fix: keep executor.jsonc in sync with source add/remove#408
Open
RyanNg1403 wants to merge 1 commit intoRhysSullivan:mainfrom
Open
fix: keep executor.jsonc in sync with source add/remove#408RyanNg1403 wants to merge 1 commit intoRhysSullivan:mainfrom
RyanNg1403 wants to merge 1 commit intoRhysSullivan:mainfrom
Conversation
Two related bugs caused executor.jsonc and the runtime DB to drift
out of sync, so sources resurrected after a UI delete and OAuth
auth blocks vanished after a restart.
1. Engine-level removeSource (openapi, mcp, graphql) only deleted
plugin storage rows. The SDK-level removeSpec/removeSource paths
also call configFile.removeSource, but the engine hook (used by
the HTTP `sources.remove` handler and the web UI delete button)
never did. Effect: deleted source reappeared on next boot from
executor.jsonc.
2. apps/local config-sync rebuilt the executor.mcp.addSource call
for remote MCP sources without passing source.auth. addSource
then wrote back to executor.jsonc with auth=undefined, so the
{kind:"oauth2", connectionId} block silently disappeared on the
first restart and the source went 401 with zero tools.
Fixes:
- Plugin engine-hook removeSource now mirrors removeSpec/removeSource
behavior and calls options.configFile?.removeSource(sourceId) after
the storage delete (openapi, mcp, graphql).
- config-sync translates McpAuthConfig -> McpConnectionAuth via a new
translateMcpAuth helper and forwards it to executor.mcp.addSource.
Tests:
- packages/plugins/openapi/src/sdk/plugin.test.ts: regression test
asserts engine-level executor.sources.remove triggers
configFile.removeSource.
- apps/local/src/server/config-sync.test.ts: covers all McpAuthConfig
variants (none, header w/ + w/o secret-public-ref prefix, oauth2,
undefined).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two related bugs caused
executor.jsoncand the runtime DB to drift out of sync, so sources resurrected after a UI delete and OAuthauthblocks vanished after a restart. Both are reproducible againstexecutor@1.4.9.removeSourcehook in the openapi, mcp, and graphql plugins now mirrors the SDK-levelremoveSpec/removeSourceand writes back toconfigFile.apps/localconfig-sync now translatesMcpAuthConfig→McpConnectionAuthand forwards it toexecutor.mcp.addSource, so remote MCPauthsurvives boot.Why
Bug 1 — engine-level remove never updates
executor.jsoncThe SDK methods (
openapi.removeSpec,mcp.removeSource,graphql.removeSource) correctly callctx.storage.removeSource(...)andconfigFile.removeSource(...). The plugin lifecycle hook also namedremoveSource— used by the engine'sexecutor.sources.removeand therefore by the HTTPsources.removehandler and the web UI delete button — only deleted plugin storage rows. The DB was cleaned, but the file wasn't.On the next boot,
apps/localboot-sync readexecutor.jsonc, saw the still-present source entry, and re-upserted it into the DB. From the user's perspective, deleted sources resurrected after every restart.Bug 2 — boot-sync silently strips MCP
authapps/local/src/server/config-sync.tsrebuilt theexecutor.mcp.addSource(...)call for remote MCP sources without passingsource.auth.addSourcethen wrote back toexecutor.jsoncviaconfigFile.upsertSource(...)withauth: undefined— so{ kind: "oauth2", connectionId: ... }blocks silently disappeared from the file on the very first restart. The next restart saw a source with no auth, hit a 401 on connect, and registered zero tools.The OAuth connection row and keychain tokens themselves remained intact in the DB; the file just lost the pointer.
Validation
bunx --bun vitest runinpackages/plugins/openapi— 64/64 (incl. new regression test assertingexecutor.sources.removetriggersconfigFile.removeSource)bunx --bun vitest runinpackages/plugins/mcp— 30/30bunx --bun vitest runinpackages/plugins/graphql— 14/14bunx --bun vitest runinpackages/core/sdk— 90/90bunx --bun vitest runinapps/local— 23/23 (incl. newconfig-sync.test.tscovering allMcpAuthConfigvariants)bun run typecheckclean acrossapps/local,packages/plugins/{openapi,mcp,graphql}executor web:executor.jsonccorrectly omits the source and the DB stays clean (was reappearing pre-fix)auth: { kind: "oauth2", connectionId: ... }block is preserved inexecutor.jsoncand 33 Linear tools load (was silently 401'ing pre-fix)