.com/UsefulSoftwareCo/executor/issues"
diff --git a/packages/plugins/provider-service-split/CHANGELOG.md b/packages/plugins/provider-service-split/CHANGELOG.md
index 41eb4bfaa5..0cefad1526 100644
--- a/packages/plugins/provider-service-split/CHANGELOG.md
+++ b/packages/plugins/provider-service-split/CHANGELOG.md
@@ -1,5 +1,13 @@
# @executor-js/plugin-provider-service-split
+## 0.0.23
+
+### Patch Changes
+
+- Updated dependencies [[`40b2f2e`](https://github.com/UsefulSoftwareCo/executor/commit/40b2f2e38d642843eb7c984c020117e0db52acfc), [`55a8b5e`](https://github.com/UsefulSoftwareCo/executor/commit/55a8b5eaea88c20fa5c5f1852262db613b8ddb9f), [`65d939e`](https://github.com/UsefulSoftwareCo/executor/commit/65d939ebab6f77a00a3435fe3575399cd1cd3b7f), [`3c263d7`](https://github.com/UsefulSoftwareCo/executor/commit/3c263d7580d1d9302a1dc5d63f2fab253fd409c2), [`be77521`](https://github.com/UsefulSoftwareCo/executor/commit/be775216cccddac6002b1f9442b3c8151e4f6063), [`d64639b`](https://github.com/UsefulSoftwareCo/executor/commit/d64639b1a50d2d292235aff8f727ca11fe9e43a6), [`e9055c1`](https://github.com/UsefulSoftwareCo/executor/commit/e9055c13bf73bc1860c8eded542fe566b51c3784), [`1f67d83`](https://github.com/UsefulSoftwareCo/executor/commit/1f67d83609b13a73d3dc8d630f48c8f54a02e6ca), [`cc0fd8f`](https://github.com/UsefulSoftwareCo/executor/commit/cc0fd8f6099f3d05c73a285ef14932c01ac212fa), [`85cf428`](https://github.com/UsefulSoftwareCo/executor/commit/85cf428905bbd73257fb3c3be5c89e762bf79377), [`38a7725`](https://github.com/UsefulSoftwareCo/executor/commit/38a7725876bcc9c8adeea9c7efbd190c121d3b86), [`3fd28a5`](https://github.com/UsefulSoftwareCo/executor/commit/3fd28a51fabb0fc96d0bf83408021e7cbca70bfe), [`3fd28a5`](https://github.com/UsefulSoftwareCo/executor/commit/3fd28a51fabb0fc96d0bf83408021e7cbca70bfe), [`929b233`](https://github.com/UsefulSoftwareCo/executor/commit/929b2338f225b3f80190ac7a6fe1f2473650c58c)]:
+ - @executor-js/sdk@1.6.9
+ - @executor-js/plugin-openapi@1.6.9
+
## 0.0.22
### Patch Changes
diff --git a/packages/plugins/provider-service-split/package.json b/packages/plugins/provider-service-split/package.json
index b318801355..a790fdea11 100644
--- a/packages/plugins/provider-service-split/package.json
+++ b/packages/plugins/provider-service-split/package.json
@@ -1,6 +1,6 @@
{
"name": "@executor-js/plugin-provider-service-split",
- "version": "0.0.22",
+ "version": "0.0.23",
"private": true,
"type": "module",
"exports": {
diff --git a/packages/plugins/toolkits/CHANGELOG.md b/packages/plugins/toolkits/CHANGELOG.md
index 4f8b5cce7e..a4c8172a01 100644
--- a/packages/plugins/toolkits/CHANGELOG.md
+++ b/packages/plugins/toolkits/CHANGELOG.md
@@ -1,5 +1,14 @@
# @executor-js/plugin-toolkits
+## 1.5.44
+
+### Patch Changes
+
+- Updated dependencies [[`d873caf`](https://github.com/UsefulSoftwareCo/executor/commit/d873caf6fb3aa7408270b42aaad77f53cf9ec090), [`40b2f2e`](https://github.com/UsefulSoftwareCo/executor/commit/40b2f2e38d642843eb7c984c020117e0db52acfc), [`65d939e`](https://github.com/UsefulSoftwareCo/executor/commit/65d939ebab6f77a00a3435fe3575399cd1cd3b7f), [`3c263d7`](https://github.com/UsefulSoftwareCo/executor/commit/3c263d7580d1d9302a1dc5d63f2fab253fd409c2), [`61f71c5`](https://github.com/UsefulSoftwareCo/executor/commit/61f71c56fe799b6e0faa2b2f82a91f631bc6a979), [`a6cdcf1`](https://github.com/