Merge remote-tracking branch 'origin/main' into mcp-oauth-health-reconnect-repro

Author: RhysSullivan

.github/workflows/publish-desktop.yml

@@ -172,6 +172,7 @@ jobs:
             apps/desktop/dist/*.AppImage
             apps/desktop/dist/*.deb
             apps/desktop/dist/*.rpm
+            apps/desktop/dist/*.blockmap
             apps/desktop/dist/latest*.yml
           if-no-files-found: warn
 
@@ -223,6 +224,7 @@ jobs:
           done < <(find artifacts -type f \
             \( -name "*.dmg" -o -name "*.zip" -o -name "*.exe" \
             -o -name "*.AppImage" -o -name "*.deb" -o -name "*.rpm" \
+            -o -name "*.blockmap" \
             -o -name "latest*.yml" \))
 
       # Flip draft → published only after every desktop asset is uploaded —

.oxlintrc.jsonc

@@ -20,6 +20,7 @@
     "executor/no-match-orelse": "error",
     "executor/no-promise-catch": "error",
     "executor/no-promise-reject": "error",
+    "executor/no-raw-durable-object-id": "error",
     "executor/no-raw-fetch": "error",
     "executor/no-redundant-primitive-cast": "error",
     "executor/no-redundant-error-factory": "error",

apps/cloud/src/api/error-response.ts

@@ -1,7 +1,7 @@
 import { Cause, Data, Effect, Predicate, Result } from "effect";
 import { HttpServerRespondable, HttpServerResponse } from "effect/unstable/http";
 
-import { captureCause } from "../observability";
+import { captureCause, captureCauseEffect } from "../observability";
 
 // Implements `Respondable` so the framework's default cause→response
 // pipeline (`HttpServerRespondable.toResponseOrElse`) renders this as the
@@ -13,13 +13,14 @@ export class HttpResponseError extends Data.TaggedError("HttpResponseError")<{
   readonly message: string;
 }> {
   [HttpServerRespondable.symbol](): Effect.Effect<HttpServerResponse.HttpServerResponse> {
-    if (this.status >= 500) captureCause(this);
-    return Effect.succeed(
-      HttpServerResponse.jsonUnsafe(
-        { error: this.message, code: this.code },
-        { status: this.status },
-      ),
-    );
+    const self = this;
+    return Effect.gen(function* () {
+      if (self.status >= 500) yield* captureCauseEffect(self);
+      return HttpServerResponse.jsonUnsafe(
+        { error: self.message, code: self.code },
+        { status: self.status },
+      );
+    });
   }
 }
 
@@ -65,3 +66,15 @@ export const toErrorServerResponse = (error: unknown): HttpServerResponse.HttpSe
     { status: mapped.status },
   );
 };
+
+export const toErrorServerResponseEffect = (
+  error: unknown,
+): Effect.Effect<HttpServerResponse.HttpServerResponse> =>
+  Effect.gen(function* () {
+    const mapped = toHttpResponseError(error);
+    if (mapped.status >= 500) yield* captureCauseEffect(mapped);
+    return HttpServerResponse.jsonUnsafe(
+      { error: mapped.message, code: mapped.code },
+      { status: mapped.status },
+    );
+  });

apps/cloud/src/auth/handlers.ts

@@ -32,10 +32,7 @@ import {
   authorizeOrganizationSelector,
   resolveOrganization,
 } from "./organization";
-import type {
-  McpSessionApprovalResult,
-  McpSessionResumeApprovalResult,
-} from "../mcp/session-durable-object";
+import { mcpSessionStub } from "@executor-js/cloudflare/mcp/session-stub";
 
 const COOKIE_OPTIONS = {
   path: "/",
@@ -122,23 +119,7 @@ const requireSelectedOrganization = Effect.gen(function* () {
   };
 });
 
