executor 1.1.7 → 1.1.9

package/bin/executor.mjs

@@ -27936,9 +27936,9 @@ var require_toError = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", {
     value: true
   });
-  exports.toError = toError2;
+  exports.toError = toError3;
   var _inspect = require_inspect();
-  function toError2(thrownValue) {
+  function toError3(thrownValue) {
     return thrownValue instanceof Error ? thrownValue : new NonErrorThrown(thrownValue);
   }
 
@@ -120561,12 +120561,12 @@ ${Me13.join(`
 });
 
 // apps/executor/src/cli/main.ts
-import { existsSync as existsSync6, readFileSync as readFileSync2 } from "node:fs";
+import { existsSync as existsSync7, readFileSync as readFileSync2 } from "node:fs";
 import { mkdir as mkdir4, open as open3, readFile as readFile5, rm as rm5 } from "node:fs/promises";
 import { spawn as spawn3 } from "node:child_process";
 import { dirname as dirname7, resolve as resolve8 } from "node:path";
 import { createInterface } from "node:readline/promises";
-import { fileURLToPath as fileURLToPath8 } from "node:url";
+import { fileURLToPath as fileURLToPath7 } from "node:url";
 
 // node_modules/.bun/@effect+cli@0.73.2+48e0a555d17e013f/node_modules/@effect/cli/dist/esm/Args.js
 var exports_Args = {};
@@ -167958,7 +167958,7 @@ var compileOpenApiToolDefinitions = (manifest) => {
 var unknownInputSchema = {
   "~standard": {
     version: 1,
-    vendor: "@executor-v3/codemode-core",
+    vendor: "@executor/codemode-core",
     validate: (value6) => ({
       value: value6
     })
@@ -178545,7 +178545,7 @@ var cleanupStalePGliteLock = async (dataDir) => {
   } catch {}
 };
 var createPGliteRuntime = async (localDataDir) => {
-  const normalized = trim(localDataDir) ?? ".executor-v3/control-plane-pgdata";
+  const normalized = trim(localDataDir) ?? ".executor/control-plane-pgdata";
   let client;
   if (normalized === ":memory:") {
     client = new We2;
@@ -178618,7 +178618,7 @@ var runMigrations = async (runtime5, options9) => {
 };
 var createSqlRuntime = async (options9) => {
   const databaseUrl = trim(options9.databaseUrl);
-  const runtime5 = databaseUrl && isPostgresUrl(databaseUrl) ? await createPostgresRuntime(databaseUrl, trim(options9.postgresApplicationName)) : await createPGliteRuntime(options9.localDataDir ?? ".executor-v3/control-plane-pgdata");
+  const runtime5 = databaseUrl && isPostgresUrl(databaseUrl) ? await createPostgresRuntime(databaseUrl, trim(options9.postgresApplicationName)) : await createPGliteRuntime(options9.localDataDir ?? ".executor/control-plane-pgdata");
   return runtime5;
 };
 
@@ -179014,7 +179014,7 @@ class WorkspacesApi extends exports_HttpApiGroup.make("workspaces").add(exports_
 
 // packages/control-plane/src/api/api.ts
 class ControlPlaneApi extends exports_HttpApi.make("controlPlane").add(LocalApi).add(OAuthApi).add(OrganizationsApi).add(MembershipsApi).add(WorkspacesApi).add(SourcesApi).add(PoliciesApi).add(ExecutionsApi).annotateContext(exports_OpenApi.annotations({
-  title: "Executor v3 Control Plane API",
+  title: "Executor Control Plane API",
   description: "CRUD control plane for organizations, workspaces, sources, and policies"
 })) {
 }
@@ -202178,7 +202178,7 @@ var createSdkMcpConnector = (input) => {
   const transport = input.transport ?? "auto";
   const requestInit = Object.keys(headers).length > 0 ? { headers } : undefined;
   const createClient = () => new Client({
-    name: input.clientName ?? "executor-v3-codemode-mcp",
+    name: input.clientName ?? "executor-codemode-mcp",
     version: input.clientVersion ?? "0.1.0"
   }, { capabilities: { elicitation: { form: {}, url: {} } } });
   return async () => {
@@ -202612,6 +202612,7 @@ var discoverMcpToolsFromConnector = (input) => gen2(function* () {
   };
 });
 // packages/runtime-deno-subprocess/src/index.ts
+import { spawnSync } from "node:child_process";
 import { existsSync as existsSync4 } from "node:fs";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 
@@ -202728,6 +202729,13 @@ var defaultDenoExecutable = () => {
   }
   return "deno";
 };
+var formatDenoSpawnError = (cause2, executable) => {
+  const code2 = typeof cause2 === "object" && cause2 !== null && "code" in cause2 ? String(cause2.code) : null;
+  if (code2 === "ENOENT") {
+    return `Failed to spawn Deno subprocess: Deno executable "${executable}" was not found. Install Deno or set DENO_BIN.`;
+  }
+  return `Failed to spawn Deno subprocess: ${cause2 instanceof Error ? cause2.message : String(cause2)}`;
+};
 var resolveWorkerScriptPath = () => {
   const moduleUrl = String(import.meta.url);
   if (moduleUrl.startsWith("/")) {
@@ -202854,7 +202862,7 @@ ${String(cause2)}`);
           stderrBuffer += chunk4;
         },
         onError: (cause2) => {
-          fail19(`Failed to spawn Deno subprocess: ${cause2.message}`);
