[codex] Fix plugin API org scoping (#1043)

Author: RhysSullivan

e2e/cloud/org-multitab-cookie.test.ts

@@ -109,3 +109,51 @@ scenario(
     });
   }),
 );
+
+scenario(
+  "Org scope · plugin API requests carry the URL organization selector",
+  {},
+  Effect.gen(function* () {
+    const target = yield* Target;
+    const browser = yield* Browser;
+    const identity = yield* target.newIdentity();
+
+    const spec = JSON.stringify({
+      openapi: "3.0.3",
+      info: { title: "Header Probe", version: "1.0.0" },
+      servers: [{ url: "https://api.example.com" }],
+      paths: {
+        "/ping": {
+          get: {
+            operationId: "ping",
+            responses: { "200": { description: "ok" } },
+          },
+        },
+      },
+    });
+
+    yield* browser.session(identity, async ({ page, step }) => {
+      await step("Open the OpenAPI add form", async () => {
+        await page.goto("/integrations/add/openapi", { waitUntil: "networkidle" });
+        await page.getByPlaceholder("https://api.example.com/openapi.json").waitFor();
+      });
+
+      const orgSlug = new URL(page.url()).pathname.split("/")[1];
+      expect(orgSlug, "the add form landed on an org-scoped URL").toBeTruthy();
+
+      await step("Paste an inline spec", async () => {
+        const previewRequest = page.waitForRequest(
+          (request) => request.url().includes("/api/openapi/preview"),
+          { timeout: 15_000 },
+        );
+
+        await page.getByPlaceholder("https://api.example.com/openapi.json").fill(spec);
+
+        expect(
+          (await previewRequest).headers()["x-executor-organization"],
+          "plugin-owned preview requests use the URL's org selector",
+        ).toBe(orgSlug);
+      });
+    });
+  }),
+);

packages/core/sdk/src/client.test.ts

@@ -77,4 +77,17 @@ describe("createPluginAtomClient", () => {
     expect(transformed.url).toBe("https://executor.example/api/graphql/sources");
     expect(transformed.headers.authorization).toBe("Bearer key_123");
   });
+
+  it("can apply host-supplied dynamic request headers to plugin requests", () => {
+    const request = HttpClientRequest.get("/openapi/integrations/acme");
+    const transformed = applyPluginAtomClientRequestTransform(request, {
+      headers: () => ({
+        "x-executor-organization": "newvale",
+        "x-empty": null,
+      }),
+    });
+
+    expect(transformed.headers["x-executor-organization"]).toBe("newvale");
+    expect(transformed.headers["x-empty"]).toBeUndefined();
+  });
 });

packages/core/sdk/src/client.ts

@@ -238,11 +238,18 @@ export interface CreatePluginAtomClientOptions {
   /** Optional dynamic Authorization header for hosts whose active
    *  Executor Server Connection requires Basic or Bearer auth. */
   readonly authorizationHeader?: string | null | (() => string | null);
+  /** Optional dynamic request headers supplied by the host shell. */
+  readonly headers?:
+    | Readonly<Record<string, string | null | undefined>>
+    | (() => Readonly<Record<string, string | null | undefined>>);
 }
 
 export interface PluginAtomClientRequestTransformOptions {
   readonly baseUrl?: () => string;
   readonly authorizationHeader?: string | null | (() => string | null);
+  readonly headers?:
+    | Readonly<Record<string, string | null | undefined>>
+    | (() => Readonly<Record<string, string | null | undefined>>);
 }
 
 /** @internal */
@@ -258,6 +265,14 @@ export const applyPluginAtomClientRequestTransform = (
   if (authorization) {
     next = HttpClientRequest.setHeader(next, "authorization", authorization);
   }
+  const headers = typeof options.headers === "function" ? options.headers() : options.headers;
+  if (headers) {
+    for (const [name, value] of Object.entries(headers)) {
+      if (value !== undefined && value !== null) {
+        next = HttpClientRequest.setHeader(next, name, value);
+      }
+    }
+  }
   return next;
 };
 