UsefulSoftwareCo/executor/commit/a6cdcf1ccfae22e7d3378908c095e5c847c70f90), [`be77521`](https://github.com/UsefulSoftwareCo/executor/commit/be775216cccddac6002b1f9442b3c8151e4f6063), [`f8cfa5f`](https://github.com/UsefulSoftwareCo/executor/commit/f8cfa5f5f475c6b9c14143663ed5861bec8f74af), [`1f67d83`](https://github.com/UsefulSoftwareCo/executor/commit/1f67d83609b13a73d3dc8d630f48c8f54a02e6ca), [`905e097`](https://github.com/UsefulSoftwareCo/executor/commit/905e0972614aed5a3bb279b51dc060f87f892d75), [`cc0fd8f`](https://github.com/UsefulSoftwareCo/executor/commit/cc0fd8f6099f3d05c73a285ef14932c01ac212fa), [`85cf428`](https://github.com/UsefulSoftwareCo/executor/commit/85cf428905bbd73257fb3c3be5c89e762bf79377), [`38a7725`](https://github.com/UsefulSoftwareCo/executor/commit/38a7725876bcc9c8adeea9c7efbd190c121d3b86), [`3fd28a5`](https://github.com/UsefulSoftwareCo/executor/commit/3fd28a51fabb0fc96d0bf83408021e7cbca70bfe), [`929b233`](https://github.com/UsefulSoftwareCo/executor/commit/929b2338f225b3f80190ac7a6fe1f2473650c58c)]:
+ - @executor-js/api@1.4.72
+ - @executor-js/sdk@1.6.9
+ - @executor-js/react@1.4.72
+
## 1.5.43
### Patch Changes
diff --git a/packages/plugins/toolkits/package.json b/packages/plugins/toolkits/package.json
index 72a85a9c75..275f8f3fcd 100644
--- a/packages/plugins/toolkits/package.json
+++ b/packages/plugins/toolkits/package.json
@@ -1,6 +1,6 @@
{
"name": "@executor-js/plugin-toolkits",
- "version": "1.5.43",
+ "version": "1.5.44",
"homepage": "https://github.com/UsefulSoftwareCo/executor/tree/main/packages/plugins/toolkits",
"bugs": {
"url": "https://github.com/UsefulSoftwareCo/executor/issues"
diff --git a/packages/react/CHANGELOG.md b/packages/react/CHANGELOG.md
index d6a61c0911..6239d80c2c 100644
--- a/packages/react/CHANGELOG.md
+++ b/packages/react/CHANGELOG.md
@@ -1,5 +1,30 @@
# @executor-js/react
+## 1.4.72
+
+### Patch Changes
+
+- [#1976](https://github.com/UsefulSoftwareCo/executor/pull/1976) [`40b2f2e`](https://github.com/UsefulSoftwareCo/executor/commit/40b2f2e38d642843eb7c984c020117e0db52acfc) Thanks [@SunkenInTime](https://github.com/SunkenInTime)! - Carry an approval's persistence choice through elicitation, so Codex Computer Use stops asking to use the same app on every call.
+
+ Computer Use offers `persist: ["session", "always"]` in the prompt's terms and remembers the app only when the answer names one. Executor dropped the offer on the way in (the terms projection kept strings only) and the choice on the way out (every adapter rebuilt the reply from `action` and `content`), so each accept was one-time. `ElicitationResponse` now has `meta.persist`; the MCP plugin, the app-server bridge, and the MCP host pass it through; the model-mode `resume` tool and the browser approval page let the approver pick from the offered scopes. Nothing is chosen automatically: a bare accept still approves once.
+
+- [#2025](https://github.com/UsefulSoftwareCo/executor/pull/2025) [`be77521`](https://github.com/UsefulSoftwareCo/executor/commit/be775216cccddac6002b1f9442b3c8151e4f6063) Thanks [@RhysSullivan](https://github.com/RhysSullivan)! - Member lists, the admin users page, and seat counts on cloud now read from the local membership mirror through the shared `MemberDirectory` seam instead of fanning out one WorkOS read per member. The admin users page gains an email/name search.
