[codex] Move cloud secret values to WorkOS Vault

[RhysSullivan]

What changed

This switches the cloud app to use WorkOS Vault for secret values and adds a dedicated @executor/plugin-workos-vault package.

It also cleans up the cloud secrets UI so storage/provider implementation details are not exposed to users:

• the cloud secrets page no longer mentions providers or backend storage
• the secret selector no longer shows provider section labels when there is only one store
• the secret selector no longer shows secret IDs on the right

Why

Cloud secret values should live in WorkOS Vault, while the app should treat Vault as a simple value store.

The previous implementation wrote app-managed registry state into Vault, which made the integration more complex than necessary. This change keeps secret refs/metadata in Postgres-backed KV and uses Vault only for secret values.

Impact

• cloud secret values are written to WorkOS Vault
• secret metadata stays in app storage for listing and reference management
• cloud users no longer see storage/provider internals in the UI
• local secret-provider UX remains intact

Root cause

The initial Vault integration used Vault for both value storage and app-level registry metadata, which created unnecessary coupling and leaked implementation details into the product UI.

Validation

• bun run --filter='@executor/plugin-workos-vault' test
• bun run --filter='@executor/cloud' typecheck
• bunx vitest run --config vitest.unit.config.ts (from apps/cloud)

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
🔵 In progress View logs	executor-cloud	f288a36	Apr 13 2026, 04:59 AM

[pkg-pr-new]

Open in StackBlitz

@executor/sdk

npm i https://pkg.pr.new/RhysSullivan/executor/@executor/sdk@215

@executor/plugin-file-secrets

npm i https://pkg.pr.new/RhysSullivan/executor/@executor/plugin-file-secrets@215

@executor/plugin-google-discovery

npm i https://pkg.pr.new/RhysSullivan/executor/@executor/plugin-google-discovery@215

@executor/plugin-graphql

npm i https://pkg.pr.new/RhysSullivan/executor/@executor/plugin-graphql@215

@executor/plugin-keychain

npm i https://pkg.pr.new/RhysSullivan/executor/@executor/plugin-keychain@215

@executor/plugin-mcp

npm i https://pkg.pr.new/RhysSullivan/executor/@executor/plugin-mcp@215

@executor/plugin-onepassword

npm i https://pkg.pr.new/RhysSullivan/executor/@executor/plugin-onepassword@215

@executor/plugin-openapi

npm i https://pkg.pr.new/RhysSullivan/executor/@executor/plugin-openapi@215

@executor/plugin-workos-vault

npm i https://pkg.pr.new/RhysSullivan/executor/@executor/plugin-workos-vault@215

commit: f288a36