Sync upstream v2 (141787b9a), preserving fork auth and release tooling - #87

Summary

Fork-only sync into shuv1337/executor:v2. Do not merge or deploy as part of this task. Nothing has been pushed to or opened on upstream.

• Fork parent / rollback reference: 5c4afbeb43bcea55c7efed8cf81479a924c5da51 (includes deployed fix: report unlinked pinned accounts instead of organization denial #86).
• Upstream parent: 141787b9aad4a1d4e4fab91d6e5fc7ceadee5dfc (UsefulSoftwareCo/executor:v2).
• Merge commit: a1a83a4c1cbaf3b9d3d02829e522b0ea0b09fc0f.
• Nine upstream commits: 47227e231, 326328f94, 7661912af, 5348aad46, f80a5266c, c5b7afe07, 30c9259a3, 2f4c398f3, 141787b9a.
• Follows prior sync PRs: a real two-parent merge, retaining fork behavior and an apps fork-version suffix.

Upstream highlights

• Auth/security observability: request-span credential kinds and non-secret IDs, classified refusal reasons, security-action audit records, impersonation attribution, Cloud client-network metadata and v1 handoff/forward tracing. Credential resolution records purpose, account and actor without credentials.
• Nested remote MCP results discard JSON text that merely repeats structuredContent, avoiding result duplication at each Executor hop; other content remains.
• Credential-check failures explain that the app's check may be wrong and provide a copyable fix prompt; the user may still add credentials.
• Alchemy state-store probing fails closed instead of bootstrapping over a live store on transient failure; opt-in instance-ID recovery support. Cloudflare observability destination lookup now paginates.
• Upstream README becomes a user-facing introduction, with development documentation moved to DEVELOPMENT.md. CLI advances to 2.0.0-beta.38; fork apps is 0.0.1-beta.122.shuv.1.

Conflicts: 13 files

Both sides' behavior was retained, not wholesale ours/theirs selection:

• README.md: take upstream's introduction/development split; move the fork's live-query throttling explanation into DEVELOPMENT.md.
• apps/hosted/server/src/contracts/api.ts: retain ConnectionKeyRefused and adopt public Viewer rather than internal Principal.
• contracts/app-ui.ts, implementation/app-sessions.ts, implementation/app-ui.ts, implementation/auth.ts under the same server directory: retain caller email / ctx.caller identity while carrying upstream impersonation attribution and refusal/request telemetry.
• contracts/mcp.ts: retain connection-key mint/list/revoke methods; adopt stored connection/grant IDs as revocation results for audit records.
• implementation/bearer-access.ts: keep connection-bound keys, generations and API refusal; adapt the fork's refusals to upstream's telemetry reason argument (wrong_resource/revoked).
• implementation/mcp-connections.ts: retain scoped management checks and all key endpoints; emit upstream revocation audit only after the fork's revoke completes.
• implementation/mcp-http.ts: retain request caller identity and connection-bound reauthentication alongside upstream refusal instrumentation.
• implementation/mcp-oauth.ts: retain bound-key deletion, then return the stored revoked ID and upstream uninterruptible completion; retain the fork's schema alias/imports and key endpoints.
• implementation/organization.ts: telemetry wraps authorization against the fork's narrowed calling-connection policy, never the wider original grant.
• packages/apps/package.json: advance upstream base while retaining fork naming, 0.0.1-beta.122.shuv.1.

Additional integration adjustments:

• Preserve the fork's public viewer email in implementation/api.ts, while excluding internal impersonatedBy.
• Existing MCP span E2E exposed missing caller/organization attributes on the fork's mcp.discovery.accounts.batch span. Use the existing withOperationSpan helper rather than raw Effect.withSpan. The scenario failed on exactly those two missing attributes before the fix and passed afterward. No assertions, retries or timeouts were weakened.
• Refresh skill digests with the existing generator. Keep lockfile churn to the CLI/apps workspace versions; frozen install passes.

Fork preservation and risks

• fix: report unlinked pinned accounts instead of organization denial #86's ConnectionAccountUnlinked contract, account resolver, HTTP/MCP error handling and relink UI remain intact; all three explicitly requested regression scenarios pass.
• Scoped connection keys, owner-only management, key revocation/ID reuse, narrowed nested Executor calls, caller identity and shared runtimes pass focused coverage.
• Fork app management, release scripts, .github workflows, self-host/native tooling and Better Auth security patches are unchanged from the fork parent. No migration files or host protocol records changed. Protocol check confirms live 14 and retained 1–13.
• Highest-risk merge areas are authentication/authorization and audit attribution. Self-host exercises those shared paths; Cloud-only impersonation, client metadata, v1 forwarding and Alchemy recovery were not run against Cloud. No deployed target or production data was used.
• Auth telemetry now carries additional opaque identifiers and, on Cloud, client network metadata; review normal telemetry retention/access policy before shipping.
• Required private notes/ documents are absent from the public export (existing papercut pc_dcf8902b5987); available AGENTS, development and E2E guidance were followed.

Local validation

Passed:

• Canonical and task bun run workspace:check before editing.
• bun install --frozen-lockfile.
• bun run executor:intro, bun run format, bun run check (all nine typecheck projects; existing Effect warnings only; patch, protocol and structural checks pass).
• bun run e2e:prepare.
• 18 distinct self-host scenarios passed across focused runs; no full suite.

Required command: 3 passed:

bun run e2e:self-host --test-name 'Pinned (many|plain)-account connections|pinned account is replaced during an execution'

Additional named coverage (15 passed):

• Member scoped-connection create/update/revoke/mint; admin connection-key widening refusal; full-member narrowing through Executor.
• Connection-key expiry, wrong URL/API refusal, revoke and ID reuse; individual key listing/revocation.
• Caller identity across MCP/dashboard/workflows; shared-runtime identity isolation.
• Private app bookmark authentication and live session revocation.
• Hosted request credential/refusal/audit telemetry; management API organization attribution; MCP operation/bearer attribution.
• Nested Executor structured-result deduplication.
• Credential-check failure UI/redaction.
• OAuth renewal through outages/refusal, including credential-purpose tracing.

Evidence (checkout-relative, private; filenames contain runner timestamps):

• .local/e2e/2026-11-10T08-53-19.127Z-self-host-e313c1 — required 3 passed.
• .local/e2e/2026-11-10T08-53-54.603Z-self-host-e6641b — 10 passed, MCP span failure retained as regression evidence.
• .local/e2e/2026-11-10T08-55-02.163Z-self-host-e6d936 — corrected MCP span scenario plus 4 additional scenarios, all passed.

CI: passed — fork-ci run 42786736445, check in 2m13s and security-e2e in 3m2s. Waited for completion. The check job includes its six self-contained E2E suites; security-e2e builds the real target and runs its selected scenarios. Existing Effect and Actions runtime-deprecation warnings are non-blocking. The fork's workflow has its own fixed selection, independent of upstream's selection block.

all: upstream sync changes bun.lock workspace versions and dependency patches

Redeploy / release notes (not performed)

• A separately authorized host/image rebuild and redeploy is needed to ship the server, UI and telemetry changes. No schema migration or data reset is introduced by this sync.
• Apps package becomes 0.0.1-beta.122.shuv.1; no package, tag or release was published. Follow the fork's app-release flow separately. Existing built apps keep their pinned framework: to pick up nested-MCP result deduplication, update the apps dependency and redeploy the affected authored app after that release is available.
• Cloud state recovery is opt-in incident tooling, not a routine redeploy instruction; no recovery variables were configured and no state was removed.