Org-slug console URLs across cloud, self-host, and cloudflare hosts#974
Merged
Conversation
RhysSullivan
commented
Jun 12, 2026
RhysSullivan
left a comment
RhysSullivan
left a comment
Collaborator
Author
There was a problem hiding this comment.
dont merge without removing sequential ids from org slugify
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
executor-cloud | ea800cf | Jun 13 2026, 05:42 PM |
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
executor-marketing | ea800cf | Commit Preview URL Branch Preview URL |
Jun 13 2026, 05:42 PM |
RhysSullivan
force-pushed
the
claude/sharp-shirley-295497
branch
from
d0442e8 to
555ca43
Compare
Collaborator
Author
|
Rebased onto main (now includes the edge auth gate #975, fresh-worktree env #973, and the spec-blob stack). Two behavioral changes from the rebase:
Gates re-run post-rebase: unit suites green, selfhost e2e 18/18, cloud e2e green (the |
Contributor
Cloudflare previewTorn down — the PR is closed. |
@executor-js/cli
@executor-js/config
@executor-js/execution
@executor-js/sdk
@executor-js/codemode-core
@executor-js/runtime-quickjs
@executor-js/plugin-file-secrets
@executor-js/plugin-graphql
@executor-js/plugin-keychain
@executor-js/plugin-mcp
@executor-js/plugin-onepassword
@executor-js/plugin-openapi
executor
commit: |
RhysSullivan
force-pushed
the
claude/sharp-shirley-295497
branch
2 times, most recently
from
62c04ef to
bbf47a6
Compare
Collaborator
Author
|
Rebased onto main again (PostHog instrumentation #987, render-shell-from-hint #986, hosted-client redirects #989). Two integration points from this round:
Also since the last update, per review feedback:
Post-rebase verification: unit gates green; cloud e2e 32/34, selfhost 17/19 — the four failures are two scenarios × two targets, all Deploy order for cloud remains: apply migration |
RhysSullivan
force-pushed
the
claude/sharp-shirley-295497
branch
from
bbf47a6 to
dc151c8
Compare
This was referenced Jun 13, 2026
Console routes now live under an optional {-$orgSlug} segment
(executor.sh/<org-slug>/policies). One shared route contract serves every
host: org-scoped hosts canonicalize bare URLs onto the active organization's
slug via a shared OrgSlugGate; local/desktop never set the param and stay
bare.
- packages/core/api: org-slug vocabulary (grammar, RESERVED_ORG_SLUGS,
slugify + unique generation), AccountOrganization gains slug
- packages/react: consoleRoutes() nests the contract under /{-$orgSlug}
(orgScoped option for app routes inside the scope), shell links/nav are
scope-relative, OrgSlugGate canonicalizes (session-moved guard prevents
switch-back races that invalidate single-use WorkOS session refreshes)
- per-app tsr.routes.ts is the single route-tree definition consumed by both
vite configs and the new routes:gen scripts (programmatic generator)
- cloud: organizations.slug column (unique) + migration + backfill script;
slugs minted at create/accept and lazily on resolution; org switcher and
create-org land on the new org's slug URL; foreign slugs switch the session
when the caller is a member; onboarding routes stay bare
- self-host: seed adopts the existing single org on slug change instead of
forking the instance; EXECUTOR_ORG_SLUG validated against the grammar;
/join/$code stays bare
- cloudflare: SELF_HOSTED_ORG_SLUG env (validated) exposed through the
account provider
Pins the slug-URL contract end to end: /account/me advertises a grammar-valid slug, bare deep links canonicalize onto it, unknown slugs snap back to the active org, and in-shell navigation keeps the prefix. Runs against cloud and selfhost.
A URL naming an org the session can't see now renders the not-found page (shared OrgSlugNotFound, same shape as cloud's route 404) instead of silently canonicalizing into the active workspace. Cloud still switches the session when the caller is a member of the slug's org. This also keeps single-segment typo paths (/this-page-does-not-exist) rendering as 404s — they match the slugged index route, so the gate is the 404 for them.
acme-corp-x7k2 instead of acme-corp-2: ordinals are enumerable, leak how many orgs share a name, and rank whoever came second. Four chars from a look-alike-free base32 alphabet (no 0/o, 1/l), retried against isTaken.
