v1.6.9

Patch Changes

• #1901 de13821 Thanks @baggiiiie! - Prevent deleted artifacts from briefly reappearing after returning to the artifact gallery.

• #1915 5c1d1b4 Thanks @baggiiiie! - Fix: links in generated artifacts (<a target="_blank">) did nothing when clicked. The sandbox iframe deliberately has no allow-popups, so the browser blocked the new browsing context and the click went nowhere. A trusted user click is now relayed across the frame boundary to the host's openLink capability — guarded by a per-render nonce so generated code cannot forge or observe it — and the host opens only http/https URLs.

• #1884 3eea03b Thanks @GijungKim! - Render artifacts that call integrations or tools with hyphenated slugs.

• #1943 b5d53cb Thanks @baggiiiie! - Fix: show-artifact now returns the saved component source to MCP clients that cannot render Apps. Agents can read the current source and make targeted edits instead of receiving only a link to the artifact.

• #1967 bfc46e5 Thanks @utpalsinghdev! - Pin CLI browser approval links to EXECUTOR_WEB_BASE_URL so a TLS reverse proxy no longer returns an unreachable http:// URL.

• #1976 40b2f2e Thanks @SunkenInTime! - Carry an approval's persistence choice through elicitation, so Codex Computer Use stops asking to use the same app on every call.

  Computer Use offers persist: ["session", "always"] in the prompt's terms and remembers the app only when the answer names one. Executor dropped the offer on the way in (the terms projection kept strings only) and the choice on the way out (every adapter rebuilt the reply from action and content), so each accept was one-time. ElicitationResponse now has meta.persist; the MCP plugin, the app-server bridge, and the MCP host pass it through; the model-mode resume tool and the browser approval page let the approver pick from the offered scopes. Nothing is chosen automatically: a bare accept still approves once.

• #1977 6870f38 Thanks @RhysSullivan! - Compile describe.tool previews against only the definitions a tool references, drop the compiler's per-call retained graph, and fall back to unknown for schemas over a node limit. Describing a tool from a large OpenAPI spec no longer burns seconds of CPU or leaks memory in the shared session isolate.

• #1980 b961092 Thanks @daviesayo! - Return a tool's declared annotations from tools.schema and describe.tool. Code inside execute can now read requiresApproval, approvalDescription and mayElicit without parsing the tool's prose description.

• #1978 f1d95f2 Thanks @RhysSullivan! - Report an MCP execute call that dies with a session reset as a JSON-RPC error instead of a silently closed stream. The front worker answers outstanding request ids when the session socket closes abnormally or a response deadline passes, and a rebuilt session answers ids stranded by a previous incarnation on the next stream. The plain memory-limit reset is now classified as transient.

• #2016 84620aa Thanks @RhysSullivan! - Fix: an MCP server refusing a tool call with a 4xx HTTP response (for example Stripe's 422 when stripe_context is missing) surfaced as Internal tool error [id]. When the body is a JSON object naming the problem, the call now returns a typed mcp_tool_error failure with the server's message and status, so the model can fix the arguments instead of reading an outage.

• #2014 f94e5e0 Thanks @RhysSullivan! - Name the MCP SDK rejection (error class and code) in the Internal tool error defect log, so an opaque MCP failure can be diagnosed from the trace instead of only naming the tool that failed.

• #2012 5b5db98 Thanks @RhysSullivan! - Fix: an MCP server refusing a tool call with a JSON-RPC error (for example -32602 Invalid params) surfaced as Internal tool error [id]. The server's answer is for the caller, so it now comes back as a typed mcp_tool_error failure carrying the server's message and JSON-RPC code, and the model can correct the arguments instead of reading an outage.

• #1942 3c263d7 Thanks @RhysSullivan! - Add a search and invoke MCP mode (?mode=passthrough, executor mcp --mode passthrough). Search returns bounded pages of matching tool IDs and input schemas. Invoke validates arguments and runs the selected tool, with native client approval and workspace blocks enforced. The MCP catalog stays at two tools regardless of integration count.

• #1971 61f71c5 Thanks @Adityakk9031! - Shut down scoped executors and tool subprocess resources upon MCP session eviction and disposal in the in-process session store.

• #1960 d64639b Thanks @baggiiiie! - OpenAPI tools that cannot reach the upstream server now return an upstream_unreachable error instead of Internal tool error [id]. The message names the integration and origin that could not be reached, details carries the sanitized host and errno-style code (ECONNREFUSED, ENOTFOUND, …), and the failure is logged with the same classification.

• #1963 eaa1f3a Thanks @RhysSullivan! - Bundle the Geist and Geist Mono fonts with the console instead of loading them from Google Fonts. The UI no longer stays blank when a self-hosted deployment cannot reach fonts.googleapis.com.

• #1987 347537c Thanks @baggiiiie! - Hide the self-hosted Admin area from non-admin members and refuse direct access before member details or invite controls are rendered.

• #1897 f1930dd Thanks @baggiiiie! - Prevent the empty Toolkits page from scrolling past its visible add cards.

• Updated dependencies [d873caf, 40b2f2e, 65d939e, 3c263d7, 61f71c5, a6cdcf1, be77521, f8cfa5f, cc0fd8f, 85cf428, 38a7725, 3fd28a5, 929b233]:

  • @executor-js/api@1.4.72
  • @executor-js/sdk@1.6.9
  • @executor-js/local@1.6.9
  • @executor-js/runtime-quickjs@1.6.9