Add hosted outbound HTTP policy

Route hosted plugin outbound requests through a shared Effect HttpClient layer that blocks local/private/metadata targets and re-checks redirects.

Thread the executor-provided HTTP client through OpenAPI, GraphQL, MCP probing, and OAuth discovery, keep local harnesses on the normal fetch client, and split the restored security coverage into the relevant existing suites.

Fix cloud migration scripts to invoke the local Drizzle binary under op run.

Author: RhysSullivan

apps/cloud/executor.config.ts

@@ -37,10 +37,15 @@ interface CloudPluginDeps {
 
 export default defineExecutorConfig({
   dialect: "pg",
-  plugins: ({ workosCredentials, workosVaultClient }: CloudPluginDeps = {}) =>
+  plugins: ({
+    workosCredentials,
+    workosVaultClient,
+  }: CloudPluginDeps = {}) =>
     [
       openApiPlugin(),
-      mcpPlugin({ dangerouslyAllowStdioMCP: false }),
+      mcpPlugin({
+        dangerouslyAllowStdioMCP: false,
+      }),
       graphqlPlugin(),
       workosVaultPlugin({
         credentials: workosCredentials ?? { apiKey: "", clientId: "" },

apps/cloud/package.json

@@ -11,9 +11,9 @@
     "db:schema": "node --import jiti/register ../../packages/core/cli/src/index.ts generate --config ./executor.config.ts --output ./src/services/executor-schema.ts",
     "db:generate": "drizzle-kit generate",
     "db:studio": "drizzle-kit studio",
-    "db:studio:prod": "op run --env-file=.env.production -- drizzle-kit studio",
-    "db:migrate:prod": "op run --env-file=.env.production -- drizzle-kit migrate",
-    "db:migrate:dev": "op run --env-file=.env.op -- drizzle-kit migrate",
+    "db:studio:prod": "op run --env-file=.env.production -- bun --bun ../../node_modules/.bun/node_modules/drizzle-kit/bin.cjs studio",
+    "db:migrate:prod": "op run --env-file=.env.production -- bun --bun ../../node_modules/.bun/node_modules/drizzle-kit/bin.cjs migrate",
+    "db:migrate:dev": "op run --env-file=.env.op -- bun --bun ../../node_modules/.bun/node_modules/drizzle-kit/bin.cjs migrate",
     "build": "node scripts/build.mjs",
     "preview": "vite preview",
     "deploy": "op run --env-file=.env.production -- bun run build && op run --env-file=.env.production -- wrangler deploy",

apps/cloud/src/mcp-session.e2e.node.test.ts

@@ -33,6 +33,7 @@ import {
   createExecutor,
   definePlugin,
 } from "@executor-js/sdk";
+import { FetchHttpClient } from "effect/unstable/http";
 import { makePostgresAdapter, makePostgresBlobStore } from "@executor-js/storage-postgres";
 import { makeTestWorkOSVaultClient } from "@executor-js/plugin-workos-vault/testing";
 import executorConfig from "../executor.config";
@@ -117,6 +118,7 @@ const buildScopedExecutor = (scopeId: string, scopeName: string, options: BuildO
       adapter,
       blobs,
       plugins,
+      httpClientLayer: FetchHttpClient.layer,
       onElicitation: "accept-all",
     });
   });

apps/cloud/src/services/__test-harness__/api-harness.ts

@@ -26,7 +26,12 @@ import {
 } from "@executor-js/api/server";
 import { createExecutionEngine } from "@executor-js/execution";
 import { makeQuickJsExecutor } from "@executor-js/runtime-quickjs";
-import { Scope, ScopeId, collectSchemas, createExecutor } from "@executor-js/sdk";
+import {
+  Scope,
+  ScopeId,
+  collectSchemas,
+  createExecutor,
+} from "@executor-js/sdk";
 import { makePostgresAdapter, makePostgresBlobStore } from "@executor-js/storage-postgres";
 import { makeTestWorkOSVaultClient } from "@executor-js/plugin-workos-vault/testing";
 
