[RhysSullivan]

The dashboard redirects a signed-in member of a workspace that has moved to v2. They then had to sign in again on v2, because the wos-session cookie never reaches v2's host.

With V2_SESSION_HANDOFF_SECRET set, the doc gate now sends them to <v2 app origin>/api/v1-handoff?token=<t> instead of /org/<slug>. The token is minted only after the gate has verified the WorkOS session and isMember has confirmed the membership. v2 checks it and starts its own session. v2 offers no WorkOS sign-in.

• Token v1hnd.<payload>.<sig>: base64url JSON {v: 1, aud: "v2-session-handoff", user, organization, slug, iat, exp, jti}, exp 60 s after iat, random jti. The signature is base64url HMAC-SHA256 over v1hnd.<payload>.
• It uses a new dedicated secret, not V2_MCP_FORWARD_SECRET.
• With the secret unset, or with no v2 slug, the redirect stays the plain one used today.

v2 side: UsefulSoftwareCo/executor-next#3358 (tests: #3359). Tests for this PR: #2357.

New secret: V2_SESSION_HANDOFF_SECRET (Worker secret), the same value as v2's V1_SESSION_HANDOFF_SECRET.

One-time production setup (not done here): generate one random secret of at least 32 characters (openssl rand -hex 32). Set it with wrangler secret put V2_SESSION_HANDOFF_SECRET here, and as V1_SESSION_HANDOFF_SECRET on v2. Deploy v2's side first, or both together: until v2 has the route and the secret, a handoff falls back to v2's sign-in page.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	executor-cloud	e982d35	Oct 23 2026, 08:45 PM

[github-actions]

Cloudflare preview

Torn down — the PR is closed.

[pkg-pr-new]

Open in StackBlitz

@executor-js/cli

npm i https://pkg.pr.new/@executor-js/cli@2356

@executor-js/config

npm i https://pkg.pr.new/@executor-js/config@2356

@executor-js/execution

npm i https://pkg.pr.new/@executor-js/execution@2356

@executor-js/sdk

npm i https://pkg.pr.new/@executor-js/sdk@2356

@executor-js/codemode-core

npm i https://pkg.pr.new/@executor-js/codemode-core@2356

@executor-js/runtime-quickjs

npm i https://pkg.pr.new/@executor-js/runtime-quickjs@2356

@executor-js/plugin-file-secrets

npm i https://pkg.pr.new/@executor-js/plugin-file-secrets@2356

@executor-js/plugin-graphql

npm i https://pkg.pr.new/@executor-js/plugin-graphql@2356

@executor-js/plugin-keychain

npm i https://pkg.pr.new/@executor-js/plugin-keychain@2356

@executor-js/plugin-mcp

npm i https://pkg.pr.new/@executor-js/plugin-mcp@2356

@executor-js/plugin-onepassword

npm i https://pkg.pr.new/@executor-js/plugin-onepassword@2356

@executor-js/plugin-openapi

npm i https://pkg.pr.new/@executor-js/plugin-openapi@2356

executor

npm i https://pkg.pr.new/executor@2356

commit: e982d35

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	executor-marketing	e982d35	Commit Preview URL Branch Preview URL	Oct 23 2026, 08:44 PM