+          fail19(formatDenoSpawnError(cause2, denoExecutable));
         },
         onExit: (exitCode, signal) => {
           if (settled) {
@@ -202864,7 +202872,7 @@ ${String(cause2)}`);
         }
       });
     } catch (cause2) {
-      fail19(`Failed to spawn Deno subprocess: ${cause2 instanceof Error ? cause2.message : String(cause2)}`);
+      fail19(formatDenoSpawnError(cause2, denoExecutable));
       return;
     }
     writeMessage(worker.stdin, {
@@ -202874,10 +202882,162 @@ ${String(cause2)}`);
   });
   return result;
 });
+var isDenoAvailable = (executable = defaultDenoExecutable()) => {
+  const result = spawnSync(executable, ["--version"], {
+    stdio: "ignore",
+    timeout: 5000
+  });
+  return result.error === undefined && result.status === 0;
+};
 var makeDenoSubprocessExecutor = (options9 = {}) => ({
   execute: (code2, toolInvoker) => executeInDeno(code2, toolInvoker, options9)
 });
 
+// packages/runtime-ses/src/index.ts
+import { fork as fork3 } from "node:child_process";
+import { fileURLToPath as fileURLToPath4 } from "node:url";
+var DEFAULT_TIMEOUT_MS2 = 5 * 60000;
+var DEFAULT_EVALUATION_ID = "evaluation";
+var WORKER_PATH = fileURLToPath4(new URL("./sandbox-worker.mjs", import.meta.url));
+var toError2 = (cause2) => cause2 instanceof Error ? cause2 : new Error(String(cause2));
+var createSandboxWorker = () => fork3(WORKER_PATH, [], { silent: true });
+var describeWorkerExit = (code2, signal, stderr) => {
+  const stderrSuffix = stderr.trim().length > 0 ? `
+${stderr.trim()}` : "";
+  if (signal) {
+    return new Error(`SES worker exited from signal ${signal}${stderrSuffix}`);
+  }
+  if (typeof code2 === "number") {
+    return new Error(`SES worker exited with code ${code2}${stderrSuffix}`);
+  }
+  return new Error(`SES worker exited before returning a result${stderrSuffix}`);
+};
+var sendMessage = (child, message) => {
+  if (typeof child.send !== "function") {
+    throw new Error("SES worker IPC channel is unavailable");
+  }
+  child.send(message);
+};
+var evaluateInSandbox = async (options9, code2, toolInvoker) => {
+  const child = createSandboxWorker();
+  const timeoutMs = options9.timeoutMs ?? DEFAULT_TIMEOUT_MS2;
+  const stderrChunks = [];
+  if (child.stderr) {
+    child.stderr.on("data", (chunk4) => {
+      stderrChunks.push(chunk4.toString());
+    });
+  }
+  return new Promise((resolve5, reject) => {
+    let settled = false;
+    let timeoutHandle;
+    const cleanup = () => {
+      if (timeoutHandle) {
+        clearTimeout(timeoutHandle);
+        timeoutHandle = undefined;
+      }
+      child.off("error", onError4);
+      child.off("exit", onExit4);
+      child.off("message", onMessage);
+      if (!child.killed) {
+        child.kill();
+      }
+    };
+    const settle = (effect3) => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      cleanup();
+      effect3();
+    };
+    const resetTimeout = () => {
+      if (timeoutHandle) {
+        clearTimeout(timeoutHandle);
+      }
+      timeoutHandle = setTimeout(() => {
+        settle(() => {
+          reject(new Error(`Execution timed out after ${timeoutMs}ms`));
+        });
+      }, timeoutMs);
+    };
+    const onError4 = (error51) => {
+      settle(() => {
+        reject(error51);
+      });
+    };
+    const onExit4 = (code3, signal) => {
+      settle(() => {
+        reject(describeWorkerExit(code3, signal, stderrChunks.join("")));
+      });
+    };
+    const onMessage = (message) => {
+      if (message.type === "ready") {
+        resetTimeout();
+        sendMessage(child, {
+          type: "evaluate",
+          id: DEFAULT_EVALUATION_ID,
+          code: code2,
+          allowFetch: options9.allowFetch === true
+        });
+        return;
+      }
+      if (message.type === "tool-call") {
+        resetTimeout();
+        runPromise(toolInvoker.invoke({ path: message.path, args: message.args })).then((value6) => {
+          if (settled) {
+            return;
+          }
+          resetTimeout();
+          sendMessage(child, {
+            type: "tool-response",
+            callId: message.callId,
+            value: value6
+          });
+        }).catch((cause2) => {
+          if (settled) {
+            return;
+          }
+          resetTimeout();
+          const error51 = toError2(cause2);
+          sendMessage(child, {
+            type: "tool-response",
+            callId: message.callId,
+            error: error51.stack ?? error51.message
+          });
+        });
+        return;
+      }
+      if (message.type === "result") {
+        settle(() => {
+          if (message.error) {
+            resolve5({
+              result: null,
+              error: message.error,
+              logs: message.logs ?? []
+            });
+            return;
+          }
+          resolve5({
