Version Packages

apps/cli/CHANGELOG.md

@@ -1,5 +1,30 @@
 # executor
 
+## 1.6.6
+
+### Patch Changes
+
+- [#1869](https://github.com/UsefulSoftwareCo/executor/pull/1869) [`c695970`](https://github.com/UsefulSoftwareCo/executor/commit/c6959702f6459504463fe0e13fa1a576190460ed) Thanks [@RhysSullivan](https://github.com/RhysSullivan)! - Explain macOS permissions for Codex plugins instead of failing with an opaque
+  error. A refused grant used to surface as `Internal tool error [id]` — the
+  plugin reports "Unknown error" and only a numeric code says what happened, so
+  neither the user nor the model could tell that macOS was the blocker.
+
+  The bridge now recognises those codes and answers with the grant to enable and
+  where to find it. Each plugin's add screen also states what macOS will ask for
+  before anything runs, with a link straight to the right Privacy pane — macOS
+  asks once, and a dismissed prompt never returns.
+
+  The add screen checks that access when it opens, and holds the Add button
+  until the plugin answers. Adding one that macOS is still blocking produced an
+  integration that looked connected and failed on its first call, by which point
+  the screen explaining the fix was gone.
+
+- Updated dependencies [[`9a1fbd5`](https://github.com/UsefulSoftwareCo/executor/commit/9a1fbd5f0de25f622f303c76f998443c1bb72063)]:
+  - @executor-js/local@1.6.6
+  - @executor-js/api@1.4.69
+  - @executor-js/sdk@1.6.6
+  - @executor-js/runtime-quickjs@1.6.6
+
 ## 1.6.5
 
 ### Patch Changes

apps/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "executor",
-  "version": "1.6.5",
+  "version": "1.6.6",
   "private": true,
   "bin": {
     "executor": "./bin/executor.ts"

apps/cloud/CHANGELOG.md

@@ -1,5 +1,32 @@
 # @executor-js/cloud
 
+## 1.4.67
+
+### Patch Changes
+
+- [#1864](https://github.com/UsefulSoftwareCo/executor/pull/1864) [`fad3650`](https://github.com/UsefulSoftwareCo/executor/commit/fad36504439a07e6080beba243b24b73cd1b9741) Thanks [@RhysSullivan](https://github.com/RhysSullivan)! - **API key validation is cached per isolate**
+
+  Every MCP request and every API-key-authenticated `/api/*` request used to pay a live WorkOS round trip (~100-150ms) to validate the presented key, on every single request. The JWT bearer path beside it already verified locally against a JWKS cached for an hour; API keys had no cache at all.
+
+  Successful validations are now cached in a bounded per-isolate map for 60 seconds, keyed by the SHA-256 digest of the key value (never the raw credential). The MCP handler used to rebuild its whole auth layer (and with it the cache) on every request; it now builds the layer once per isolate, so the cache holds on both the `/api/*` and `/mcp` planes. Invalid keys and upstream failures are never cached, so probing bad keys cannot pollute the map and a freshly created key works immediately. The tradeoff: a revoked key remains usable for up to 60 seconds within an isolate that validated it before revocation — far tighter than the one-hour rotation window the JWT path already accepts.
+
+- Updated dependencies [[`c695970`](https://github.com/UsefulSoftwareCo/executor/commit/c6959702f6459504463fe0e13fa1a576190460ed), [`21119da`](https://github.com/UsefulSoftwareCo/executor/commit/21119da662d2d225b033b3532e1f17d97311a39d), [`9a1fbd5`](https://github.com/UsefulSoftwareCo/executor/commit/9a1fbd5f0de25f622f303c76f998443c1bb72063)]:
+  - @executor-js/plugin-mcp@1.6.6
+  - @executor-js/execution@1.6.6
+  - @executor-js/react@1.4.69
+  - @executor-js/api@1.4.69
+  - @executor-js/cloudflare@0.0.48
+  - @executor-js/host-mcp@1.4.4
+  - @executor-js/mcp-apps-shell@1.4.17
+  - @executor-js/runtime-dynamic-worker@1.4.4
+  - @executor-js/plugin-graphql@1.6.6
+  - @executor-js/plugin-openapi@1.6.6
+  - @executor-js/plugin-toolkits@1.5.41
+  - @executor-js/plugin-workos-vault@0.0.2
+  - @executor-js/sdk@1.6.6
+  - @executor-js/runtime-quickjs@1.6.6
+  - @executor-js/vite-plugin@0.0.66
+
 ## 1.4.66
 
