Merge main into cloudflare-mcp-do-hibernation-standalone

Brings the branch up to date with main (78 commits). Non-trivial integration:
main added toolkit-scoped MCP (`/mcp/toolkits/<slug>`, an `McpResource` threaded
through the session flow) while this branch replaced the old session DO with the
hibernatable Agent DO. Ported `resource` onto the new `McpAgentSessionDOBase`
(McpSessionInit + SessionMeta) and threaded it through both agent handlers:
host-cloudflare always serves the default resource (only `/mcp` routes to the
bridge), cloud derives the toolkit resource from the request path.

Kept the four old-impl files deleted (main had modified them; no new consumers).

Author: RhysSullivan

.changeset/core-tools-no-auth-connections.md

@@ -0,0 +1,5 @@
+---
+"executor": patch
+---
+
+Add a test seam to skip the first-run "keep Executor running in the background?" consent dialog under automation, matching the existing `confirmResetState` seam. Set `EXECUTOR_TEST_AUTO_CONFIRM_BACKGROUND_SERVICE=1` to keep the background service or any other value to decline. When the variable is unset the dialog is shown exactly as before. Native dialogs cannot be answered from CDP or Playwright, so a packaged first-run boot under automation previously blocked at this prompt with no way to proceed.

.changeset/desktop-background-service-consent-seam.md

@@ -0,0 +1,5 @@
+---
+"executor": patch
+---
+
+Fix the desktop app failing to start its local server when the generated auth token begins with a dash. The token is `randomBytes(32).toString("base64url")`, which can start with "-", and the packaged app passed it to the bundled CLI as a separate argument (`--auth-token`, then the token). The CLI then read the leading-dash token as an unknown flag, printed its help, and exited, so the desktop showed a fatal "local Executor server crashed during startup" dialog. This was persistent (the token is saved) and cross-platform, affecting roughly 1 in 64 fresh installs. The token is now passed in the combined `--auth-token=<value>` form so a leading dash is treated as the value.

.changeset/desktop-sidecar-auth-token-dash.md

@@ -0,0 +1,9 @@
+---
+"@executor-js/plugin-graphql": patch
+---
+
+Fix the GraphQL plugin generating invalid operations against large schemas, and make field selection caller-controlled instead of a baked-in guess.
+
+Previously each tool froze a recursive, depth- and count-bounded selection at sync time. Against a rich schema (GitLab) this produced invalid GraphQL (composite fields with no sub-selection, nested fields missing required arguments) so every call over a rich return type failed, and the arbitrary bound silently truncated which fields came back.
+
+Generated tools now default to selecting only scalar/enum leaf fields of the return type (always valid, always within a server's query-complexity budget), and expose an optional `select` input carrying a GraphQL selection set so a caller can request nested or list data per call (including supplying nested required arguments). Fixes #1146.