+            result: message.value,
+            logs: message.logs ?? []
+          });
+        });
+      }
+    };
+    child.on("error", onError4);
+    child.on("exit", onExit4);
+    child.on("message", onMessage);
+    resetTimeout();
+  });
+};
+var runInSes = (options9, code2, toolInvoker) => tryPromise2({
+  try: () => evaluateInSandbox(options9, code2, toolInvoker),
+  catch: toError2
+});
+var makeSesExecutor = (options9 = {}) => ({
+  execute: (code2, toolInvoker) => runInSes(options9, code2, toolInvoker)
+});
+
 // packages/control-plane/src/runtime/schema-type-signature.ts
 var asRecord4 = (value6) => typeof value6 === "object" && value6 !== null && !Array.isArray(value6) ? value6 : {};
 var asStringArray2 = (value6) => Array.isArray(value6) ? value6.filter((item) => typeof item === "string") : [];
@@ -204277,7 +204437,7 @@ var ENV_SECRET_PROVIDER_ID = "env";
 var PARAMS_SECRET_PROVIDER_ID = "params";
 var KEYCHAIN_SECRET_PROVIDER_ID = "keychain";
 var POSTGRES_SECRET_PROVIDER_ID2 = "postgres";
-var DEFAULT_KEYCHAIN_SERVICE_NAME = "executor-v3";
+var DEFAULT_KEYCHAIN_SERVICE_NAME = "executor";
 var DANGEROUSLY_ALLOW_ENV_SECRETS_ENV = "DANGEROUSLY_ALLOW_ENV_SECRETS";
 var SECRET_STORE_PROVIDER_ENV = "EXECUTOR_SECRET_STORE_PROVIDER";
 var KEYCHAIN_SERVICE_NAME_ENV = "EXECUTOR_KEYCHAIN_SERVICE_NAME";
@@ -204744,7 +204904,7 @@ var decodeJson = (input) => {
     return input.fallback;
   }
 };
-var toError2 = (cause2) => cause2 instanceof Error ? cause2 : new Error(String(cause2));
+var toError3 = (cause2) => cause2 instanceof Error ? cause2 : new Error(String(cause2));
 var createClientMetadata = (redirectUrl) => ({
   redirect_uris: [redirectUrl],
   grant_types: ["authorization_code", "refresh_token"],
@@ -204793,7 +204953,7 @@ var startMcpOAuthAuthorization = (input) => gen2(function* () {
     try: () => auth3(provider, {
       serverUrl: input.endpoint
     }),
-    catch: toError2
+    catch: toError3
   });
   if (result !== "REDIRECT" || !captured.authorizationUrl || !captured.codeVerifier) {
     return yield* fail8(new Error("OAuth flow did not produce an authorization redirect"));
@@ -204861,7 +205021,7 @@ var exchangeMcpOAuthAuthorizationCode = (input) => gen2(function* () {
       serverUrl: input.session.endpoint,
       authorizationCode: input.code
     }),
-    catch: toError2
+    catch: toError3
   });
   if (result !== "AUTHORIZED" || !captured.tokens) {
     return yield* fail8(new Error("OAuth redirect did not complete MCP OAuth setup"));
@@ -206794,8 +206954,9 @@ var createWorkspaceExecutionEnvironmentResolver = (input) => {
       sourceAuthService: input.sourceAuthService,
       onElicitation
     });
+    const executor = isDenoAvailable() ? makeDenoSubprocessExecutor() : makeSesExecutor();
     return {
-      executor: makeDenoSubprocessExecutor(),
+      executor,
       toolInvoker,
       catalog
     };
@@ -207622,7 +207783,7 @@ var ControlPlaneMembershipsLive = exports_HttpApiBuilder.group(ControlPlaneApi,
 })))));
 
 // packages/control-plane/src/api/oauth/http.ts
-var OAUTH_RESULT_STORAGE_KEY_PREFIX = "executor-v3:oauth-result:";
+var OAUTH_RESULT_STORAGE_KEY_PREFIX = "executor:oauth-result:";
 var requireWriteSources = (workspaceId) => requirePermission({
   permission: "sources:write",
   workspaceId
@@ -207821,7 +207982,7 @@ var ControlPlaneOAuthLive = exports_HttpApiBuilder.group(ControlPlaneApi, "oauth
       status: "connected",
       sessionId: completed.right.sessionId,
       payload: {
-        type: "executor-v3:oauth-result",
+        type: "executor:oauth-result",
         ok: true,
         sessionId: completed.right.sessionId,
         auth: completed.right.auth
@@ -207835,7 +207996,7 @@ var ControlPlaneOAuthLive = exports_HttpApiBuilder.group(ControlPlaneApi, "oauth
     status: "failed",
     sessionId: "failed",
     payload: {
-      type: "executor-v3:oauth-result",
+      type: "executor:oauth-result",
       ok: false,
       sessionId: null,
       error: message
@@ -209414,7 +209575,7 @@ var utils = {
 // node_modules/.bun/prettier@3.8.1/node_modules/prettier/index.mjs
 import { equal, ok, strictEqual } from "assert";
 import path11 from "path";
-import { fileURLToPath as fileURLToPath5 } from "url";
+import { fileURLToPath as fileURLToPath52 } from "url";
 import path13 from "path";
 import { pathToFileURL as pathToFileURL5 } from "url";
 import path12 from "path";
@@ -224052,7 +224213,7 @@ function getLanguageByIsSupported(languages2, file10) {
   }
   if (isUrl(file10)) {
     try {
-      file10 = fileURLToPath5(file10);
+      file10 = fileURLToPath52(file10);
     } catch {
       return;
     }
@@ -227682,7 +227843,7 @@ var tryDetectMcp = (input) => gen2(function* () {
   }
   const oauthProbe = yield* either3(startMcpOAuthAuthorization({