The connect-agent card and setup-mcp onboarding now print /<org-slug>/mcp instead of /org_xxx/mcp. Server-side the MCP path classifier claims slug-shaped segments alongside the legacy org_ form (the slug grammar reserves every routable root segment, so console paths ending in /mcp still fall through to the SPA), and the org authorizer resolves a slug through the mirror before the live WorkOS membership check — the URL stays a selector, not a trust boundary. Existing org_-pinned URLs in agents' configs keep working; discovery docs echo whichever selector form the client used. Self-host and cloudflare cards print the bare /mcp — their servers only mount the bare endpoint and a single-org instance has nothing to select.
Main's edge gate now renders the real shell from the hint, so the hint must carry the org slug (minted lazily like everywhere else) or the first paint has no slug to canonicalize onto. The foreign-slug state renders inside the shell chrome via the shared shell's content slot, matching main's in-shell route 404; connect-panel asserts the slug-form MCP command.
#991 seeds the API client + connect-card MCP URL from the document request origin (request.url). Behind a proxy that terminates TLS and forwards plain HTTP upstream — tailscale serve for the dev-share workflow, or an nginx/Caddy front — request.url is http:// while the browser is on https://, so the HTTPS page got an http:// API base and blocked it as mixed content. Derive the origin from X-Forwarded-Proto/ -Host when present (extracted to a pure, unit-tested request-origin module). No-op on Cloudflare, where request.url already carries the external https origin.
The component collapsed loading / no-match / matched-org into one null|"none"|org value, re-derived the id off it, then ran a side-effecting switch through a mutable ref guard. The failure branch only flipped the ref (no re-render, match still present), so a failed switch sat on "Switching organization…" forever — never the 404 the comment claimed. Split it: render is now a pure AsyncResult.match over the three states, and the one side effect (switch + reload) lives in a small SwitchIntoOrg child that tracks failure in state, so a failed switch renders not-found. Adds e2e coverage for the switch-by-URL path (open another of your orgs by slug -> session switches into it), which had none.
RhysSullivan
force-pushed
the
claude/sharp-shirley-295497
branch
from
2ac5e0a to
ea800cf
Compare
RhysSullivan
added a commit
that referenced
this pull request
Jul 2, 2026
The cloud e2e project never gated CI either, so ten scenarios rotted. Refresh the four whose product behavior moved intentionally: - connect-card-ssr-origin: install URLs are org-slug-scoped since the org-slug console URLs change (#974); accept the slug form. - connection-owner-isolation: /api/auth/switch-organization was deleted with cookie-based org switching (#1000); switch orgs the way the web client does, via the x-executor-organization selector header. - oauth-connections: the popup-state fix (#1235) envelopes the callback state as base64url JSON; decode it and assert the inner state + orgSlug. - unauthenticated-skeleton: the 404 page shipped as a standalone page in the same commit as the shell-framed assertion (#986); assert the page it actually renders. Quarantine the six that need product/harness work, each with a reason: mcp-browser-approval-org-scope + the two browser-approval scenarios (cloud-only: the mcporter browser-approval completion never lands), cli-device-login (device-flow terminal never reaches the emulator), and run-panel-auto-approve (autoApprove leaves the run paused; never green since the feature landed in #1183).