-const getMcpSessionStub = (mcpSessionId: string) =>
-  Effect.try({
-    try: () => {
-      const ns = env.MCP_SESSION;
-      return ns.get(ns.idFromString(mcpSessionId));
-    },
-    catch: () => undefined,
-  }).pipe(Effect.orElseSucceed(() => null));
-
-const requireMcpSessionStub = (mcpSessionId: string, executionId: string) =>
-  Effect.gen(function* () {
-    const stub = yield* getMcpSessionStub(mcpSessionId);
-    if (!stub) {
-      return yield* new McpExecutionNotFoundError({ executionId });
-    }
-    return stub;
-  });
+const getMcpSessionStub = (mcpSessionId: string) => mcpSessionStub(env.MCP_SESSION, mcpSessionId);
 
 const failMcpApprovalResult = (
   result: { readonly status: "not_found" | "forbidden" },
@@ -528,13 +509,12 @@ export const CloudSessionAuthHandlers = HttpApiBuilder.group(
       .handle("getMcpPaused", ({ params }) =>
         Effect.gen(function* () {
           const owner = yield* requireSelectedOrganization;
-          const stub = yield* requireMcpSessionStub(params.mcpSessionId, params.executionId);
-          const result = yield* Effect.promise(
-            () =>
-              stub.getPausedExecutionForApproval(params.executionId, {
-                accountId: owner.accountId,
-                organizationId: owner.organizationId,
-              }) as Promise<McpSessionApprovalResult>,
+          const stub = getMcpSessionStub(params.mcpSessionId);
+          const result = yield* Effect.promise(() =>
+            stub.getPausedExecutionForApproval(params.executionId, {
+              accountId: owner.accountId,
+              organizationId: owner.organizationId,
+            }),
           );
 
           if (result.status !== "ok") {
@@ -550,20 +530,19 @@ export const CloudSessionAuthHandlers = HttpApiBuilder.group(
       .handle("resumeMcpExecution", ({ params, payload }) =>
         Effect.gen(function* () {
           const owner = yield* requireSelectedOrganization;
-          const stub = yield* requireMcpSessionStub(params.mcpSessionId, params.executionId);
-          const result = yield* Effect.promise(
-            () =>
-              stub.resumeExecutionForApproval(
-                params.executionId,
-                {
-                  accountId: owner.accountId,
-                  organizationId: owner.organizationId,
-                },
-                {
-                  action: payload.action,
-                  content: payload.content as Record<string, unknown> | undefined,
-                },
-              ) as Promise<McpSessionResumeApprovalResult>,
+          const stub = getMcpSessionStub(params.mcpSessionId);
+          const result = yield* Effect.promise(() =>
+            stub.resumeExecutionForApproval(
+              params.executionId,
+              {
+                accountId: owner.accountId,
+                organizationId: owner.organizationId,
+              },
+              {
+                action: payload.action,
+                content: payload.content as Record<string, unknown> | undefined,
+              },
+            ),
           );
 
           if (result.status !== "ok") {

apps/cloud/src/engine/execution-gate.ts

@@ -24,12 +24,12 @@
 // `CodeCompilationError` / `SandboxRuntimeError` into `ExecuteResult.error`.
 // ---------------------------------------------------------------------------
 
-import * as Sentry from "@sentry/cloudflare";
 import { Data, Effect } from "effect";
 import type * as Cause from "effect/Cause";
 
 import type { ExecutionEngine, ExecutionResult } from "@executor-js/execution";
 
+import { captureCauseEffect } from "../observability";
 import { EXECUTION_LIMIT_BLOCKED_MESSAGE } from "./execution-limit-messages";
 