     endpoint: input.normalizedUrl,
-    redirectUrl: "http://127.0.0.1/executor-v3/discovery/oauth/callback",
+    redirectUrl: "http://127.0.0.1/executor/discovery/oauth/callback",
     state: "source-discovery"
   }));
   if (oauthProbe._tag === "Left") {
@@ -228407,7 +228568,7 @@ var ControlPlaneSourcesLive = exports_HttpApiBuilder.group(ControlPlaneApi, "sou
   message: `Source connected: ${source3.id}. You can close this window.`,
   state: "stored",
   payload: {
-    type: "executor-v3:source-oauth-result",
+    type: "executor:source-oauth-result",
     ok: true,
     sourceId: source3.id
   }
@@ -228416,7 +228577,7 @@ var ControlPlaneSourcesLive = exports_HttpApiBuilder.group(ControlPlaneApi, "sou
   message: error51 instanceof Error ? error51.message : "Failed completing OAuth",
   state: "cancelled",
   payload: {
-    type: "executor-v3:source-oauth-result",
+    type: "executor:source-oauth-result",
     ok: false,
     error: error51 instanceof Error ? error51.message : "Failed completing OAuth"
   }
@@ -228644,12 +228805,13 @@ var createControlPlaneClient = (input) => {
   }).pipe(provide2(exports_FetchHttpClient.layer));
 };
 // packages/server/src/index.ts
+import { existsSync as existsSync5 } from "node:fs";
+import { mkdir as mkdir3, readFile as readFile4, rename as rename5, rm as rm4, stat as stat4, writeFile as writeFile3 } from "node:fs/promises";
 import {
   createServer as createNodeServer
 } from "node:http";
-import { mkdir as mkdir3, readFile as readFile4, rm as rm4, stat as stat4, writeFile as writeFile3 } from "node:fs/promises";
-import { Readable } from "node:stream";
 import { dirname as dirname5, extname as extname2, resolve as resolve6 } from "node:path";
+import { Readable } from "node:stream";
 
 // node_modules/.bun/@modelcontextprotocol+sdk@1.27.1/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/server.js
 class ExperimentalServerTasks {
@@ -230694,7 +230856,11 @@ var createExecutorMcpServer = async (config3) => {
     return buildToolResult(created);
   });
   const resumeTool = server.registerTool("resume", {
-    description: "Resume a paused executor execution using the resumePayload returned by execute.",
+    description: [
+      "Resume a paused executor execution using the resumePayload returned by execute.",
+      "Never call this without getting approval from the user first unless they explicitly state otherwise."
+    ].join(`
+`),
     inputSchema: resumeInputSchema
   }, async (input) => {
     const resumed = await driveExecutionWithoutElicitation({
@@ -230844,6 +231010,9 @@ var defaultLinuxStateHome = trim4(process.env.XDG_STATE_HOME) ?? join10(home, ".
 var defaultWindowsHome = join10(trim4(process.env.LOCALAPPDATA) ?? join10(home, "AppData", "Local"), "Executor");
 var defaultMacHome = join10(home, "Library", "Application Support", "Executor");
 var defaultLinuxHome = join10(defaultLinuxDataHome, "executor");
+var legacyLinuxHome = join10(defaultLinuxDataHome, "executor-v3");
+var legacyWindowsHome = join10(trim4(process.env.LOCALAPPDATA) ?? join10(home, "AppData", "Local"), "Executor-v3");
+var legacyMacHome = join10(home, "Library", "Application Support", "Executor-v3");
 var DEFAULT_SERVER_PORT = 8788;
 var DEFAULT_SERVER_HOST = "127.0.0.1";
 var DEFAULT_SERVER_BASE_URL = `http://${DEFAULT_SERVER_HOST}:${DEFAULT_SERVER_PORT}`;
@@ -230851,6 +231020,11 @@ var DEFAULT_EXECUTOR_HOME = explicitExecutorHome ?? (isWindows ? defaultWindowsH
 var DEFAULT_EXECUTOR_DATA_DIR = trim4(process.env[EXECUTOR_DATA_DIR_ENV]) ?? join10(DEFAULT_EXECUTOR_HOME, "data");
 var DEFAULT_EXECUTOR_RUN_DIR = explicitExecutorHome ? join10(DEFAULT_EXECUTOR_HOME, "run") : isWindows || isMac ? join10(DEFAULT_EXECUTOR_HOME, "run") : join10(defaultLinuxStateHome, "executor", "run");
 var DEFAULT_LOCAL_DATA_DIR = trim4(process.env[EXECUTOR_LOCAL_DATA_DIR_ENV]) ?? join10(DEFAULT_EXECUTOR_DATA_DIR, "control-plane");
+var DEFAULT_LEGACY_LOCAL_DATA_DIRS = explicitExecutorHome ? [] : [
+  isWindows ? join10(legacyWindowsHome, "control-plane") : null,
+  isMac ? join10(legacyMacHome, "control-plane") : null,
+  !isWindows && !isMac ? join10(legacyLinuxHome, "control-plane") : null
+].filter((value6) => value6 !== null);
 var DEFAULT_SERVER_PID_FILE = trim4(process.env[EXECUTOR_SERVER_PID_FILE_ENV]) ?? join10(DEFAULT_EXECUTOR_RUN_DIR, "server.pid");
 var DEFAULT_SERVER_LOG_FILE = trim4(process.env[EXECUTOR_SERVER_LOG_FILE_ENV]) ?? join10(DEFAULT_EXECUTOR_RUN_DIR, "server.log");
 var SERVER_START_TIMEOUT_MS = 5000;
@@ -230861,6 +231035,71 @@ var disposeRuntime = (runtime6) => tryPromise2({
   try: () => runtime6.close(),
   catch: (cause2) => cause2 instanceof Error ? cause2 : new Error(String(cause2 ?? "runtime close failed"))
 }).pipe(orDie2);
+var createRuntime = (localDataDir, getLocalServerBaseUrl, options10) => createSqlControlPlaneRuntime({
