v1.5.36

Patch Changes

• #1478 8ecbfd6 Thanks @RhysSullivan! - Store minted OAuth tokens in the durable file secret store (auth.json under EXECUTOR_DATA_DIR) instead of the system keychain. On sandbox/headless hosts the keychain can be an in-memory keyring that a stop/recreate wipes, leaving OAuth connections expired with "Stored refresh token could not be resolved." Existing keychain-backed connections migrate with one clean reconnect.

• #1462 5a70675 Thanks @RhysSullivan! - Fix: org OAuth connections on self-host worked only for whoever ran the consent

  The encrypted-secrets credential provider (the writable provider on the self-hosted and Cloudflare hosts) filed token rows under the acting user's private partition instead of the credential's own owner. An org-owned OAuth connection whose consent completed in one member's browser session therefore resolved only for that member — every other principal failed with oauth_connection_missing, while the UI showed the connection healthy. The provider now partitions by the owner embedded in the item id (oauth:org:… → org-shared), matching the WorkOS Vault provider, and a boot-time data migration re-files rows already written wrong. The encrypted value itself was never affected.

• #1459 fc1e589 Thanks @wan0net! - Preserve elicitation_mode=native when creating self-hosted MCP sessions.

• #1475 77b0821 Thanks @RhysSullivan! - Refresh OAuth tokens when the upstream rejects them with HTTP 401, not only when the stored expiry says they are due. Connections whose authorization server omits expires_in can now recover without a manual reconnect, and the refresh path is traced.

• #1476 167d899 Thanks @RhysSullivan! - Remove the custom apps plugin. Git and local-directory app sources are no
  longer supported. The packed binary still ships the workerd and worker-bundler
  sidecars.

• Updated dependencies []:

  • @executor-js/sdk@1.5.36
  • @executor-js/runtime-quickjs@1.5.36
  • @executor-js/local@1.4.4
  • @executor-js/api@1.4.56