[shuv1337]

Syncs UsefulSoftwareCo/executor v2 tip 5bd06da41 into the fork. Merge-base with fork v2 (ade7a4053) is 04f358c97. This PR is not merged. It does not tag, release, or deploy.

Merging this into fork v2 does not deploy production. The fork workflow is fork-ci only. Shipping the OAuth dynamic-client-registration change and the hosted workflow error contracts to prod needs Lauren's sign-off via Poteto.

Missing upstream commits

These three commits were on upstream v2 and not on the fork:

• 1d6ef5809ee59ef8e775caf569fc5a7ebb179080 Export 4b71470d
• 14dc59b093a96443916309e8f2b90a7bd9633d7e Export b407786e
• 5bd06da415d373479a1ca8033460b7cdd5fba4bd Export d5c2127a

Head of this PR is the merge of fork ade7a4053 and upstream 5bd06da41. The in-tree CLI package version in that upstream tip is 2.0.0-beta.36. Packaging notes in the same tip stop publishing per-platform runtimes as executor versions; runtimes through 2.0.0-beta.36 are deprecated. No migrations. Host protocols are unchanged (live protocol 14, bundles for 1–13 kept). better-auth stays 1.7.16; the fork's extra patch hunks are unchanged because upstream did not touch patches/better-auth@1.7.16.patch.

What upstream adds

• App outbound requests always get a User-Agent. App code's own value is kept. A request that names none is sent as User-Agent: Executor.
• Workflow listing failures are AppEvaluationFailed or a per-app provider error (WorkflowDefinitionErrors on the SDK, hosted, and local contracts), the same account used when listing tools or skills fails.
• OAuth dynamic client registration uses Better Auth clientRegistrationDefaultApplicationType: "infer". That replaces the fork's loopback-only /oauth2/register check.
• Packaging: the npm launcher is rewritten, and per-platform runtimes are no longer published to npm. Packaging-breaking only.

Security-adjacent: mixed OAuth callbacks

infer no longer refuses a registration that mixes an HTTPS web callback with a loopback or private-use callback. That registration is one native client, and every callback it names is held to the native rules. The old hook only promoted a registration when every redirect URI was loopback, so a mix stayed on the web rules and was refused.

Still refused: plain HTTP off a loopback host, and an HTTPS loopback callback on a web-only client. oauth-registration-application-type covers the mix, private-use URIs, web-only clients, and both refusals.

Conflict resolutions

Three content conflicts. Both sides' intent is kept.

packages/sdk/src/implementation/credential-handles.ts (#78)

Upstream copies the request headers and sets User-Agent: Executor when the app sent none, then scans and places credentials from that copy. The fork stamps the MCP connection this Worker was loaded for (stampCaller) and refuses a managed credential sealed for a different connection, so a scoped connection key cannot widen through the Executor app.

The merged forward does both on the same header copy. When the request carries no credential handle, stampCaller runs on requestHeaders after the default User-Agent is applied, then that copy is sent. A missing User-Agent does not skip the connection bind. When the request does carry handles, placement uses the same requestHeaders (so the User-Agent is kept) and the fork's mismatch check still runs.

A scoped connection key still cannot widen when an app request has no User-Agent. The no-handle path is the one the Executor app uses to call the host. It now fills in User-Agent and still replaces any connection id app code wrote with the connection the Worker was loaded for. A managed handle from another connection, or one that dropped the bind, is still refused.

packages/sdk/src/implementation/workflows.ts

Listing workflows maps runtime failures to AppEvaluationFailed and ProviderError to appProviderFailure, and an invalid catalog is AppEvaluationFailed. The fork's workflow behavior stays: sharedRuntime, systemCaller, and callerContext on captured runs and steps. A workflow body is still the host's own work and does not carry the MCP connection that enqueued it.

executor-skill-digests.gen.ts

Regenerated with bun run executor:intro from the merged skills. Not hand-edited. deploy.md keeps the fork's executor apps call notes and upstream's User-Agent note. Only the deploy.md digest changed (679ae66cb0b832e0fb9081ca402eaf4469128677366bfbf38570e1036dd916c8).

Verification

packages/sdk and packages/mcp-auth have no unit-test suite. This repo's tests live in e2e/ (the Go host is the only other exception). Those packages were covered by typecheck, lint, and the scenarios below.

Command	Result
bun run lint (Bun 1.3.11, the fork-ci pin)	passed
bun run typecheck	passed (existing Effect warnings only; 9 projects)
bun run e2e:check	passed
versions:check, format:check, apps:protocols, apps:telemetry, api:errors, auth:rate-limit, v1-import:access, browser-scripts, executor:intro --check, no-unit-tests, storage versions, local data steps, edge contract, e2e boundary	passed
bun run patches:check	failed locally on a pre-existing fixture (file mode differs from the patch: expected rejected, got accepted). Git 2.43.0 here does not warn when a patch's file mode differs, which is what that fixture requires. The merge does not change any patch. fork-ci on v2 passed this check on 2026-11-05.
bun run e2e:prepare then bun run e2e:self-host --workers 2 --test-name '...' (Bun 1.4.4; Motel's collector build requires 1.4.4)	7 passed, 6 skipped, 33.6s

Self-host scenarios that passed:

• An app's fetch without a User-Agent names Executor and keeps an app's own
• An app whose code fails to load fails only its own reads and names its error in every preview
• a registration without application_type is native for a loopback or private-use callback, held to the native rules, and web otherwise
• Members create, list, update and revoke their own scoped connection (Let members manage their own scoped MCP connections #77)
• an API key creates, uses and revokes its user's scoped connection (Let members manage their own scoped MCP connections #77)
• A full member connection can create a narrower Mesh connection, and a scoped connection cannot create an all-apps connection or mint a wider key (Let members manage their own scoped MCP connections #77)
• An org admin's connection key cannot widen a connection or mint outside its scope, on the API or through the Executor app (Stop a scoped connection key from widening through the Executor app #78)

app-fetch-user-agent.spec.ts
app-load-failure-containment.spec.ts
oauth-registration-application-type.spec.ts
oauth-token-telemetry.spec.ts
local-upgrade.spec.ts
mcp-connections.spec.ts
connection-api-keys.spec.ts

npm-launcher.spec.ts changed with the packaging rewrite and runs under e2e/npm-launcher.config.ts, not the self-host or local jobs. It was not run here.