+  localDataDir,
+  migrationsFolder: options10.migrationsFolder,
+  executionResolver: options10.executionResolver,
+  resolveSecretMaterial: options10.resolveSecretMaterial,
+  getLocalServerBaseUrl
+}).pipe(mapError2((cause2) => cause2 instanceof Error ? cause2 : new Error(String(cause2))));
+var moveLegacyLocalDataDir = (legacyLocalDataDir, requestedLocalDataDir) => tryPromise2({
+  try: async () => {
+    await mkdir3(dirname5(requestedLocalDataDir), { recursive: true });
+    if (existsSync5(requestedLocalDataDir)) {
+      const backupPath = `${requestedLocalDataDir}.backup-${Date.now()}`;
+      await rename5(requestedLocalDataDir, backupPath);
+      console.warn(`[executor] Backed up unreadable local data dir to: ${backupPath}`);
+    }
+    await rename5(legacyLocalDataDir, requestedLocalDataDir);
+    console.warn(`[executor] Moved legacy local data dir to: ${requestedLocalDataDir}`);
+  },
+  catch: (cause2) => cause2 instanceof Error ? cause2 : new Error(String(cause2))
+});
+var createRuntimeWithLegacyMigration = (requestedLocalDataDir, legacyLocalDataDirs, getLocalServerBaseUrl, options10) => gen2(function* () {
+  if (requestedLocalDataDir !== ":memory:" && !existsSync5(requestedLocalDataDir) && legacyLocalDataDirs.length > 0) {
+    for (const legacyLocalDataDir of legacyLocalDataDirs) {
+      const legacyExit = yield* exit2(createRuntime(legacyLocalDataDir, getLocalServerBaseUrl, options10));
+      if (isFailure(legacyExit)) {
+        continue;
+      }
+      yield* disposeRuntime(legacyExit.value);
+      const migrationExit = yield* exit2(moveLegacyLocalDataDir(legacyLocalDataDir, requestedLocalDataDir));
+      if (isFailure(migrationExit)) {
+        continue;
+      }
+      const migratedExit = yield* exit2(createRuntime(requestedLocalDataDir, getLocalServerBaseUrl, options10));
+      if (isSuccess(migratedExit)) {
+        return migratedExit.value;
+      }
+    }
+  }
+  const primaryExit = yield* exit2(createRuntime(requestedLocalDataDir, getLocalServerBaseUrl, options10));
+  if (isSuccess(primaryExit)) {
+    return primaryExit.value;
+  }
+  const primaryError = squash(primaryExit.cause);
+  if (legacyLocalDataDirs.length > 0) {
+    yield* sync3(() => {
+      console.warn(`[executor] Failed to open default local data dir: ${requestedLocalDataDir}`, primaryError instanceof Error ? primaryError.message : String(primaryError));
+    });
+  }
+  for (const legacyLocalDataDir of legacyLocalDataDirs) {
+    const legacyExit = yield* exit2(createRuntime(legacyLocalDataDir, getLocalServerBaseUrl, options10));
+    if (isFailure(legacyExit)) {
+      continue;
+    }
+    yield* disposeRuntime(legacyExit.value);
+    const migrationExit = yield* exit2(moveLegacyLocalDataDir(legacyLocalDataDir, requestedLocalDataDir));
+    if (isFailure(migrationExit)) {
+      continue;
+    }
+    const migratedExit = yield* exit2(createRuntime(requestedLocalDataDir, getLocalServerBaseUrl, options10));
+    if (isSuccess(migratedExit)) {
+      return migratedExit.value;
+    }
+  }
+  return yield* fail8(primaryError instanceof Error ? primaryError : new Error(String(primaryError)));
+});
 var createControlPlaneWebHandler = (runtime6) => acquireRelease2(sync3(() => exports_HttpApiBuilder.toWebHandler(merge7(createControlPlaneApiLayer(runtime6.runtimeLayer), exports_HttpServer.layerContext))), (handler2) => tryPromise2({ try: () => handler2.dispose(), catch: (cause2) => cause2 instanceof Error ? cause2 : new Error(String(cause2 ?? "web handler dispose failed")) }).pipe(orDie2));
 var safeFilePath = (assetsDir, pathname) => {
   const target = resolve6(assetsDir, `.${pathname}`);
@@ -230976,23 +231215,21 @@ var isApiRequest = (request) => {
   return pathname === "/mcp" || pathname === "/v1" || pathname.startsWith("/v1/");
 };
 var createLocalExecutorRequestHandler = (options10 = {}) => gen2(function* () {
-  const localDataDir = options10.localDataDir ?? DEFAULT_LOCAL_DATA_DIR;
-  if (localDataDir !== ":memory:") {
+  const requestedLocalDataDir = options10.localDataDir ?? DEFAULT_LOCAL_DATA_DIR;
+  const legacyLocalDataDirs = options10.localDataDir === undefined ? DEFAULT_LEGACY_LOCAL_DATA_DIRS.filter((candidate) => existsSync5(candidate)) : [];
+  if (requestedLocalDataDir !== ":memory:") {
     yield* tryPromise2({
-      try: () => mkdir3(dirname5(localDataDir), { recursive: true }),
+      try: () => mkdir3(dirname5(requestedLocalDataDir), { recursive: true }),
       catch: (cause2) => cause2 instanceof Error ? cause2 : new Error(String(cause2))
     });
   }
   let baseUrlRef;
-  const runtime6 = yield* acquireRelease2(createSqlControlPlaneRuntime({
-    localDataDir,
-    migrationsFolder: options10.migrationsFolder,
-    executionResolver: options10.executionResolver,