 ### Patch Changes

apps/cloud/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@executor-js/cloud",
-  "version": "1.4.66",
+  "version": "1.4.67",
   "private": true,
   "type": "module",
   "scripts": {

apps/desktop/CHANGELOG.md

@@ -1,5 +1,7 @@
 # @executor-js/desktop
 
+## 1.6.6
+
 ## 1.6.5
 
 ## 1.6.4

apps/desktop/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@executor-js/desktop",
-  "version": "1.6.5",
+  "version": "1.6.6",
   "private": true,
   "homepage": "https://github.com/UsefulSoftwareCo/executor",
   "license": "MIT",

apps/host-selfhost/CHANGELOG.md

@@ -1,5 +1,26 @@
 # @executor-js/host-selfhost
 
+## 0.0.48
+
+### Patch Changes
+
+- Updated dependencies [[`c695970`](https://github.com/UsefulSoftwareCo/executor/commit/c6959702f6459504463fe0e13fa1a576190460ed), [`21119da`](https://github.com/UsefulSoftwareCo/executor/commit/21119da662d2d225b033b3532e1f17d97311a39d), [`9a1fbd5`](https://github.com/UsefulSoftwareCo/executor/commit/9a1fbd5f0de25f622f303c76f998443c1bb72063)]:
+  - @executor-js/plugin-mcp@1.6.6
+  - @executor-js/execution@1.6.6
+  - @executor-js/react@1.4.69
+  - @executor-js/analytics@0.1.13
+  - @executor-js/api@1.4.69
+  - @executor-js/host-mcp@1.4.4
+  - @executor-js/mcp-apps-shell@1.4.17
+  - @executor-js/app@1.4.4
+  - @executor-js/plugin-graphql@1.6.6
+  - @executor-js/plugin-openapi@1.6.6
+  - @executor-js/plugin-toolkits@1.5.41
+  - @executor-js/plugin-provider-service-split@0.0.20
+  - @executor-js/sdk@1.6.6
+  - @executor-js/runtime-quickjs@1.6.6
+  - @executor-js/plugin-encrypted-secrets@0.0.48
+
 ## 0.0.47
 
 ### Patch Changes

apps/host-selfhost/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@executor-js/host-selfhost",
-  "version": "0.0.47",
+  "version": "0.0.48",
   "private": true,
   "type": "module",
   "exports": {

apps/local/CHANGELOG.md

@@ -1,5 +1,38 @@
 # @executor-js/local
 
+## 1.6.6
+
+### Patch Changes
+
+- [#1865](https://github.com/UsefulSoftwareCo/executor/pull/1865) [`9a1fbd5`](https://github.com/UsefulSoftwareCo/executor/commit/9a1fbd5f0de25f622f303c76f998443c1bb72063) Thanks [@RhysSullivan](https://github.com/RhysSullivan)! - **Desktop OAuth connects finish the moment the provider redirects**
+
+  When the desktop app runs an OAuth flow in the system browser, the app learned about completion by polling the local server once a second. The completed result sat in memory while the user watched the "Connecting…" spinner for up to a second more — about half a second wasted on average, on every connect.
+
+  The await endpoint now long-polls: the server holds the request open (up to 25 seconds per hold) and answers the instant the flow completes. The client polls one request at a time and reconnects after each answer, so requests never stack. Mixed versions stay compatible in both directions: an old client still gets its answer within one poll of a new server, and a new client against an old server behaves exactly as before.
+
+- Updated dependencies [[`c695970`](https://github.com/UsefulSoftwareCo/executor/commit/c6959702f6459504463fe0e13fa1a576190460ed), [`21119da`](https://github.com/UsefulSoftwareCo/executor/commit/21119da662d2d225b033b3532e1f17d97311a39d), [`9a1fbd5`](https://github.com/UsefulSoftwareCo/executor/commit/9a1fbd5f0de25f622f303c76f998443c1bb72063)]:
+  - @executor-js/plugin-mcp@1.6.6
+  - @executor-js/execution@1.6.6
+  - @executor-js/react@1.4.69
+  - @executor-js/analytics@0.1.13
+  - @executor-js/api@1.4.69
+  - @executor-js/host-mcp@1.4.4
+  - @executor-js/mcp-apps-shell@1.4.17
+  - @executor-js/app@1.4.4
+  - @executor-js/plugin-graphql@1.6.6
+  - @executor-js/plugin-onepassword@1.6.6
+  - @executor-js/plugin-openapi@1.6.6
+  - @executor-js/plugin-toolkits@1.5.41
+  - @executor-js/plugin-provider-service-split@0.0.20
+  - @executor-js/sdk@1.6.6
+  - @executor-js/runtime-quickjs@1.6.6
+  - @executor-js/config@1.6.6
+  - @executor-js/plugin-file-secrets@1.6.6
+  - @executor-js/plugin-keychain@1.6.6
+  - @executor-js/plugin-example@1.6.6
+  - @executor-js/plugin-desktop-settings@1.6.6
+  - @executor-js/vite-plugin@0.0.66
+
 ## 1.6.5
 
 ### Patch Changes

apps/local/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@executor-js/local",
-  "version": "1.6.5",
+  "version": "1.6.6",
   "private": true,
   "type": "module",
   "exports": {