RhysSullivan
added a commit
that referenced
this pull request
Jul 2, 2026
* e2e: fix stale docs, harden dev-CLI status, add cloud+selfhost CI jobs - e2e/AGENTS.md: the anatomy example predated the service-yielding scenario() signature (no more needs/ctx); capability notes said browser was cloud-only and mcp-oauth selfhost-only, both wrong per targets/*.ts; file placement now lists cloudflare/, local/, cli/; document summary, motel, test:* scripts, the viewer/ SPA, pr-media, and the Windows desktop/cli VM targets. - e2e dev CLI status: probe the app URL before reporting ready (a zombie runner with a dead server used to read as healthy), and only parse real state files in .dev/ (cloud.journey.json rendered as a garbage DEAD line). - CI: run the cloud and selfhost e2e projects on every PR/push with failure artifacts (trace.zip, session.mp4, step screenshots) uploaded per target. * Fix the MCP regressions and policy gaps the e2e suite caught Cloud (hibernatable MCP DO rework fallout): - server.ts no longer gates MCP dispatch behind the Axiom tracer install: with AXIOM_TOKEN unset (any dev boot without motel) every /mcp request fell through to the SPA router and 404ed. - agent-handler mounts a second serve() on /mcp/toolkits/:slug — the agents SDK builds an exact-match URLPattern, so the single /mcp handler never saw toolkit paths. - Restore the old envelope's transport contract: JSON-RPC 405 for verbs outside GET/POST/DELETE/OPTIONS (was a bare 404), 200 for session DELETE (agents SDK answers 204), and a reconnect-worded 404 for requests that race a condemned DO's abort. Selfhost (org-scoped MCP OAuth discovery): - The org-segment strip middleware now carries the original pathname in an internal header, and the protected-resource metadata echoes it, so a client that dialed /<org>/mcp/... passes the MCP SDK's RFC 9728 resource check. Bare paths are untouched; the header is stripped from unrewritten requests. Microsoft Graph URL policy: - microsoftHttpPlugin gains the hosts' local-network dev posture: selfhost, cloud, and the cloudflare host thread allowLocalNetwork into allowUnsafeUrlOverrides, and the override now also admits plain-http loopback URLs (local emulators). Production behavior is unchanged: the flag is unset there, and non-loopback http stays rejected even with it. Stale e2e assertion refreshed for an intentional product change: - tool-descriptions: the execute inventory is names-only since the skills tool slimming; drop the per-connection description assertions. * test(e2e): repair self-host scenarios and gate the suite in CI The self-host e2e project never ran in CI, so it drifted red while the app moved on. Repair the failing scenarios (stale connect-modal selectors, a racy action-bar position read, a shared-admin connection-count assertion, a multi-tenant-only org-slug 404 step, and a cloud-shaped toolkit MCP URL), add a documented skip affordance to the scenario helper, and quarantine the two Microsoft emulator scenarios that need a canonical block-YAML Graph spec (tracked separately). Cherry-picked from origin/fix-selfhost-e2e-and-ci (PR #1239); its CI job is superseded by the cloud+selfhost matrix job already on this branch. * test(e2e): quarantine the two agents-SDK transport gaps Both are real gaps in the hibernatable Agent bridge (standalone SSE supersede never resolves; response routing scopes JSON-RPC ids per session instead of per stream), not regressions on this branch. Skip with reasons so the suite gates CI while the gaps stay visible; fixing the bridge is tracked separately. * test(e2e): repair or quarantine the cloud scenarios that drifted on main The cloud e2e project never gated CI either, so ten scenarios rotted. Refresh the four whose product behavior moved intentionally: - connect-card-ssr-origin: install URLs are org-slug-scoped since the org-slug console URLs change (#974); accept the slug form. - connection-owner-isolation: /api/auth/switch-organization was deleted with cookie-based org switching (#1000); switch orgs the way the web client does, via the x-executor-organization selector header. - oauth-connections: the popup-state fix (#1235) envelopes the callback state as base64url JSON; decode it and assert the inner state + orgSlug. - unauthenticated-skeleton: the 404 page shipped as a standalone page in the same commit as the shell-framed assertion (#986); assert the page it actually renders. Quarantine the six that need product/harness work, each with a reason: mcp-browser-approval-org-scope + the two browser-approval scenarios (cloud-only: the mcporter browser-approval completion never lands), cli-device-login (device-flow terminal never reaches the emulator), and run-panel-auto-approve (autoApprove leaves the run paused; never green since the feature landed in #1183). * lint: suppress the adapter-boundary error checks in the MCP agent handler The condemned-DO abort surfaces as a plain runtime Error thrown out of the agents SDK's serve.fetch; its message string is the only signal. Narrow suppressions with boundary reasons, per the