-    resolveSecretMaterial: options10.resolveSecretMaterial,
-    getLocalServerBaseUrl: () => baseUrlRef
-  }).pipe(mapError2((cause2) => cause2 instanceof Error ? cause2 : new Error(String(cause2)))), disposeRuntime);
+  const runtime6 = yield* acquireRelease2(createRuntimeWithLegacyMigration(requestedLocalDataDir, legacyLocalDataDirs, () => baseUrlRef, options10), disposeRuntime);
   const apiHandler = yield* createControlPlaneWebHandler(runtime6);
-  const mcpHandler = yield* acquireRelease2(sync3(() => createExecutorMcpRequestHandler(runtime6)), (handler2) => tryPromise2({ try: () => handler2.close(), catch: (cause2) => cause2 instanceof Error ? cause2 : new Error(String(cause2 ?? "mcp handler close failed")) }).pipe(orDie2));
+  const mcpHandler = yield* acquireRelease2(sync3(() => createExecutorMcpRequestHandler(runtime6)), (handler2) => tryPromise2({
+    try: () => handler2.close(),
+    catch: (cause2) => cause2 instanceof Error ? cause2 : new Error(String(cause2 ?? "mcp handler close failed"))
+  }).pipe(orDie2));
   return {
     runtime: runtime6,
     handleApiRequest: (request) => {
@@ -231227,7 +231464,7 @@ var seedGithubOpenApiSourceInWorkspace = (input) => gen2(function* () {
 });
 
 // apps/executor/src/cli/runtime-paths.ts
-import { existsSync as existsSync5 } from "node:fs";
+import { existsSync as existsSync6 } from "node:fs";
 import { dirname as dirname6, extname as extname3, resolve as resolve7 } from "node:path";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
 var sourceDir = dirname6(fileURLToPath6(import.meta.url));
@@ -231241,7 +231478,7 @@ var resolveIfExists = (value6) => {
     return null;
   }
   const resolved = resolve7(candidate);
-  return existsSync5(resolved) ? resolved : null;
+  return existsSync6(resolved) ? resolved : null;
 };
 var getSourceEntrypoint = () => {
   const candidate = trim5(process.argv[1]);
@@ -231254,21 +231491,21 @@ var getSourceEntrypoint = () => {
 };
 var resolveBundledNodeLauncher = () => {
   const candidate = resolve7(sourceDir, "executor.js");
-  return existsSync5(candidate) ? candidate : null;
+  return existsSync6(candidate) ? candidate : null;
 };
 var resolveRuntimeResourcesRoot = () => {
   const compiledCandidate = resolve7(dirname6(process.execPath), "../resources");
-  if (existsSync5(compiledCandidate)) {
+  if (existsSync6(compiledCandidate)) {
     return compiledCandidate;
   }
   const bundledCandidateFromModule = resolve7(sourceDir, "../resources");
-  if (existsSync5(bundledCandidateFromModule)) {
+  if (existsSync6(bundledCandidateFromModule)) {
     return bundledCandidateFromModule;
   }
   const sourceEntrypoint = getSourceEntrypoint();
   if (sourceEntrypoint) {
     const bundledCandidate = resolve7(dirname6(sourceEntrypoint), "../resources");
-    if (existsSync5(bundledCandidate)) {
+    if (existsSync6(bundledCandidate)) {
       return bundledCandidate;
     }
   }
@@ -231390,8 +231627,16 @@ var buildPausedExecutionOutput = (input) => {
   };
 };
 
+// apps/executor/src/cli/interaction-handling.ts
+var decideInteractionHandling = (input) => {
+  if (input.parsed?.mode === "url") {
+    return input.isInteractiveTerminal ? "url_interactive" : "url_paused";
+  }
+  return input.isInteractiveTerminal ? "form_interactive" : "form_paused";
+};
+
 // apps/executor/src/cli/main.ts
-var toError3 = (cause2) => cause2 instanceof Error ? cause2 : new Error(String(cause2));
+var toError4 = (cause2) => cause2 instanceof Error ? cause2 : new Error(String(cause2));
 var sleep5 = (ms8) => promise2(() => new Promise((resolve9) => setTimeout(resolve9, ms8)));
 var openUrlInBrowser = (url4) => sync3(() => {
   const cmd = process.platform === "darwin" ? ["open", url4] : process.platform === "win32" ? ["cmd", "/c", "start", "", url4] : ["xdg-open", url4];
@@ -231418,7 +231663,7 @@ var promptLine = (prompt4) => tryPromise2({
       rl5.close();
     }
   },
-  catch: toError3
+  catch: toError4
 });
 var readStdin = () => tryPromise2({
   try: async () => {
@@ -231429,7 +231674,7 @@ var readStdin = () => tryPromise2({
     }
     return contents;
   },
-  catch: toError3
+  catch: toError4
 });
 var readCode = (input) => gen2(function* () {
   if (input.code && input.code.trim().length > 0) {
@@ -231438,7 +231683,7 @@ var readCode = (input) => gen2(function* () {
   if (input.file && input.file.trim().length > 0) {
     const contents = yield* tryPromise2({
       try: () => readFile5(input.file, "utf8"),
-      catch: toError3
+      catch: toError4
     });
     if (contents.trim().length > 0) {
       return contents;
@@ -231455,7 +231700,7 @@ var readCode = (input) => gen2(function* () {
 });
 var getBootstrapClient = (baseUrl2 = DEFAULT_SERVER_BASE_URL) => createControlPlaneClient({ baseUrl: baseUrl2 });
 var decodeExecutionId = decodeUnknown2(ExecutionIdSchema);