+
+ **Deploy prerequisite (cloud):** `bun run --cwd apps/cloud db:backfill-workos-mirror:prod` must complete before this build is deployed, and its printed membership count should match WorkOS. Until the backfill has stamped the mirror's marker, seat reporting to Autumn is skipped with a warning (never a partial count) and member lists show only members who have signed in since the mirror shipped.
+
+- [#1952](https://github.com/UsefulSoftwareCo/executor/pull/1952) [`1f67d83`](https://github.com/UsefulSoftwareCo/executor/commit/1f67d83609b13a73d3dc8d630f48c8f54a02e6ca) Thanks [@Karavil](https://github.com/Karavil)! - Support POST health checks for APIs that expose reads through HTTP RPC. Warn that POST can change data, allow validated JSON request bodies, and display the reason when a configured probe cannot run.
+
+- [#1892](https://github.com/UsefulSoftwareCo/executor/pull/1892) [`905e097`](https://github.com/UsefulSoftwareCo/executor/commit/905e0972614aed5a3bb279b51dc060f87f892d75) Thanks [@ra-co88](https://github.com/ra-co88)! - fix: honor prefers-reduced-motion in the shared stylesheet
+
+ Adds a `prefers-reduced-motion: reduce` block to the global stylesheet that
+ caps transition/animation durations to 0.01ms and disables smooth scrolling,
+ so motion-sensitive users get a stable UI. The loading spinner renders
+ statically under reduced motion (its meaning is preserved via `role="status"`).
+
+- Updated dependencies [[`d873caf`](https://github.com/UsefulSoftwareCo/executor/commit/d873caf6fb3aa7408270b42aaad77f53cf9ec090), [`40b2f2e`](https://github.com/UsefulSoftwareCo/executor/commit/40b2f2e38d642843eb7c984c020117e0db52acfc), [`65d939e`](https://github.com/UsefulSoftwareCo/executor/commit/65d939ebab6f77a00a3435fe3575399cd1cd3b7f), [`3c263d7`](https://github.com/UsefulSoftwareCo/executor/commit/3c263d7580d1d9302a1dc5d63f2fab253fd409c2), [`61f71c5`](https://github.com/UsefulSoftwareCo/executor/commit/61f71c56fe799b6e0faa2b2f82a91f631bc6a979), [`a6cdcf1`](https://github.com/UsefulSoftwareCo/executor/commit/a6cdcf1ccfae22e7d3378908c095e5c847c70f90), [`be77521`](https://github.com/UsefulSoftwareCo/executor/commit/be775216cccddac6002b1f9442b3c8151e4f6063), [`f8cfa5f`](https://github.com/UsefulSoftwareCo/executor/commit/f8cfa5f5f475c6b9c14143663ed5861bec8f74af), [`cc0fd8f`](https://github.com/UsefulSoftwareCo/executor/commit/cc0fd8f6099f3d05c73a285ef14932c01ac212fa), [`85cf428`](https://github.com/UsefulSoftwareCo/executor/commit/85cf428905bbd73257fb3c3be5c89e762bf79377), [`38a7725`](https://github.com/UsefulSoftwareCo/executor/commit/38a7725876bcc9c8adeea9c7efbd190c121d3b86), [`3fd28a5`](https://github.com/UsefulSoftwareCo/executor/commit/3fd28a51fabb0fc96d0bf83408021e7cbca70bfe), [`929b233`](https://github.com/UsefulSoftwareCo/executor/commit/929b2338f225b3f80190ac7a6fe1f2473650c58c)]:
+ - @executor-js/api@1.4.72
+ - @executor-js/sdk@1.6.9
+
## 1.4.71
### Patch Changes
diff --git a/packages/react/package.json b/packages/react/package.json
index 916b0cf410..bc7e72a21a 100644
--- a/packages/react/package.json
+++ b/packages/react/package.json
@@ -1,6 +1,6 @@
{
"name": "@executor-js/react",
- "version": "1.4.71",
+ "version": "1.4.72",
"private": true,
"type": "module",
"exports": {