[RhysSullivan]

A dynamically registered OAuth client can only be authorized for the scopes it registered for. When a server later advertises more scopes (Mercury did), reconnecting reused the old client because reuse ignored scopes. oauth.start then requested every discovered scope, and the server refused with invalid_scope. Reconnecting could never recover.

• Record two things for each DCR client, in new nullable columns (cloud and local migrations, plus the local SQLite upgrade):
  • origin_requested_scopes: the scopes the registration asked for.
  • origin_scopes: the scopes the server registered, read from the registration response (RFC 7591 §3.2.1 lets the server narrow them); null when the response omits scope.
• Reuse a DCR client only when what it asked for, or was granted, covers the requested scopes. Comparing against what it asked for means a server that narrows registrations isn't sent a new registration on every reconnect. Rows with no recorded scopes are registered again on their next connect; existing connections keep refreshing through them.
• oauth.start narrows discovered scopes to the server-registered set, the same way scope-limited first-party apps already do. Declared scopes outside it fail with a clear error before the authorize redirect.

This PR's own Test check fails because one existing test assumed rows without recorded scopes are reused; #2403 updates it. Tests are in #2403.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	executor-cloud	daa3e1f	Oct 27 2026, 05:05 AM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	executor-marketing	daa3e1f	Commit Preview URL Branch Preview URL	Oct 27 2026, 05:02 AM

[github-actions]

Cloudflare preview

Torn down — the PR is closed.

[pkg-pr-new]

Open in StackBlitz

@executor-js/cli

npm i https://pkg.pr.new/@executor-js/cli@2402

@executor-js/config

npm i https://pkg.pr.new/@executor-js/config@2402

@executor-js/execution

npm i https://pkg.pr.new/@executor-js/execution@2402

@executor-js/sdk

npm i https://pkg.pr.new/@executor-js/sdk@2402

@executor-js/codemode-core

npm i https://pkg.pr.new/@executor-js/codemode-core@2402

@executor-js/runtime-quickjs

npm i https://pkg.pr.new/@executor-js/runtime-quickjs@2402

@executor-js/plugin-file-secrets

npm i https://pkg.pr.new/@executor-js/plugin-file-secrets@2402

@executor-js/plugin-graphql

npm i https://pkg.pr.new/@executor-js/plugin-graphql@2402

@executor-js/plugin-keychain

npm i https://pkg.pr.new/@executor-js/plugin-keychain@2402

@executor-js/plugin-mcp

npm i https://pkg.pr.new/@executor-js/plugin-mcp@2402

@executor-js/plugin-onepassword

npm i https://pkg.pr.new/@executor-js/plugin-onepassword@2402

@executor-js/plugin-openapi

npm i https://pkg.pr.new/@executor-js/plugin-openapi@2402

executor

npm i https://pkg.pr.new/executor@2402

commit: daa3e1f