@@ -61,7 +66,10 @@ const defaultUserFor = (orgId: string) => `default_user_${orgId}`;
 // ---------------------------------------------------------------------------
 
 const fakeVault = makeTestWorkOSVaultClient();
-const testPlugins = executorConfig.plugins({ workosVaultClient: fakeVault });
+const testPlugins = executorConfig.plugins({
+  workosVaultClient: fakeVault,
+});
+const testHttpClientLayer = FetchHttpClient.layer;
 
 const createTestScopedExecutor = (userId: string, orgId: string, orgName: string) =>
   Effect.gen(function* () {
@@ -85,6 +93,7 @@ const createTestScopedExecutor = (userId: string, orgId: string, orgName: string
       adapter,
       blobs,
       plugins,
+      httpClientLayer: testHttpClientLayer,
       onElicitation: "accept-all",
     });
   });

apps/cloud/src/services/executor.ts

@@ -10,7 +10,13 @@
 
 import { Effect } from "effect";
 
-import { Scope, ScopeId, collectSchemas, createExecutor } from "@executor-js/sdk";
+import {
+  Scope,
+  ScopeId,
+  collectSchemas,
+  createExecutor,
+  makeHostedHttpClientLayer,
+} from "@executor-js/sdk";
 import { makePostgresAdapter, makePostgresBlobStore } from "@executor-js/storage-postgres";
 
 import { env } from "cloudflare:workers";
@@ -58,6 +64,7 @@ export const createScopedExecutor = (
     const { db } = yield* DbService;
 
     const plugins = orgPlugins();
+    const httpClientLayer = makeHostedHttpClientLayer();
     const schema = collectSchemas(plugins);
     const adapter = makePostgresAdapter({ db, schema });
     const blobs = makePostgresBlobStore({ db });
@@ -82,6 +89,7 @@ export const createScopedExecutor = (
       adapter,
       blobs,
       plugins,
+      httpClientLayer,
       onElicitation: "accept-all",
     });
   });

apps/cloud/src/services/mcp-oauth.node.test.ts

@@ -27,10 +27,10 @@ import { createServer, type Server } from "node:http";
 import type { AddressInfo } from "node:net";
 import { createHash, randomBytes } from "node:crypto";
 
-import { Effect, Option, Schema } from "effect";
+import { Effect, Option, Result, Schema } from "effect";
 import { ScopeId } from "@executor-js/sdk";
 
-import { asUser, testUserOrgScopeId } from "./__test-harness__/api-harness";
+import { asOrg, asUser, testUserOrgScopeId } from "./__test-harness__/api-harness";
 
 // ---------------------------------------------------------------------------
 // Fake OAuth + MCP server
@@ -262,6 +262,67 @@ afterAll(async () => {
 // ---------------------------------------------------------------------------
 
 describe("mcp oauth end-to-end (node pool, real OAuth + MCP server)", () => {
+  it.effect(
+    "start rejects a redirectUrl on a different origin before discovery",
+    () =>
+      Effect.gen(function* () {
+        const org = `org_${crypto.randomUUID()}`;
+        const scopeId = ScopeId.make(org);
+        const start = Date.now();
+
+        const result = yield* asOrg(org, (client) =>
+          client.oauth.start({
+            params: { scopeId },
+            payload: {
+              endpoint: "https://example.test/api",
+              redirectUrl: "https://other.example/cb",
+              connectionId: "conn-foreign-redirect",
+              tokenScope: String(scopeId),
+              pluginId: "mcp",
+              strategy: { kind: "dynamic-dcr" },
+            },
+          }),
+        ).pipe(Effect.result);
+
+        expect(Result.isFailure(result)).toBe(true);
+        expect(Date.now() - start).toBeLessThan(1000);
+      }),
+    { timeout: 30_000 },
+  );
+
+  it.effect(
+    "start rejects non-http redirectUrl schemes",
+    () =>
+      Effect.gen(function* () {
+        const org = `org_${crypto.randomUUID()}`;
+        const scopeId = ScopeId.make(org);
+
+        for (const redirectUrl of [
+          "javascript:alert(1)",
+          "data:text/html,<script>alert(1)</script>",
+        ]) {
+          const start = Date.now();
+          const result = yield* asOrg(org, (client) =>
+            client.oauth.start({
+              params: { scopeId },
+              payload: {
+                endpoint: "https://example.test/api",
+                redirectUrl,
+                connectionId: `conn-${crypto.randomUUID().slice(0, 8)}`,
+                tokenScope: String(scopeId),
+                pluginId: "mcp",
+                strategy: { kind: "dynamic-dcr" },
+              },
+            }),
+          ).pipe(Effect.result);
+
+          expect(Result.isFailure(result)).toBe(true);
+          expect(Date.now() - start).toBeLessThan(1000);
+        }
+      }),
+    { timeout: 30_000 },
+  );
+
   it.effect(
     "startOAuth → authorize → completeOAuth writes tokens at the invoker scope",
     () =>