@@ -278,16 +293,17 @@ export const createPluginAtomClient = <
   group: G,
   options: CreatePluginAtomClientOptions = {},
 ) => {
-  const { baseUrl = "/api", authorizationHeader } = options;
+  const { baseUrl = "/api", authorizationHeader, headers } = options;
   const pluginId = group.identifier;
   const bundle = HttpApi.make(`plugin-${pluginId}`).add(group);
   const getBaseUrl = typeof baseUrl === "function" ? baseUrl : null;
   const staticBaseUrl = typeof baseUrl === "function" ? undefined : baseUrl;
   const getAuthorizationHeader =
     typeof authorizationHeader === "function" ? authorizationHeader : null;
   const hasAuthorization = authorizationHeader !== undefined && authorizationHeader !== null;
+  const hasHeaders = headers !== undefined;
   const transformClient =
-    getBaseUrl || hasAuthorization
+    getBaseUrl || hasAuthorization || hasHeaders
       ? HttpClient.mapRequest((request) =>
           applyPluginAtomClientRequestTransform(request, {
             ...(getBaseUrl ? { baseUrl: getBaseUrl } : {}),
@@ -296,6 +312,7 @@ export const createPluginAtomClient = <
               : authorizationHeader !== undefined
                 ? { authorizationHeader }
                 : {}),
+            ...(headers !== undefined ? { headers } : {}),
           }),
         )
       : undefined;

packages/plugins/graphql/src/react/client.ts

@@ -1,5 +1,6 @@
 import { createPluginAtomClient } from "@executor-js/sdk/client";
 import {
+  getExecutorOrganizationHeaders,
   getExecutorApiBaseUrl,
   getExecutorServerAuthorizationHeader,
 } from "@executor-js/react/api/server-connection";
@@ -8,4 +9,5 @@ import { GraphqlGroup } from "../api/group";
 export const GraphqlClient = createPluginAtomClient(GraphqlGroup, {
   baseUrl: getExecutorApiBaseUrl,
   authorizationHeader: getExecutorServerAuthorizationHeader,
+  headers: getExecutorOrganizationHeaders,
 });

packages/plugins/mcp/src/react/client.ts

@@ -1,5 +1,6 @@
 import { createPluginAtomClient } from "@executor-js/sdk/client";
 import {
+  getExecutorOrganizationHeaders,
   getExecutorApiBaseUrl,
   getExecutorServerAuthorizationHeader,
 } from "@executor-js/react/api/server-connection";
@@ -8,4 +9,5 @@ import { McpGroup } from "../api/group";
 export const McpClient = createPluginAtomClient(McpGroup, {
   baseUrl: getExecutorApiBaseUrl,
   authorizationHeader: getExecutorServerAuthorizationHeader,
+  headers: getExecutorOrganizationHeaders,
 });

packages/plugins/onepassword/src/react/client.ts

@@ -1,5 +1,6 @@
 import { createPluginAtomClient } from "@executor-js/sdk/client";
 import {
+  getExecutorOrganizationHeaders,
   getExecutorApiBaseUrl,
   getExecutorServerAuthorizationHeader,
 } from "@executor-js/react/api/server-connection";
@@ -8,4 +9,5 @@ import { OnePasswordGroup } from "../api/group";
 export const OnePasswordClient = createPluginAtomClient(OnePasswordGroup, {
   baseUrl: getExecutorApiBaseUrl,
   authorizationHeader: getExecutorServerAuthorizationHeader,
+  headers: getExecutorOrganizationHeaders,
 });

packages/plugins/openapi/src/react/client.ts

@@ -1,5 +1,6 @@
 import { createPluginAtomClient } from "@executor-js/sdk/client";
 import {
+  getExecutorOrganizationHeaders,
   getExecutorApiBaseUrl,
   getExecutorServerAuthorizationHeader,
 } from "@executor-js/react/api/server-connection";
@@ -8,4 +9,5 @@ import { OpenApiGroup } from "../api/group";
 export const OpenApiClient = createPluginAtomClient(OpenApiGroup, {
   baseUrl: getExecutorApiBaseUrl,
   authorizationHeader: getExecutorServerAuthorizationHeader,
+  headers: getExecutorOrganizationHeaders,
 });

packages/react/src/api/server-connection.tsx

@@ -96,6 +96,11 @@ export const getActiveOrgSlug = (): string | null => {
   return first && isValidOrgSlug(first) ? first : null;
 };
 
+export const getExecutorOrganizationHeaders = (): Readonly<Record<string, string>> => {
+  const orgSlug = getActiveOrgSlug();
+  return orgSlug ? { [EXECUTOR_ORG_HEADER]: orgSlug } : {};
+};
+
 export const getExecutorServerConnection = (): ExecutorServerConnection => activeConnection;
 
 export const setExecutorServerConnection = (input: ExecutorServerConnectionInput): void => {