Re-register DCR clients when the flow redirect URI changes

[RhysSullivan]

Fixes a reported DCR reuse bug: persisted dynamically registered OAuth clients were reused by (owner, issuer, resource) without comparing the redirect URI they registered with the authorization server. When the callback origin changes (e.g. a sandbox is recreated) while the client row survives in storage, `oauth.start` pairs the old registration with the new callback and strict providers reject the authorize request with 400 `invalid_redirect_uri`.

Changes

• New nullable `oauth_client.origin_redirect_uri` column (core schema, local + cloud drizzle schemas/migrations, local boot-time defensive ALTER). Set only for DCR clients, from the redirect URI sent in the RFC 7591 `redirect_uris` at registration.
• `decideDcrClientReuse` now takes the flow redirect URI (resolved before the reuse decision) and skips candidates whose stored redirect differs — those fall through to a fresh registration.
• The fresh registration dedupes its slug against all existing candidates (the resource-scoped path previously didn't), so the stale client row is never clobbered; connections that reference it keep refreshing through the old client_id, and the existing DCR GC collects it once unreferenced.
• Legacy rows (null stored redirect) are treated as matching, so an upgrade does not re-register every existing client. A null flow redirect also reuses; a fresh registration would fail the missing-redirectUri guard anyway.

Tests

• New end-to-end repro in `oauth-register-dynamic.test.ts`: register with callback A, register again with callback B, assert a fresh `/register` happens under a new slug (old row preserved) and the full authorize → callback → complete flow succeeds against the strict test AS. Before the fix this test fails first on the missing re-registration and, with that assertion removed, at the authorize hop with the reported 400 (`redirect_uri is not registered`).
• Full `@executor-js/sdk` suite green (450 tests), cloud db schema-consistency tests green, local db tests green except three v1→v2 SIGKILL-recovery cases that fail identically on the base commit (pre-existing, unrelated).

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	executor-marketing	d5ded65	Commit Preview URL Branch Preview URL	Jul 20 2026, 09:12 PM

[github-actions]

Cloudflare preview

Torn down — the PR is closed.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	executor-cloud	d5ded65	Jul 20 2026, 09:14 PM

[pkg-pr-new]

Open in StackBlitz

@executor-js/cli

npm i https://pkg.pr.new/@executor-js/cli@1443

@executor-js/config

npm i https://pkg.pr.new/@executor-js/config@1443

@executor-js/execution

npm i https://pkg.pr.new/@executor-js/execution@1443

@executor-js/sdk

npm i https://pkg.pr.new/@executor-js/sdk@1443

@executor-js/codemode-core

npm i https://pkg.pr.new/@executor-js/codemode-core@1443

@executor-js/runtime-quickjs

npm i https://pkg.pr.new/@executor-js/runtime-quickjs@1443

@executor-js/plugin-file-secrets

npm i https://pkg.pr.new/@executor-js/plugin-file-secrets@1443

@executor-js/plugin-graphql

npm i https://pkg.pr.new/@executor-js/plugin-graphql@1443

@executor-js/plugin-keychain

npm i https://pkg.pr.new/@executor-js/plugin-keychain@1443

@executor-js/plugin-mcp

npm i https://pkg.pr.new/@executor-js/plugin-mcp@1443

@executor-js/plugin-onepassword

npm i https://pkg.pr.new/@executor-js/plugin-onepassword@1443

@executor-js/plugin-openapi

npm i https://pkg.pr.new/@executor-js/plugin-openapi@1443

executor

npm i https://pkg.pr.new/executor@1443

commit: d5ded65