apps/cloud/src/services/secrets-api.node.test.ts

@@ -9,24 +9,27 @@ import { ScopeId, SecretId } from "@executor-js/sdk";
 import { asOrg, fetchForOrg, TEST_BASE_URL } from "./__test-harness__/api-harness";
 
 describe("secrets api (HTTP)", () => {
-  it.effect("set → list → status round-trips a new secret without exposing plaintext", () =>
+  it.effect("set → list → status returns secret metadata", () =>
     Effect.gen(function* () {
       const org = `org_${crypto.randomUUID()}`;
       const id = `sec_${crypto.randomUUID().slice(0, 8)}`;
 
+      const secretValue = "sk-test-abc";
       const setRef = yield* asOrg(org, (client) =>
         client.secrets.set({
           params: { scopeId: ScopeId.make(org) },
-          payload: { id: SecretId.make(id), name: "My API Token", value: "sk-test-abc" },
+          payload: { id: SecretId.make(id), name: "My API Token", value: secretValue },
         }),
       );
       expect(setRef.id).toBe(id);
       expect(setRef.scopeId).toBe(org);
+      expect(JSON.stringify(setRef)).not.toContain(secretValue);
 
       const list = yield* asOrg(org, (client) =>
         client.secrets.list({ params: { scopeId: ScopeId.make(org) } }),
       );
       expect(list.find((s) => s.id === id)?.name).toBe("My API Token");
+      expect(JSON.stringify(list)).not.toContain(secretValue);
 
       const status = yield* asOrg(org, (client) =>
         client.secrets.status({
@@ -37,7 +40,7 @@ describe("secrets api (HTTP)", () => {
     }),
   );
 
-  it.effect("does not expose a plaintext resolve endpoint", () =>
+  it.effect("resolve is not available through the public API", () =>
     Effect.gen(function* () {
       const org = `org_${crypto.randomUUID()}`;
       const id = `sec_${crypto.randomUUID().slice(0, 8)}`;

apps/cloud/src/services/sources-api.node.test.ts

@@ -373,6 +373,26 @@ describe("sources api (HTTP)", () => {
     }),
   );
 
+  it.effect("openapi.addSpec accepts a public HTTP baseUrl in local mode", () =>
+    Effect.gen(function* () {
+      const org = `org_${crypto.randomUUID()}`;
+
+      const result = yield* asOrg(org, (client) =>
+        client.openapi.addSpec({
+          params: { scopeId: ScopeId.make(org) },
+          payload: {
+            targetScope: ScopeId.make(org),
+            spec: MINIMAL_OPENAPI_SPEC,
+            namespace: `ns_${crypto.randomUUID().replace(/-/g, "_")}`,
+            baseUrl: "http://example.com",
+          },
+        }),
+      );
+
+      expect(result.toolCount).toBe(1);
+    }),
+  );
+
   it.effect("added OpenAPI source can be listed, inspected, and invoked through execution", () =>
     Effect.gen(function* () {
       const server = yield* Effect.acquireRelease(