AccountForbidden: Verify your identity to change organization settings. ❯ Array.<anonymous> src/account/workos-account-service.ts:154:25 ❯ next ../../node_modules/.bun/effect@4.0.0-beta.59/node_modules/effect/src/internal/effect.ts:1276:25 ❯ Object.~effect/Effect/evaluate ../../node_modules/.bun/effect@4.0.0-beta.59/node_modules/effect/src/internal/effect.ts:1289:23 ❯ FiberImpl.runLoop ../../node_modules/.bun/effect@4.0.0-beta.59/node_modules/effect/src/internal/effect.ts:633:39 ❯ runLoop ../../node_modules/.bun/effect@4.0.0-beta.59/node_modules/effect/src/internal/effect.ts:593:22 ❯ evaluate ../../node_modules/.bun/effect@4.0.0-beta.59/node_modules/effect/src/internal/effect.ts:1030:14 ❯ resume ../../node_modules/.bun/effect@4.0.0-beta.59/node_modules/effect/src/internal/effect.ts:991:15 ⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯ Serialized Error: { _tag: 'AccountForbidden' }

src/auth/mirror-feeders.node.test.ts > account service writes through to the mirror > removeMember tombstones the mirror row after the WorkOS delete: apps/cloud/src/account/workos-account-service.ts#L154

src/auth/mirror-feeders.node.test.ts > account service writes through to the mirror > inviteMember scans an organization the backfill never covered before counting its seats, once: apps/cloud/src/auth/mirror-feeders.node.test.ts#L1361

AssertionError: expected AccountForbidden: Verify your identity to… { _tag: '…' } to match object { message: StringContaining{…} } (1 matching property omitted from actual) - Expected + Received - { - "message": StringContaining "Your plan includes 3 members", + AccountForbidden { + "message": "Verify your identity to change organization settings.", + "_tag": "AccountForbidden", } ❯ Array.<anonymous> src/auth/mirror-feeders.node.test.ts:1361:23 ❯ next ../../node_modules/.bun/effect@4.0.0-beta.59/node_modules/effect/src/internal/effect.ts:1276:25 ❯ Object.~effect/Effect/evaluate ../../node_modules/.bun/effect@4.0.0-beta.59/node_modules/effect/src/internal/core.ts:531:30 ❯ FiberImpl.runLoop ../../node_modules/.bun/effect@4.0.0-beta.59/node_modules/effect/src/internal/effect.ts:633:39 ❯ runLoop ../../node_modules/.bun/effect@4.0.0-beta.59/node_modules/effect/src/internal/effect.ts:593:22 ❯ evaluate ../../node_modules/.bun/effect@4.0.0-beta.59/node_modules/effect/src/internal/effect.ts:1030:14

src/auth/mirror-feeders.node.test.ts > account service writes through to the mirror > inviteMember mirrors the pending membership WorkOS created for the invitee: apps/cloud/src/account/workos-account-service.ts#L154

src/auth/mirror-feeders.node.test.ts > session handlers read membership from the mirror > finishes on a retry after WorkOS already deleted the org: apps/cloud/src/auth/mirror-feeders.node.test.ts#L924

AssertionError: expected 403 to be 500 // Object.is equality - Expected + Received - 500 + 403 ❯ src/auth/mirror-feeders.node.test.ts:924:26

src/auth/mirror-feeders.node.test.ts > session handlers read membership from the mirror > finishes on a retry after the billing cancel failed, and only purges once billing is cancelled: apps/cloud/src/auth/mirror-feeders.node.test.ts#L883

AssertionError: the failed billing cancel is surfaced, not hidden: expected 403 to be 500 // Object.is equality - Expected + Received - 500 + 403 ❯ src/auth/mirror-feeders.node.test.ts:883:79

src/auth/mirror-feeders.node.test.ts > session handlers read membership from the mirror > revokes every member's access the moment deletion starts, even when the local purge fails, and finishes on a retry after WorkOS already deleted the org: apps/cloud/src/auth/mirror-feeders.node.test.ts#L809

AssertionError: the failed purge is surfaced, not hidden: expected 403 to be 500 // Object.is equality - Expected + Received - 500 + 403 ❯ src/auth/mirror-feeders.node.test.ts:809:70

Test

@executor-js/cloud#test: command (/home/runner/_work/executor/executor/apps/cloud) /home/runner/.bun/bin/bun run test exited (1)

E2E (cloud 8of16)

Process completed with exit code 1.

[cloud] cloud/integration-creation-permissions.test.ts > Integration creation · cloud members see admin guidance and admins can add: e2e/cloud/support/session.ts#L84

Error: /api/account/members/invite failed (403): {"_tag":"AccountForbidden","message":"Verify your identity to change organization settings."} ❯ cloud/support/session.ts:84:13

[cloud] cloud/admin-users-console.test.ts > Admin · the Users page shows every member and what each has connected, and refuses a plain member: e2e/cloud/support/session.ts#L84

Error: /api/account/members/invite failed (403): {"_tag":"AccountForbidden","message":"Verify your identity to change organization settings."} ❯ cloud/support/session.ts:84:13

E2E (cloud 16of16)

Process completed with exit code 1.