-var cliSourceDir = dirname7(fileURLToPath8(import.meta.url));
+var cliSourceDir = dirname7(fileURLToPath7(import.meta.url));
 var CLI_NAME = "executor";
 var CLI_VERSION = (() => {
   const candidatePaths = [
@@ -231463,7 +231708,7 @@ var CLI_VERSION = (() => {
     resolve8(cliSourceDir, "../../package.json")
   ];
   for (const candidatePath of candidatePaths) {
-    if (!existsSync6(candidatePath)) {
+    if (!existsSync7(candidatePath)) {
       continue;
     }
     try {
@@ -231531,17 +231776,17 @@ var formatCatalogUnavailableMessage = (cause2) => {
 };
 var closeSqlRuntime = (runtime6) => tryPromise2({
   try: () => runtime6.close(),
-  catch: toError3
+  catch: toError4
 }).pipe(catchAll2(() => _void));
 var buildRunWorkflowText = (catalog) => {
   if (!catalog) {
     return succeed8(DEFAULT_RUN_WORKFLOW);
   }
-  return catalog.listNamespaces({ limit: 200 }).pipe(map16((namespaces) => buildWorkflowText(namespaces.length > 0 ? namespaces.map((namespace) => namespace.displayName ?? namespace.namespace) : ["none discovered yet"])), mapError2(toError3));
+  return catalog.listNamespaces({ limit: 200 }).pipe(map16((namespaces) => buildWorkflowText(namespaces.length > 0 ? namespaces.map((namespace) => namespace.displayName ?? namespace.namespace) : ["none discovered yet"])), mapError2(toError4));
 };
 var loadRunWorkflowText = () => acquireUseRelease2(createSqlControlPlaneRuntime({
   localDataDir: DEFAULT_LOCAL_DATA_DIR
-}).pipe(mapError2(toError3)), (runtime6) => gen2(function* () {
+}).pipe(mapError2(toError4)), (runtime6) => gen2(function* () {
   const environment2 = yield* gen2(function* () {
     const resolveExecutionEnvironment = yield* RuntimeExecutionResolverService;
     return yield* resolveExecutionEnvironment({
@@ -231549,7 +231794,7 @@ var loadRunWorkflowText = () => acquireUseRelease2(createSqlControlPlaneRuntime(
       accountId: runtime6.localInstallation.accountId,
       executionId: ExecutionIdSchema.make("exec_help")
     });
-  }).pipe(provide2(runtime6.runtimeLayer), mapError2(toError3));
+  }).pipe(provide2(runtime6.runtimeLayer), mapError2(toError4));
   return yield* buildRunWorkflowText(environment2.catalog);
 }), closeSqlRuntime).pipe(catchAllCause2((cause2) => succeed8([
   DEFAULT_RUN_WORKFLOW,
@@ -231675,7 +231920,7 @@ var startServerInBackground = (port2) => tryPromise2({
       await logHandle.close();
     }
   },
-  catch: toError3
+  catch: toError4
 });
 var readPidRecord = () => tryPromise2({
   try: async () => {
@@ -231728,10 +231973,11 @@ var waitForReachability = (baseUrl2, expected) => gen2(function* () {
   }
   const error51 = yield* tryPromise2({
     try: () => buildReachabilityTimeoutError(baseUrl2, expected),
-    catch: toError3
+    catch: toError4
   });
   return yield* fail8(error51);
 });
+var renderDenoSandboxDetail = (denoVersion) => denoVersion !== null ? `deno ${denoVersion}` : "deno not found (run `executor sandbox` to install)";
 var getServerStatus = (baseUrl2) => gen2(function* () {
   const pidRecord = yield* readPidRecord();
   const reachable = yield* isServerReachable(baseUrl2);
@@ -231739,6 +231985,7 @@ var getServerStatus = (baseUrl2) => gen2(function* () {
   const pid = typeof pidRecord?.pid === "number" ? pidRecord.pid : null;
   const pidRunning = pid !== null ? isPidRunning(pid) : false;
   const logFile = pidRecord?.logFile ?? DEFAULT_SERVER_LOG_FILE;
+  const denoVersion = yield* getDenoVersion();
   return {
     baseUrl: baseUrl2,
     reachable,
@@ -231749,7 +231996,8 @@ var getServerStatus = (baseUrl2) => gen2(function* () {
     localDataDir: DEFAULT_LOCAL_DATA_DIR,
     webAssetsDir: resolveRuntimeWebAssetsDir(),
     migrationsDir: resolveRuntimeMigrationsDir(),
-    installation
+    installation,
+    denoVersion
   };
 });
 var renderStatus = (status2) => [
@@ -231762,10 +232010,11 @@ var renderStatus = (status2) => [
   `localDataDir: ${status2.localDataDir}`,
   `webAssetsDir: ${status2.webAssetsDir ?? "missing"}`,
   `migrationsDir: ${status2.migrationsDir ?? "missing"}`,
-  `workspaceId: ${status2.installation?.workspaceId ?? "unavailable"}`
+  `workspaceId: ${status2.installation?.workspaceId ?? "unavailable"}`,
+  `denoSandbox: ${renderDenoSandboxDetail(status2.denoVersion)}`
 ].join(`
 `);
-var getDoctorReport = (baseUrl2) => getServerStatus(baseUrl2).pipe(flatMap10((status2) => getDenoVersion().pipe(map16((denoVersion) => {
+var getDoctorReport = (baseUrl2) => getServerStatus(baseUrl2).pipe(map16((status2) => {
   const checks4 = {
     serverReachable: {
       ok: status2.reachable,
@@ -231796,8 +232045,8 @@ var getDoctorReport = (baseUrl2) => getServerStatus(baseUrl2).pipe(flatMap10((st
       detail: status2.installation ? `workspace ${status2.installation.workspaceId}` : "local installation unavailable"
     },
     denoSandbox: {
