First-party OAuth clients

[RhysSullivan]

Adds host-operated OAuth apps ("first-party clients") so users can connect GitHub, Google, etc. through cloud's own registered apps with nothing to paste.

• New firstPartyOAuthClients executor config: apps declared at composition time, addressed as first-party:<name>. Resolved from config, never stored — secrets stay in host env, are never written to a credential provider, and never cross any read surface. Minted connections and tokens remain per-owner.
• oauth-service: loadClient/listClients intercept the first-party: namespace ahead of the DB; createClient/removeClient reject it; the org→user sharing rule doesn't apply to deployment-owned apps. Refresh-at-execute resolves the same config identity.
• New first_party variant on OAuthClientOrigin (API schema included), with plural integrations for picker intent-matching.
• Cloud: FIRST_PARTY_{GITHUB,GOOGLE}_CLIENT_{ID,SECRET} env pairs enable each app; threaded through HostConfig so both the HTTP plane and the MCP session DO resolve them. Cloud-only for now (a stable registered callback is required; local/self-host deployments register their own apps).
• github-rest preset gains an OAuth auth template (classic OAuth app endpoints).
• Connect UI: first-party apps rank first in the picker with a "Built-in" badge and no manage menu; BYO remains the escape hatch.

Tests: SDK lifecycle suite (start/complete/execute/refresh, namespace guards, listing), picker tier tests, and a cloud e2e scenario proving env → HostConfig → authorize-redirect end to end.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	executor-marketing	ac3bea5	Commit Preview URL Branch Preview URL	Aug 17 2026, 07:42 PM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	executor-cloud	ac3bea5	Aug 17 2026, 07:42 PM

[github-actions]

Cloudflare preview

Torn down — the PR is closed.

[pkg-pr-new]

Open in StackBlitz

@executor-js/cli

npm i https://pkg.pr.new/UsefulSoftwareCo/executor/@executor-js/cli@1527

@executor-js/config

npm i https://pkg.pr.new/UsefulSoftwareCo/executor/@executor-js/config@1527

@executor-js/execution

npm i https://pkg.pr.new/UsefulSoftwareCo/executor/@executor-js/execution@1527

@executor-js/sdk

npm i https://pkg.pr.new/UsefulSoftwareCo/executor/@executor-js/sdk@1527

@executor-js/codemode-core

npm i https://pkg.pr.new/UsefulSoftwareCo/executor/@executor-js/codemode-core@1527

@executor-js/runtime-quickjs

npm i https://pkg.pr.new/UsefulSoftwareCo/executor/@executor-js/runtime-quickjs@1527

@executor-js/plugin-file-secrets

npm i https://pkg.pr.new/UsefulSoftwareCo/executor/@executor-js/plugin-file-secrets@1527

@executor-js/plugin-graphql

npm i https://pkg.pr.new/UsefulSoftwareCo/executor/@executor-js/plugin-graphql@1527

@executor-js/plugin-keychain

npm i https://pkg.pr.new/UsefulSoftwareCo/executor/@executor-js/plugin-keychain@1527

@executor-js/plugin-mcp

npm i https://pkg.pr.new/UsefulSoftwareCo/executor/@executor-js/plugin-mcp@1527

@executor-js/plugin-onepassword

npm i https://pkg.pr.new/UsefulSoftwareCo/executor/@executor-js/plugin-onepassword@1527

@executor-js/plugin-openapi

npm i https://pkg.pr.new/UsefulSoftwareCo/executor/@executor-js/plugin-openapi@1527

executor

npm i https://pkg.pr.new/UsefulSoftwareCo/executor@1527

commit: ac3bea5