.changeset/graphql-valid-selections.md

@@ -0,0 +1,77 @@
+---
+name: self-contained-modals
+description: "Build modals/dialogs self-contained: form and in-flight state lives inside, closing unmounts it. Use when writing or reviewing a modal/dialog, especially one that owns async work (OAuth popups, timers, subscriptions, AbortControllers). Catches the stuck-on-Connecting class of lifecycle-leak bugs."
+---
+
+# Self-contained modals
+
+A modal's **form state and in-flight work live INSIDE the modal**, and **closing
+the modal UNMOUNTS that state** so it is destroyed, not hand-reset. Only the
+**open/route intent** belongs to the parent (deep links, programmatic open,
+reconnect handoffs need it).
+
+## Why
+
+A hand-written `reset()` has to enumerate every field, and it silently drifts out
+of sync with state owned by **child hooks the parent can't see**. Unmounting
+resets everything for free, including child-hook cleanup effects (cancelling a
+dangling server session, clearing a timer, aborting a fetch).
+
+Concrete bug this prevents (executor, add-account-modal): the modal was mounted
+unconditionally, so `useOAuthPopupFlow`'s `busy` survived close. `reset()` zeroed
+its own booleans but never called `oauthPopup.cancel()`. Abandon the OAuth popup,
+close, reopen, and `oauthBusy = false || busy(true) = true`, so the footer is
+wedged on "Connecting…" with Close disabled. Unmounting would have cleared `busy`
+AND run the hook's cleanup that cancels the server OAuth session.
+
+## How to apply
+
+Default to **genuine conditional unmount**, state inside. When closed the
+component returns `null`, so React destroys all of it and runs every child
+hook's cleanup. This is the cleanest fix and the one to reach for first:
+
+```tsx
+function Parent() {
+  const [open, setOpen] = useState(false);
+  return open ? <Modal onClose={() => setOpen(false)} /> : null;
+}
+```
+
+A key bump (`<Body key={openCount} />`) is **still a manual reset**, just
+spelled as a remount. Prefer real unmount; only reach for keyed remount in the
+one case below.
+
+That case: **Radix Dialog** (this repo's `components/dialog.tsx`) Content/Overlay
+use `data-[state=closed]:animate-out` exit animations, so unmounting the whole
+`Dialog` drops the close animation. If you must keep that animation, keep the
+`Dialog` + `DialogContent` shell mounted and remount only the state-bearing
+**body** per open:
+
+```tsx
+function Parent() {
+  const [open, setOpen] = useState(false);
+  const [openCount, setOpenCount] = useState(0);
+  return (
+    <Dialog open={open} onOpenChange={setOpen}>
+      <DialogContent>{open ? <ModalBody key={openCount} /> : null}</DialogContent>
+    </Dialog>
+  );
+}
+```
+
+This only works when `DialogContent` is **independent of body state**. If the
+shell depends on the body (e.g. a width className driven by the body's current
+sub-view), the body must own `DialogContent`, so there is no stable shell to
+keep, and genuine unmount (losing the exit animation) is the right call. That is
+exactly the executor add-account-modal: it genuinely unmounts and accepts the
+lost animation rather than plumbing body state up to a shell.
+
+## Reviewing: flag these smells
+
+1. A hand-written `reset()` exists. Its presence means state outlives the modal;
+   ask why the modal isn't just unmounted.
+2. An always-mounted dialog (rendered unconditionally with an `open` prop) that
+   owns async/in-flight state: popups, timers, subscriptions, AbortControllers,
+   server sessions.
+3. A busy/loading flag composed from a child hook (e.g. `ccBusy || someHook.busy`)
+   where `reset()` clears only part of it.

.changeset/openapi-file-emit-descriptions.md

@@ -74,6 +74,44 @@ jobs:
 
       - run: bun run test
 
+  e2e-local:
+    name: E2E (stdio MCP)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.3.11
+
+      # The local scenarios boot a real `executor web` (which spawns a Node
+      # sidecar) and some drive a browser, so pin Node 22 and install Chromium.
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - run: bun install --frozen-lockfile
+
+      # `chromium` and the new `chromium-headless-shell` ship as separate
+      # downloads; the browser-driven scenarios launch the headless shell.
+      # Install from e2e so bunx resolves ITS pinned playwright (the version the
+      # tests run against) rather than floating to the latest, which would fetch
+      # a browser build the test runtime does not look for.
+      - name: Install Playwright Chromium
+        run: bunx playwright install --with-deps chromium chromium-headless-shell
+        working-directory: e2e
+
+      # The `local` project is excluded from the default `test` chain (each
+      # scenario boots its own `executor web`). Run just the stdio MCP scenario
+      # here: it is the auto-connect / env-as-secret regression guard, and
+      # running it alone avoids the boot-resource accumulation and the
+      # pre-existing browser flakiness of the rest of the local suite. Expanding
+      # to the full `local` project (bun run test:local) is a follow-up once
+      # those are stabilized.
+      - name: Run the stdio MCP scenario
+        run: bunx vitest run --project local local/stdio-mcp.test.ts
+        working-directory: e2e
+
   desktop-smoke:
     name: Desktop smoke build
     runs-on: ubuntu-latest

.claude/skills/self-contained-modals/SKILL.md

@@ -153,6 +153,7 @@
     "vendor/",
     "emulators/",
     "e2e/runs/",
+    "e2e/desktop-packaged/linux-vm/repro.mjs",
     "node_modules/",
     "packages/core/fumadb/",
     "packages/core/sdk/src/vendor/json-schema-to-typescript/",

