[shuv1337]

Merges UsefulSoftwareCo/executor v2 at 04f358c97 (executor@2.0.0-beta.36) into the fork with a merge commit. Does not tag, release, or deploy.

credential-hosts.spec.ts
app-package.spec.ts
cloud-v1-import-run.spec.ts
cloud-v1-import.spec.ts
cloud-oauth-proxy.spec.ts
self-host-short-names.spec.ts

Incoming commits

Merge-base cd6048d26. Six commits:

• a14e2fac1 Export f0ca0ceb

• 2070377d0 Export 649546de

• d59655b0f Export 36110f42

• 12aa620f8 Export 87285251

  Cloud v1-import rework and app-slug tightening (appSlugFits, addresses cut to a DNS label).

• 40e983b04 Export a94fb31e

  Host protocol 14, which allows underscores in credential hosts, plus apps 0.0.1-beta.120. protocols/14.json, gates.json, and released.ts move with that version. Protocol 13 is frozen.

• 04f358c97 Export 8668df23

  better-auth and @better-auth/* 1.7.5 to 1.7.16. Patches regenerated. The @better-auth/core patch is dropped.

The fork's own changes stay, including the #74 CLI short-name fix (1e3a5ff). apps/cli stays at upstream's 2.0.0-beta.35.

Conflict resolutions

Git reported two conflicts:

• packages/apps/package.json: version is 0.0.1-beta.120.shuv.1, the fork's .shuv.N suffix on the new base. No 0.0.1-beta.120.shuv release exists yet, so N is 1.
• bun.lock: regenerated with bun install. better-auth@1.7.16 was published the same day, so the install used --minimum-release-age=0 once; bun install --frozen-lockfile then succeeded with the age gate on. The lock holds better-auth@1.7.16, Playwright 1.64.1, and apps@0.0.1-beta.120.shuv.1. No patchedDependencies selector remains on 1.7.5. patches:check reports 22 applied patches.

Two further resolutions were not git conflicts:

• Protocol 13's snapshot on the fork already records caller identity, shared runtimes, and human on approval failures. Upstream's new frozen module did not. The module now matches that snapshot, and protocols/14.json was re-recorded so the live protocol includes the same fields. gates.json and released.ts are upstream's. bun run apps:protocols passes: protocols 1–13 unchanged, protocol 14 recorded, older bundles still accepted. The version, protocols/14.json, gates.json, and released.ts move together relative to fork v2.
• An owner can make a connection again with a revoked connection's id, which revives that row. A second v1 import of the same toolkit copy must not revive it: the revoked copy keeps its id, and the new copy takes the next generation. importToolkit skips a generation whose id is still held by that owner's revoked connection.

fork-ci did not need a suite-list change. The new test-plan scenarios are credentialHostsUnderscore (self-host) and v1ImportLongNames, v1ImportToolkitScale, v1ImportIntoEnterprise (cloud). They live in spec files those jobs already run when those targets run. fork-ci's self-contained suites (pglite, typecheck-runner, prepare-cache, emulator-failures, dashboard-file-names, release-archives) gained no scenarios.

Review fixes (ce08ca21a)

• OAuth proxy guard decrypts with better-auth 1.7.16 purpose keys. The better-auth@1.7.16 patch exports derivePurposeKey from better-auth/crypto (HKDF-SHA256, salt better-auth:oauth-encryption:v1, info better-auth:<purpose>:v1, 32 bytes, hex). The guard uses purposes oauth-proxy-package and oauth-proxy-state. A decrypt or parse failure throws in the before hook, so the plugin never redirects. A 32-character own sign-in token is still passed through. cloudOAuthProxyRefusal covers an untrusted redirect (403), a trusted one, and malformed or undecryptable state (400).
• A failed v1-import attempt keeps the last v2_id (14_v1_import_failed_keeps_id relaxes the map check so failed may keep an id; imported still requires one). Toolkit copies with any v2_id stay saved. The generation walk, used for unsaved and unmapped, always skips an id a revoked connection still holds. Artifact retries reuse that app id. v1ImportRevokedRetry imports, rolls back, then imports a twin whose toolkit rows are the failed-with-null-id state a dropped id would leave, and checks generation 0 stays revoked.
• A published protocol-13 apps release is not in the e2e npm lock (it stops at 0.0.1-beta.95; protocol 13 is 0.0.1-beta.119, which is not locked). The credential-hosts pin was left out.

Upstream 04f358c97 has the same OAuth proxy bug: apps/hosted/cloud/src/implementation/oauth-proxy-guard.ts decrypts with key: secret at lines 93 and 103.

Test results

• bun run check: passed, including typecheck (9 of 9 projects).
• go test in apps/hosted/self-host/native: passed. That is the only unit suite; other tests are end to end.
• bun apps/hosted/server/scripts/check-better-auth-security.mjs: passed.
• node scripts/check-patches.ts: passed (22 patches, none on better-auth 1.7.5).
• Self-host, 2 workers, 96 tests in 47 files, all passed (583s). Includes credential-hosts (the underscore host), app-package (supported protocols through 14), the OAuth and API-key scenarios scheduled on self-host, and self-host-short-names (fix: restore app short-name lookup for older CLI clients (#71) #74). After the review commit, that self-host selection was run again and passed.
• Local, 2 workers: 5 passed. local-oauth, both local callback scenarios, local renewal interruption, and oauth-refresh-redirect-uri.
• Cloud, managed local Cloud (Docker): passkey scenarios passed (cloud-passkey-moved, passkey enrollment refresh, onboarding registers a passkey, onboarding can skip a passkey). cloud-v1-import-run and cloud-v1-import ran together: 37 passed, 3 failed. Isolated rerun: the WorkOS emulator 500 and the 60s timeout both passed. v1ImportIntoCopy failed again because a rolled-back copy was revived under its old id. After the import fix, that scenario passed alone.
• After the review commit, the cloud filter for v1 import, passkey, and the OAuth proxy refusal ran 40 passed, 2 failed, 7 skipped. The two new scenarios failed on the edge callback hop and a run id longer than 24 characters. Isolated rerun of cloudOAuthProxyRefusal and v1ImportRevokedRetry passed.
• fork-ci on ce08ca21a: success.

Still to run after deploy

• A self-host sign-in
• An API-key bearer call
• One OAuth or passkey flow
• An older-protocol app still running

  

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​better-auth@​1.7.5 ⏵ 1.7.16	-25	+75		+1
	npm/​@​better-auth/​api-key@​1.7.5 ⏵ 1.7.16	+1		+1	+1
	npm/​@​better-auth/​sso@​1.7.5 ⏵ 1.7.16	+1		+1	+1
	npm/​@​better-auth/​oauth-provider@​1.7.5 ⏵ 1.7.16	+1		+1	+1
	npm/​@​better-auth/​core@​1.7.5 ⏵ 1.7.16	+1		+1	+2
	npm/​@​better-auth/​passkey@​1.7.5 ⏵ 1.7.16	+1		+1	+1

View full report