typed-errors skill. * test(e2e): quarantine the seat-limit scenario on the emulate 0.9.0 Autumn gap emulate 0.9.0's Autumn customer balances omit the expanded feature object autumn-js asserts, so useCustomer crashes the org page into the error boundary. Fixed upstream in UsefulSoftwareCo/emulate#8 (0.9.1); unskip once the publish lands and the e2e dependency is bumped. * ci: retrigger * ci: shard the cloud e2e job so each shard gets a fresh dev stack A full-suite run against one long-lived cloud dev server degrades partway through: sign-in starts refusing connections and everything after fails with fetch errors (the same SSE/OTel memory growth being instrumented on main). Four shards, each booting its own stack, stay under the threshold. Re-merge into one job once the leak is fixed. * ci: split the cloud e2e job into eight shards Four shards still hit the dev-server degradation a few minutes in on 2-core runners; eight keeps each stack's lifetime under the threshold. * ci: retry flaky browser scenarios twice on the same stack The remaining shard failures are scattered single-test Playwright waitFor timeouts on 2-core runners, not systemic stack death; vitest --retry clears them without hiding real regressions (a consistent failure still fails after 3 attempts). * test(e2e): quarantine the Graph default-add scenario on CI runners Compiling the Graph spec inside dev workerd 500s on 2-core GitHub runners and takes the dev stack down for every scenario after it in the shard (the auth-hint/org-slug/docs-link failures in the same shard were all downstream of this). Local runs are unaffected; skip only under CI. * selfhost: read the local-network posture from env in the plugins seam plugins() runs per request; loadConfig() does filesystem work (data dir, secret key resolution) that should not ride the request path. The env read is the same computation loadConfig makes for the flag. * e2e: bump @executor-js/emulate to 0.10.0, unskip the seat-limit scenario 0.10.0 ships the Autumn balances.feature expansion autumn-js asserts (UsefulSoftwareCo/emulate#8), so the org page renders again and the scenario passes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Console URLs now carry the organization slug on org-scoped hosts:
executor.sh/<org-slug>/policiesinstead of/policies. One shared route tree serves every host — cloud, self-host, and the Cloudflare host canonicalize onto the active organization's slug, while local/desktop keep bare URLs.How
Routing. Every shared console route nests under an optional
{-$orgSlug}segment, so the same TanStack tree matches both bare and slug-prefixed paths. The TanStack generator rewritescreateFileRoute()ids on disk to match the mounted path, so all consumers must mount the shared files identically — each app now has atsr.routes.tsread by both its vite config and aroutes:genscript (programmatic@tanstack/router-generator), keeping CLI regens and dev builds in lockstep.Canonicalization. A shared
OrgSlugGatemounted inside each authenticated shell pins the URL to the active org's slug: bare URLs redirect in place (path + query preserved), unknown slugs snap back, and on cloud a foreign slug the caller is a member of switches the session into that org. The gate distinguishes "URL is foreign" from "session moved out from under the URL" (org create/switch elsewhere) — without that, the gate races the in-flight switch and rotates the single-use session refresh twice, invalidating the cookie. The URL slug is a selector, not a trust boundary; sessions scope every API call server-side.Slugs. A shared vocabulary in
@executor-js/apiowns the grammar (2–48 chars of[a-z0-9-]), a reserved-segment list (api,mcp,login, console sections, marketing paths,cdn-cgi, …), name-derived slug generation with-2/-3suffixing on collision, and validation helpers.AccountOrganization(/account/me) now carriesslug.Per host:
organizations.slugunique column (+ migration and an idempotent backfill script — the runtime also mints slugs lazily on first resolution, so the backfill is pre-warming, not a deploy gate). Slugs are minted at org create / invite accept and are stable across renames so org URLs survive. The org switcher and create-org flows land on the new org's slug URL. Onboarding (/create-org,/setup-mcp) stays bare.EXECUTOR_ORG_SLUGwould have silently forked the instance with a second org — it now adopts the single existing org and renames its slug. The env var is validated against the grammar at boot./join/<code>invite links stay bare.SELF_HOSTED_ORG_SLUGvar (validated), surfaced through the account provider.Testing
e2e/scenarios/org-slug-routing.test.ts(recording above):/account/meadvertises a grammar-valid slug, bare deep links canonicalize, unknown slugs snap back, in-shell navigation keeps the prefix. Green on cloud and selfhost.format:check,lint,typecheck,testall green.Deploy notes (cloud)
slugcolumn) before or with the deploy — old code ignores the column, new code lazily mints slugs, so ordering is forgiving.db:backfill-org-slugs:prodafterwards to pre-mint slugs in bulk.