Version Packages

Closed
MA
2mo ago
+389-102

This PR was opened after prepare-release versioned packages on changeset-release/main but could not create the PR itself (Actions was not allowed to create PRs). Workflow permissions are now write + create/approve PRs enabled so future prepare-release runs can open this automatically.

Merging this will publish the version bump from pending changesets.

[!NOTE]
Medium Risk
The PR is mostly versioning, but it releases OAuth scope/CIMD/DCR, Slack token handling, toolkit catalog sync, and integration policy UI changes that touch auth and tool access paths.

Overview
This Version Packages PR applies the pending Changesets release: it removes the consumed .changeset entries, bumps versions across the monorepo (notably executor 1.6.11, @executor-js/sdk 1.6.11, @executor-js/react 1.4.74), and records the aggregated notes in each package CHANGELOG.md and bun.lock.

What ships in this bump (already merged; this PR only versions and publishes it):

SDK / toolkits — OAuth scope discovery now requests advertised scopes up to an 8 KiB scope-string budget (replacing a 100-scope cap) and fixes health-check behavior when tool sync fails without a probe. Toolkit sessions narrow catalog reads by access pattern and stop blocking tools reads on TTL-only stale catalogs (background rebuild; stale/config-revision still gates within the grace budget).

React console — Tool policies from an account section apply to that connection; connection-level policy menus; members no longer see unusable policy controls; failed policy writes show the server reason. Restricted integration actions appear disabled with an admin explanation; members can browse the catalog and add personal connections.

CLI / self-host — Prefer browser OAuth when a matching client exists; accept Slack bot/user token envelopes on sign-in/refresh; EXECUTOR_OAUTH_CIMD_ENABLED=false falls back to DCR when CIMD is unreachable for automatic MCP/OpenAPI connects.

Merging publishes the versioned packages per the release workflow.

Reviewed by Cursor Bugbot for commit 335d8c4b2d602b0bd511bfca2df03dea4b11f0f8. Bugbot is set up for automated code reviews on this repo. Configure here.

Summary by cubic

Releases pending changesets as patch bumps across the workspace, updating package versions, changelogs, and the lockfile. Merging publishes the release.

Key patches in this release

  • Account-scoped tool policies now apply to the connection only, and members see disabled restricted controls with an admin explanation.
  • OAuth sign-in prefers the browser when a matching client exists, and Slack bot/user token envelopes are accepted.
  • OAuth discovery requests all advertised scopes within an 8 KiB budget, fixing tokens missing needed scopes for resources with many fine-grained scopes.
  • Self-hosts can fall back to DCR with EXECUTOR_OAUTH_CIMD_ENABLED=false; unsetting it restores CIMD without rewriting integration settings.
  • Toolkit sessions narrow catalog reads to the toolkit's access patterns and answer reads from persisted rows while stale catalogs rebuild in the background.

Summary by CodeRabbit

  • New Features

    • Browser sign-in is preferred when a matching OAuth client is available, while preserving the selected sign-in method.
    • Slack bot and user OAuth token envelopes are supported during sign-in and refresh.
    • Self-hosted deployments can use DCR when OAuth servers cannot reach the CIMD document.
    • Tool policies now apply per connection, with clearer controls and server explanations for rejected changes.
    • Restricted integration actions show why they are unavailable.

  • Bug Fixes

    • Improved OAuth scope discovery and health-check accuracy.
    • Fixed macOS update failures and surfaced rejected updates clearly.

  • Performance

    • Toolkit searches and reads are faster through narrower catalog access and background refreshes.