[cloud] cloud/spec-update-convergence.test.ts > Convergence · a spec refresh reaches a co-worker's own connection on their next read: e2e/cloud/spec-update-convergence.test.ts#L126

Error: /api/account/members/invite failed (403): {"_tag":"AccountForbidden","message":"Verify your identity to change organization settings."} ❯ cloud/spec-update-convergence.test.ts:126:13

[cloud] cloud/org-api-keys-console.test.ts > Admin · organization keys are minted in the console and authenticate the admin API: e2e/cloud/support/session.ts#L84

Error: /api/account/members/invite failed (403): {"_tag":"AccountForbidden","message":"Verify your identity to change organization settings."} ❯ cloud/support/session.ts:84:13

[cloud] cloud/mcp-workspace-write-permissions.test.ts > MCP workspace writes · a member session is denied while an admin session succeeds: e2e/cloud/support/session.ts#L84

Error: /api/account/members/invite failed (403): {"_tag":"AccountForbidden","message":"Verify your identity to change organization settings."} ❯ cloud/support/session.ts:84:13

E2E (cloud 12of16)

Process completed with exit code 1.

[cloud] cloud/admin-users.test.ts > Admin · the owner sees every member of the workspace and what each has connected: e2e/cloud/support/session.ts#L84

Error: /api/account/members/invite failed (403): {"_tag":"AccountForbidden","message":"Verify your identity to change organization settings."} ❯ cloud/support/session.ts:84:13

E2E (cloud 9of16)

Process completed with exit code 1.

[cloud] cloud/workspace-write-permissions.test.ts > Workspace writes · cloud members are denied while Personal writes and admin writes succeed: e2e/cloud/support/session.ts#L84

Error: /api/account/members/invite failed (403): {"_tag":"AccountForbidden","message":"Verify your identity to change organization settings."} ❯ cloud/support/session.ts:84:13

[cloud] cloud/member-invite-seat-limit.test.ts > Billing · a free org fills its 3 member seats, then invites are blocked with a reason: e2e/cloud/member-invite-seat-limit.test.ts#L59

TimeoutError: locator.waitFor: Timeout 30000ms exceeded. Call log: - waiting for getByRole('button', { name: 'Invite member' }) to be visible ❯ cloud/member-invite-seat-limit.test.ts:59:67 ❯ step src/surfaces/browser.ts:276:15 ❯ cloud/member-invite-seat-limit.test.ts:57:7 ❯ src/surfaces/browser.ts:288:13

E2E (cloud 6of16)

Process completed with exit code 1.

[cloud] cloud/mcp-workos-blip-session-survival.test.ts > MCP sessions · a revoked membership fails closed on the next request and condemns the session: e2e/cloud/support/session.ts#L84

Error: /api/account/members/invite failed (403): {"_tag":"AccountForbidden","message":"Verify your identity to change organization settings."} ❯ cloud/support/session.ts:84:13

[cloud] cloud/connect-link-multi-org.test.ts > Connect · an org-scoped connect link resolves a multi-org recipient in the SENDING org: e2e/cloud/support/session.ts#L84

Error: /api/account/members/invite failed (403): {"_tag":"AccountForbidden","message":"Verify your identity to change organization settings."} ❯ cloud/support/session.ts:84:13

E2E (cloud 14of16)

Process completed with exit code 1.

[cloud] cloud/connection-owner-isolation.test.ts > Connections · an org-owned connection is shared with every member of the org: e2e/cloud/connection-owner-isolation.test.ts#L83

Error: /api/account/members/invite failed (403): {"_tag":"AccountForbidden","message":"Verify your identity to change organization settings."} ❯ cloud/connection-owner-isolation.test.ts:83:13

[cloud] cloud/connection-owner-isolation.test.ts > Connections · a user-owned connection is private to its creator, even inside the same org: e2e/cloud/connection-owner-isolation.test.ts#L83

Error: /api/account/members/invite failed (403): {"_tag":"AccountForbidden","message":"Verify your identity to change organization settings."} ❯ cloud/connection-owner-isolation.test.ts:83:13

E2E (cloud 11of16)

Process completed with exit code 1.

[cloud] cloud/org-delete.test.ts > Organizations · an admin deletes the organization from settings: e2e/cloud/org-delete.test.ts#L44

TimeoutError: locator.waitFor: Timeout 30000ms exceeded. Call log: - waiting for getByText('Permanently delete this organization') to be visible ❯ cloud/org-delete.test.ts:44:70 ❯ step src/surfaces/browser.ts:276:15 ❯ cloud/org-delete.test.ts:41:7 ❯ src/surfaces/browser.ts:288:13

E2E (cloud 15of16)

Process completed with exit code 1.

Changed paths

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, dorny/paths-filter@v3. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

Lint

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/cache@v4, actions/checkout@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

Format

Typecheck

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/cache@v4, actions/checkout@v4, actions/setup-node@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

Typecheck

The `catch` callback in `Effect.tryPromise` returns `unknown`, so the Effect error type stays untyped. A specific typed error preserves error-channel information, for example by narrowing the value or wrapping it in `Data.TaggedError`. effect(unknownInEffectCatch)

Typecheck

The `catch` callback in `Effect.try` returns `unknown`, so the Effect error type stays untyped. A specific typed error preserves error-channel information, for example by narrowing the value or wrapping it in `Data.TaggedError`. effect(unknownInEffectCatch)

Typecheck

Cloud evaluated closure

Test

E2E (local 2of2)

E2E (local 1of2)

E2E (selfhost 2of10)

E2E (cloud 4of16)

E2E (selfhost 9of10)

E2E (cloud 3of16)

E2E (selfhost 1of10)

E2E (selfhost 3of10)

E2E (selfhost 4of10)

E2E (selfhost 6of10)

E2E (cloud 2of16)

E2E (selfhost 5of10)

E2E (selfhost 10of10)

E2E (cloud 8of16)

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/cache@v4, actions/checkout@v4, actions/setup-node@v4, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

E2E (cloud 16of16)