 // The engine's completed-result payload (`ExecuteResult` in codemode-core),
@@ -166,10 +166,12 @@ export const makeExecutionLimitGate = (checkBalance: ExecutionBalanceCheck) => {
         // must never block executions. Reported like `trackExecution` so a
         // billing outage still pages; the error outcome is never cached.
         Effect.catch((error: unknown) =>
-          Effect.sync((): GateDecision => {
-            console.warn("[billing] execution balance check failed open:", error);
-            Sentry.captureException(error);
-            return { blocked: false };
+          Effect.gen(function* () {
+            yield* Effect.sync(() => {
+              console.warn("[billing] execution balance check failed open:", error);
+            });
+            yield* captureCauseEffect(error);
+            return { blocked: false } as const satisfies GateDecision;
           }),
         ),
       );

apps/cloud/src/engine/execution-rate-limit.ts

@@ -14,12 +14,12 @@
 // ---------------------------------------------------------------------------
 
 import { DurableObject, env } from "cloudflare:workers";
-import * as Sentry from "@sentry/cloudflare";
 import { Data, Effect } from "effect";
 import type * as Cause from "effect/Cause";
 
 import type { ExecutionEngine } from "@executor-js/execution";
 
+import { captureCauseEffect } from "../observability";
 import { withPreExecutionGate, type GateDecision } from "./execution-gate";
 import { RATE_LIMIT_BLOCKED_MESSAGE } from "./execution-limit-messages";
 
@@ -149,10 +149,12 @@ export const makeExecutionRateLimiter = (
         // FAIL OPEN: the backstop must never block executions because its
         // counter is unreachable or slow.
         Effect.catch((error: unknown) =>
-          Effect.sync((): GateDecision => {
-            console.warn("[rate-limit] execution rate limit check failed open:", error);
-            Sentry.captureException(error);
-            return { blocked: false };
+          Effect.gen(function* () {
+            yield* Effect.sync(() => {
+              console.warn("[rate-limit] execution rate limit check failed open:", error);
+            });
+            yield* captureCauseEffect(error);
+            return { blocked: false } as const satisfies GateDecision;
           }),
         ),
       );

apps/cloud/src/env-augment.d.ts

@@ -11,6 +11,8 @@ declare global {
       AXIOM_TRACES_URL?: string;
       AXIOM_TRACES_SAMPLE_RATIO?: string;
       SENTRY_DSN?: string;
+      SENTRY_OTEL_LOG_PAYLOAD?: string;
+      SENTRY_OTEL_VERIFY?: string;
       VITE_PUBLIC_SENTRY_DSN?: string;
       VITE_PUBLIC_POSTHOG_KEY?: string;
       VITE_PUBLIC_POSTHOG_HOST?: string;
@@ -38,6 +40,7 @@ declare global {
       // workers and older local setups run without the binding, and the
       // limiter degrades to disabled when absent.
       EXECUTION_RATE_LIMITER?: import("@cloudflare/workers-types").DurableObjectNamespace;
+      MCP_EXECUTION_OWNER?: import("@cloudflare/workers-types").DurableObjectNamespace;
 
       // Optional per-org hourly execution rate-limit override, parsed as an
       // integer (defaults to EXECUTIONS_PER_ORG_PER_HOUR = 1000 when unset or

apps/cloud/src/extensions/billing/route.ts

@@ -5,7 +5,11 @@ import { autumnHandler } from "autumn-js/backend";
 
 import { WorkOSClient } from "../../auth/workos";
 import { ORG_SELECTOR_HEADER, authorizeOrganizationSelector } from "../../auth/organization";
-import { HttpResponseError, isServerError, toErrorServerResponse } from "../../api/error-response";
+import {
+  HttpResponseError,
+  isServerError,
+  toErrorServerResponseEffect,
+} from "../../api/error-response";
 
 type BillingSession = {
   readonly userId: string;
@@ -111,7 +115,7 @@ const handler = Effect.gen(function* () {
     if (isServerError(err)) {
       console.error("[autumn] request failed:", Cause.pretty(err));
     }
-    return Effect.succeed(toErrorServerResponse(err));
+    return toErrorServerResponseEffect(err);
   }),
 );
 

apps/cloud/src/extensions/billing/service.ts

@@ -3,10 +3,11 @@
 // ---------------------------------------------------------------------------
 
 import { env } from "cloudflare:workers";
-import * as Sentry from "@sentry/cloudflare";
 import { Autumn } from "autumn-js";
 import { Context, Data, Effect, Layer } from "effect";
 