.github/workflows/ci.yml

@@ -48,8 +48,8 @@ working instance of X" — read them before inventing a boot path.
   screenshots, `session.mp4` + `trace.zip` for browser scenarios, and the
   scenario source as `test.ts`.
 - `cd e2e && bun run serve` builds the viewer and serves the scenario ×
-  target matrix over HTTP, bound to all interfaces (reachable over the
-  tailnet). It prefers port 8901 but walks forward to the next free port if
+  target matrix over HTTP, bound to all interfaces. It prefers port 8901
+  but walks forward to the next free port if
   that's taken (so concurrent worktrees, or a leaked previous viewer, never
   wedge each other) — read the printed `e2e viewer → …` URL for the actual
   port. `PORT=…` pins a port explicitly and fails loudly if it's busy. The
@@ -77,14 +77,14 @@ emulator ledger — develop interactively, then crystallize the journey into
 a scenario.
 
 ```sh
-bun run cli up selfhost --share   # boot, reachable over the tailnet, stays up
-bun run cli up cloud --share      # emulated WorkOS+Autumn, tailscale-HTTPS fronted
+bun run cli up selfhost --share   # boot, shared, stays up
+bun run cli up cloud --share      # emulated WorkOS+Autumn
 bun run cli status                # what's running, URLs, creds
 bun run cli identity selfhost     # fresh identity (headers / cookies / creds)
 bun run cli api selfhost tools.list
 bun run cli mcp selfhost call execute '{"code":"return 1+1;"}'
 bun run cli ledger cloud workos   # what hit the emulator
-bun run cli down selfhost         # tear down (also removes tailscale serves)
+bun run cli down selfhost         # tear down
 ```
 
 Instances persist until `down` — `up --share` IS the "touch it" handoff
@@ -93,15 +93,6 @@ state (API/MCP/UI), hand across the URL. State files in `e2e/.dev/` mark
 deliberate long-lived instances (vs leaks); attach scenarios to a running
 instance with `E2E_<TARGET>_URL`.
 
-Why cloud `--share` is more involved (encoded in the CLI, kept here for
-when you hit it manually): the cloud app sets `secure: true` auth cookies,
-so login breaks over plain http from any non-localhost origin ("Invalid
-login state"). Both the app AND the WorkOS emulator get fronted with
-`tailscale serve` HTTPS, the emulator advertises its public URL on both
-sides (its `baseUrl` and the app's `WORKOS_API_URL` — the browser-facing
-authorize URL derives from the latter), and Vite must allow the public
-hostname (`__VITE_ADDITIONAL_SERVER_ALLOWED_HOSTS`).
-
 ## Environment gotchas (learned the hard way)
 
 - The shell is fish, and the working directory resets between Bash calls.
@@ -113,10 +104,6 @@ hostname (`__VITE_ADDITIONAL_SERVER_ALLOWED_HOSTS`).
   (symptom: behavior matching old code only in dev servers, while unit
   tests pass). Kill the server, clear `node_modules/.vite` /
   `.tanstack`-adjacent caches, reboot.
-- The real Tailscale CLI on this machine is
-  `/opt/homebrew/opt/tailscale/bin/tailscale`; `/usr/local/bin/tailscale`
-  is a broken shim pointing at a deleted app. The tailnet IP is on the
-  `utun` interface (100.x.y.z) if the CLI fails.
 - `bun.lock` conflicts on rebase: take either side, re-run `bun install`,
   never hand-merge.
 - Long-lived demo servers you left up for the user look like leaks to