-      ok: denoVersion !== null,
-      detail: denoVersion !== null ? `deno ${denoVersion}` : "deno not found (run `executor sandbox` to install)"
+      ok: status2.denoVersion !== null,
+      detail: renderDenoSandboxDetail(status2.denoVersion)
     }
   };
   return {
@@ -231805,7 +232054,7 @@ var getDoctorReport = (baseUrl2) => getServerStatus(baseUrl2).pipe(flatMap10((st
     status: status2,
     checks: checks4
   };
-}))));
+}));
 var printJson = (value6) => sync3(() => {
   console.log(JSON.stringify(value6, null, 2));
 });
@@ -232058,8 +232307,28 @@ var driveExecution = (input) => gen2(function* () {
       return current;
     }
     const parsed = parseInteractionPayload2(pending2);
-    const isInteractiveTerminal = process.stdin.isTTY && process.stdout.isTTY;
-    if (!isInteractiveTerminal) {
+    const handling = decideInteractionHandling({
+      parsed,
+      isInteractiveTerminal: process.stdin.isTTY && process.stdout.isTTY
+    });
+    if (handling === "url_interactive" && parsed?.mode === "url") {
+      yield* printUrlInteraction({
+        message: parsed.message,
+        url: parsed.url ?? null,
+        shouldOpen: input.shouldOpenUrls
+      });
+      current = yield* waitForExecutionProgress({
+        client: input.client,
+        workspaceId: input.workspaceId,
+        executionId: current.execution.id,
+        pendingInteractionId: pending2.id
+      });
+      continue;
+    }
+    if (handling === "url_paused") {
+      if (input.shouldOpenUrls && parsed?.mode === "url" && parsed.url) {
+        yield* openUrlInBrowser(parsed.url);
+      }
       const paused = buildPausedExecutionOutput({
         executionId: current.execution.id,
         interaction: pending2,
@@ -232073,19 +232342,19 @@ var driveExecution = (input) => gen2(function* () {
       });
       return current;
     }
-    if (parsed?.mode === "url") {
-      yield* printUrlInteraction({
-        message: parsed.message,
-        url: parsed.url ?? null,
-        shouldOpen: input.shouldOpenUrls
-      });
-      current = yield* waitForExecutionProgress({
-        client: input.client,
-        workspaceId: input.workspaceId,
+    if (handling === "form_paused") {
+      const paused = buildPausedExecutionOutput({
         executionId: current.execution.id,
-        pendingInteractionId: pending2.id
+        interaction: pending2,
+        baseUrl: input.baseUrl,
+        shouldOpenUrls: input.shouldOpenUrls,
+        cliName: CLI_NAME
       });
-      continue;
+      yield* sync3(() => {
+        console.log(JSON.stringify(paused));
+        process.exitCode = 20;
+      });
+      return current;
     }
     const responseJson = yield* promptInteraction({
       interaction: pending2,
@@ -232141,7 +232410,7 @@ var doctorCommand = exports_Command.make("doctor", {
 `))))).pipe(exports_Command.withDescription("Check local executor install and daemon health"));
 var getDenoVersion = () => tryPromise2({
   try: () => new Promise((resolve9) => {
-    const denoExecutable = process.env.DENO_BIN?.trim() || (process.env.HOME && existsSync6(`${process.env.HOME}/.deno/bin/deno`) ? `${process.env.HOME}/.deno/bin/deno` : "deno");
+    const denoExecutable = process.env.DENO_BIN?.trim() || (process.env.HOME && existsSync7(`${process.env.HOME}/.deno/bin/deno`) ? `${process.env.HOME}/.deno/bin/deno` : "deno");
     const child = spawn3(denoExecutable, ["--version"], {
       stdio: ["ignore", "pipe", "ignore"],
       timeout: 5000
@@ -232220,7 +232489,7 @@ var resumeCommand = exports_Command.make("resume", {
 }, ({ executionId, baseUrl: baseUrl2, noOpen }) => gen2(function* () {
   yield* ensureServer(baseUrl2);
   const { installation, client: client2 } = yield* getLocalAuthedClient(baseUrl2);
-  const decodedExecutionId = yield* decodeExecutionId(executionId).pipe(mapError2((cause2) => toError3(cause2)));
+  const decodedExecutionId = yield* decodeExecutionId(executionId).pipe(mapError2((cause2) => toError4(cause2)));
   const execution2 = yield* client2.executions.get({
     path: {
       workspaceId: installation.workspaceId,
@@ -232290,7 +232559,7 @@ var hiddenServer = () => {
     ...getDefaultServerOptions(Number.isInteger(port2) && port2 > 0 ? port2 : DEFAULT_SERVER_PORT)
   });
 };
-var program = (hiddenServer() ?? helpOverride() ?? runCli(toEffectCliArgv(getCliArgs())).pipe(mapError2(toError3))).pipe(provide2(exports_NodeFileSystem.layer)).pipe(provide2(exports_NodePath.layer)).pipe(catchAllCause2((cause2) => sync3(() => {
+var program = (hiddenServer() ?? helpOverride() ?? runCli(toEffectCliArgv(getCliArgs())).pipe(mapError2(toError4))).pipe(provide2(exports_NodeFileSystem.layer)).pipe(provide2(exports_NodePath.layer)).pipe(catchAllCause2((cause2) => sync3(() => {
   console.error(pretty2(cause2));
   process.exitCode = 1;
 })));