+import { captureCauseEffect } from "../../observability";
+
 // ---------------------------------------------------------------------------
 // Errors
 // ---------------------------------------------------------------------------
@@ -72,12 +73,12 @@ const make = Effect.sync(() => {
       ).pipe(
         Effect.catchTag("AutumnError", (error) =>
           Effect.gen(function* () {
-            // Silent billing data loss is worth paging on — autumn.trackExecution
+            // Silent billing data loss is worth paging on: autumn.trackExecution
             // is fire-and-forget so the caller doesn't handle it themselves.
             yield* Effect.sync(() => {
               console.error("[billing] track failed:", error);
-              Sentry.captureException(error);
             });
+            yield* captureCauseEffect(error);
             yield* Effect.annotateCurrentSpan({ "autumn.track.failed": true });
           }),
         ),

apps/cloud/src/mcp/agent-handler.ts

@@ -13,19 +13,12 @@ import {
   withVerifiedIdentityHeaders,
 } from "@executor-js/cloudflare/mcp/do-headers";
 import type { McpSessionProps } from "@executor-js/cloudflare/mcp/agent-durable-object";
+import { mcpSessionStub } from "@executor-js/cloudflare/mcp/session-stub";
 
 import { wrapMcpSseResponse } from "../observability/memory-metrics";
 import { cloudMcpAuth } from "./auth-provider";
 import { McpSessionDOSqlite } from "./session-durable-object";
 
-interface McpAgentSessionStub {
-  readonly validateMcpSessionOwner: (identity: {
-    readonly accountId: string;
-    readonly organizationId: string;
-  }) => Promise<"ok" | "not_found" | "forbidden">;
-  readonly _cf_scheduleDestroy: () => Promise<void>;
-}
-
 const corsPreflightResponse = (): Response =>
   new Response(null, {
     status: 204,
@@ -67,12 +60,6 @@ const renderAuthError = (
   return jsonRpcResponse(503, -32001, outcome.message);
 };
 
-const sessionStub = (env: Env, sessionId: string): McpAgentSessionStub =>
-  // oxlint-disable-next-line executor/no-double-cast -- boundary: Workers types expose only DurableObjectStub, but RPC methods are generated from the bound DO class.
-  env.MCP_SESSION.get(
-    env.MCP_SESSION.idFromName(`streamable-http:${sessionId}`),
-  ) as unknown as McpAgentSessionStub;
-
 const authenticate = (request: Request) =>
   Effect.gen(function* () {
     const auth = yield* McpAuthProvider;
@@ -141,7 +128,11 @@ export const makeCloudMcpAgentHandler = () => {
     if (!Predicate.isTagged(outcome, "Authenticated")) {
       if (Predicate.isTagged(outcome, "Forbidden") && sessionId) {
         await Effect.runPromise(
-          Effect.ignore(Effect.tryPromise(() => sessionStub(env, sessionId)._cf_scheduleDestroy())),
+          Effect.ignore(
+            Effect.tryPromise(() =>
+              mcpSessionStub(env.MCP_SESSION, sessionId)._cf_scheduleDestroy(),
+            ),
+          ),
         );
       }
       return renderAuthError(auth, request, outcome);
@@ -155,7 +146,7 @@ export const makeCloudMcpAgentHandler = () => {
     }
 
     if (sessionId) {
-      const owner = await sessionStub(env, sessionId).validateMcpSessionOwner({
+      const owner = await mcpSessionStub(env.MCP_SESSION, sessionId).validateMcpSessionOwner({
         accountId: outcome.principal.accountId,
         organizationId: outcome.principal.organizationId,
       });