.oxlintrc.jsonc

@@ -1,5 +1,86 @@
 # executor
 
+## 1.5.22
+
+### Patch Changes
+
+- [#1167](https://github.com/RhysSullivan/executor/pull/1167) [`add2e40`](https://github.com/RhysSullivan/executor/commit/add2e405fca8a5e20aea43d216bc8289c15e2187) Thanks [@RhysSullivan](https://github.com/RhysSullivan)! - Fix the desktop app's main-area title-bar strip pushing page content down so page headers no longer lined up with the sidebar header. The drag strip now overlays the top of the main area (behind page content) instead of reserving its own row, and the Toolkits header uses a fixed title-bar height so its bottom border aligns with the sidebar header again.
+
+- Updated dependencies []:
+  - @executor-js/local@1.4.4
+  - @executor-js/sdk@1.5.22
+  - @executor-js/runtime-quickjs@1.5.22
+  - @executor-js/api@1.4.42
+
+## 1.5.21
+
+### Patch Changes
+
+- [#1134](https://github.com/RhysSullivan/executor/pull/1134) [`78aa871`](https://github.com/RhysSullivan/executor/commit/78aa8710d774d552d6030eca060c5e72f0899461) Thanks [@RhysSullivan](https://github.com/RhysSullivan)! - Fix OAuth callbacks in cloud so they preserve the URL-selected organization when the session cookie points at another org.
+
+- Updated dependencies []:
+  - @executor-js/local@1.4.4
+  - @executor-js/sdk@1.5.21
+  - @executor-js/runtime-quickjs@1.5.21
+  - @executor-js/api@1.4.41
+
+## 1.5.20
+
+### Patch Changes
+
+- [#1132](https://github.com/RhysSullivan/executor/pull/1132) [`580fc7f`](https://github.com/RhysSullivan/executor/commit/580fc7f8b2615a0d7760b3a4daddf8d45673ef3f) Thanks [@RhysSullivan](https://github.com/RhysSullivan)! - Fix the PostHog custom MCP OAuth setup flow so Add connection opens PostHog authorization instead of falling back to manual OAuth app registration.
+
+- Updated dependencies []:
+  - @executor-js/sdk@1.5.20
+  - @executor-js/runtime-quickjs@1.5.20
+  - @executor-js/local@1.4.4
+  - @executor-js/api@1.4.40
+
+## 1.5.19
+
+### Patch Changes
+
+- [#1115](https://github.com/RhysSullivan/executor/pull/1115) [`92bd86c`](https://github.com/RhysSullivan/executor/commit/92bd86cb975ce867b3002ae9bcb6bf60da67cc48) Thanks [@RhysSullivan](https://github.com/RhysSullivan)! - Google media downloads (Drive file contents, exports, and other binary
+  endpoints) are now returned as binary responses instead of being decoded as
+  text, so files come back intact. Emit them with `emit(result.data)`.
+
+- [#1115](https://github.com/RhysSullivan/executor/pull/1115) [`92bd86c`](https://github.com/RhysSullivan/executor/commit/92bd86cb975ce867b3002ae9bcb6bf60da67cc48) Thanks [@RhysSullivan](https://github.com/RhysSullivan)! - The CLI now validates that a URL is `http`/`https` before handing it to the
+  operating system's browser opener, and on Windows opens it via
+  `rundll32 url.dll,FileProtocolHandler` instead of `cmd /c start`. This removes a
+  path where a crafted URL could be interpreted as a shell command. `executor
+login` and the "open in browser" prompts behave the same for normal URLs.
+
+- [#1115](https://github.com/RhysSullivan/executor/pull/1115) [`92bd86c`](https://github.com/RhysSullivan/executor/commit/92bd86cb975ce867b3002ae9bcb6bf60da67cc48) Thanks [@RhysSullivan](https://github.com/RhysSullivan)! - Hardened the hosted egress guard. Outbound requests from OAuth token exchanges,
+  MCP transports, and GraphQL/Google/Microsoft discovery now all route through the
+  guard, and the guard resolves DNS before connecting so a hostname that points at
+  a private or loopback address is blocked rather than only literal private IPs.
+  This tightens SSRF protection for hosted and cloud execution.
+- Updated dependencies []:
+  - @executor-js/sdk@1.5.19
+  - @executor-js/runtime-quickjs@1.5.19
+  - @executor-js/local@1.4.4
+  - @executor-js/api@1.4.39
+
+## 1.5.18
+
+### Patch Changes
+
+- [#1093](https://github.com/RhysSullivan/executor/pull/1093) [`bc24d1a`](https://github.com/RhysSullivan/executor/commit/bc24d1a4924ed8b3f09d64c639b0fe7fe02ed53d) Thanks [@RhysSullivan](https://github.com/RhysSullivan)! - `connections.create` now accepts no-auth connections (the `none` template with
+  no credential), which previously failed validation with "Expected exactly one
+  provider credential origin". Agents can wire up public, no-auth integrations
+  (public MCP servers, public REST APIs) programmatically instead of bouncing
+  through the web UI. Templates that take a credential still require exactly one.
+
+- [#1093](https://github.com/RhysSullivan/executor/pull/1093) [`bc24d1a`](https://github.com/RhysSullivan/executor/commit/bc24d1a4924ed8b3f09d64c639b0fe7fe02ed53d) Thanks [@RhysSullivan](https://github.com/RhysSullivan)! - OpenAPI tools that return a file now spell out how to emit it directly in the
+  tool's description, so an agent sees the `emit(result.data)` contract before its
+  first call instead of only discovering it after a failed attempt or by reading
+  `describe.tool`. Non-file tools are unchanged.
+- Updated dependencies []:
+  - @executor-js/sdk@1.5.18
+  - @executor-js/runtime-quickjs@1.5.18
+  - @executor-js/local@1.4.4
+  - @executor-js/api@1.4.38
+
 ## 1.5.17
 
 ### Patch Changes