chore: sync upstream 2026-10-13

.changeset/mcp-default-user-agent.md

@@ -0,0 +1,5 @@
+---
+"executor": patch
+---
+
+Send a default User-Agent on remote MCP requests so servers that reject requests without one accept the connection. A configured User-Agent header still wins.

.changeset/mcp-probe-user-agent.md

@@ -0,0 +1,5 @@
+---
+"executor": patch
+---
+
+Send the default User-Agent on the MCP endpoint probe and its OAuth metadata request too, so adding a server that rejects requests without one no longer fails. A configured User-Agent still wins.

.changeset/v2-import-sidebar-link.md

@@ -0,0 +1,5 @@
+---
+"@executor-js/cloud": patch
+---
+
+Link eligible single-member free organizations to Executor v2's workspace import from the sidebar.

.changeset/v2-moved-notice.md

@@ -0,0 +1,5 @@
+---
+"@executor-js/cloud": patch
+---
+
+Tell users when their organization has moved to Executor v2, with a link to it in v2 and a way to say why they are staying on v1.

apps/cloud/src/account/org-api-key-revoke.node.test.ts

@@ -158,6 +158,7 @@ const stubDirectory = Layer.succeed(MemberDirectory)({
 const stubAutumn = Layer.succeed(AutumnService)({
   use: () => Effect.die("revoke does not touch billing"),
   ensureCustomer: () => Effect.die("revoke does not touch billing"),
+  findCustomer: () => Effect.die("revoke does not touch billing"),
   checkExecutionBalance: () => Effect.die("revoke does not touch billing"),
   trackExecution: () => Effect.void,
   setMemberSeats: () => Effect.void,

apps/cloud/src/auth/api.ts

@@ -34,6 +34,24 @@ const AuthOrganizationsResponse = Schema.Struct({
   activeOrganizationId: Schema.NullOr(Schema.String),
 });
 
+// Executor v2's workspace import for the selected org: its page URL when v2
+// would let the signed-in user import the org, otherwise null. Nothing else
+// about the membership or billing reads behind it is returned.
+//
+// `moved` is set instead when the org has already been imported (v2 records
+// the move on the WorkOS organization): where it lives in v2 and when it
+// moved. It drives a notice only; the org keeps working in v1.
+const V2MovedResponse = Schema.Struct({
+  v2Url: Schema.String,
+  v2Slug: Schema.String,
+  movedAt: Schema.String,
+});
+
+const V2ImportResponse = Schema.Struct({
+  url: Schema.NullOr(Schema.String),
+  moved: Schema.NullOr(V2MovedResponse),
+});
+
 const CreateOrganizationBody = Schema.Struct({
   name: Schema.String,
 });
@@ -231,6 +249,12 @@ export class CloudAuthApi extends HttpApiGroup.make("cloudAuth")
       error: [WorkOSError, UserStoreError, MemberDirectoryError],
     }),
   )
+  .add(
+    HttpApiEndpoint.get("v2Import", "/auth/v2-import", {
+      success: V2ImportResponse,
+      error: NoOrganization,
+    }),
+  )
   .add(
     HttpApiEndpoint.post("createOrganization", "/auth/create-organization", {
       payload: CreateOrganizationBody,

apps/cloud/src/auth/handlers.ts

@@ -42,6 +42,8 @@ import {
   type AuthorizeOrganizationOptions,
 } from "./organization";
 import { mcpSessionStub } from "@executor-js/cloudflare/mcp/session-stub";
+import { liveV2ImportSource, v2ImportAnswer } from "./v2-import";
+import { liveV2MovedSource } from "./v2-moved";
 
 const COOKIE_OPTIONS = {
   path: "/",
@@ -439,6 +441,18 @@ export const CloudSessionAuthHandlers = HttpApiBuilder.group(
           };
         }),
       )
+      .handle("v2Import", () =>
+        Effect.gen(function* () {
+          const session = yield* requireSelectedOrganization;
+          return yield* v2ImportAnswer({
+            env,
+            importSource: liveV2ImportSource,
+            movedSource: liveV2MovedSource,
+            userId: session.accountId,
+            organizationId: session.organizationId,
+          });
+        }),
+      )
       .handle("createOrganization", ({ payload }) =>
         Effect.gen(function* () {
           const workos = yield* WorkOSClient;

apps/cloud/src/auth/mirror-feeders.node.test.ts

@@ -175,6 +175,7 @@ const seedOrganization = (id: string) =>
 const stubAutumn = Layer.succeed(AutumnService)({
   use: () => Effect.die("feeders do not read billing"),
   ensureCustomer: () => Effect.void,
+  findCustomer: () => Effect.die("feeders do not read billing"),
   checkExecutionBalance: () => Effect.die("feeders do not check balances"),
   trackExecution: () => Effect.void,
   setMemberSeats: () => Effect.void,
@@ -673,6 +674,7 @@ describe("session handlers read membership from the mirror", () => {
   const deletingAutumn = Layer.succeed(AutumnService)({
     use: () => Effect.succeed({} as never),
     ensureCustomer: () => Effect.void,
+    findCustomer: () => Effect.die("feeders do not read billing"),
     checkExecutionBalance: () => Effect.die("deletion does not check balances"),
     trackExecution: () => Effect.void,
     setMemberSeats: () => Effect.void,
@@ -866,6 +868,7 @@ describe("session handlers read membership from the mirror", () => {
           return Effect.fail(failure);
         }),
       ensureCustomer: () => Effect.void,
+      findCustomer: () => Effect.die("feeders do not read billing"),
       checkExecutionBalance: () => Effect.die("deletion does not check balances"),
       trackExecution: () => Effect.void,
       setMemberSeats: () => Effect.void,
@@ -1234,6 +1237,7 @@ describe("account service writes through to the mirror", () => {
           subscriptions: [{ planId: "team", status: "active" }],
         } as never),
       ensureCustomer: () => Effect.void,
+      findCustomer: () => Effect.die("feeders do not read billing"),
       checkExecutionBalance: () => Effect.die("invite does not check balances"),
       trackExecution: () => Effect.void,
       setMemberSeats: () => Effect.void,
@@ -1314,6 +1318,7 @@ describe("account service writes through to the mirror", () => {
       const freeAutumn = Layer.succeed(AutumnService)({
         use: () => Effect.succeed({ subscriptions: [] } as never),
         ensureCustomer: () => Effect.void,
+        findCustomer: () => Effect.die("feeders do not read billing"),
         checkExecutionBalance: () => Effect.die("invite does not check balances"),
         trackExecution: () => Effect.void,
         setMemberSeats: () => Effect.void,
@@ -1541,6 +1546,7 @@ describe("seat reporter", () => {
       const recording = Layer.succeed(AutumnService)({
         use: () => Effect.die("the seat reporter sets seats, it does not read"),
         ensureCustomer: () => Effect.void,
+        findCustomer: () => Effect.die("feeders do not read billing"),
         checkExecutionBalance: () => Effect.die("the seat reporter does not check balances"),
         trackExecution: () => Effect.void,
         setMemberSeats: (organizationId, seats) =>