chore: sync with upstream 2026-08-29 (conflicts)

.claude/skills/onboarding/SKILL.md

@@ -188,9 +188,9 @@ unless the same verified email is also a linked GitHub identity.
 Guide user:
 
 1. https://api.slack.com/apps → "Create New App" → "From scratch"
-2. OAuth & Permissions → Add scopes: `app_mentions:read`, `chat:write`, `channels:history`,
-   `channels:read`, `groups:history`, `groups:read`, `im:history`, `im:read`, `files:read`,
-   `files:write`, `reactions:write`
+2. OAuth & Permissions → Add scopes: `assistant:write`, `app_mentions:read`, `chat:write`,
+   `channels:history`, `channels:read`, `groups:history`, `groups:read`, `im:history`, `files:read`,
+   `files:write`, `reactions:write`, `users:read`, `users:read.email`
 3. Install to Workspace, note **Bot Token** (`xoxb-...`)
 4. Basic Information → note **Signing Secret**
 5. **App Home and Event Subscriptions configured AFTER deployment** (worker must be running for URL
@@ -264,27 +264,41 @@ terraform apply
 
 After Terraform deployment, guide user:
 
+The user can apply `packages/slack-bot/slack-app-manifest.yaml` instead of configuring the following
+settings individually. Replace `SLACK_EVENTS_URL` with the worker's `/events` URL and
+`SLACK_INTERACTIONS_URL` with its `/interactions` URL first. The template includes
+`message.channels` and `message.groups` for channel-message automations; remove them if the
+deployment will not use that feature.
+
+OAuth scopes, app installation, the bot token, and the signing secret must be configured before
+`terraform apply`. Apply the URL-dependent manifest after deployment.
+
+### Enable Agents
+
+1. Agents → Enable the agent feature
+2. Set the agent description to `AI coding assistant for your codebase`
+
 ### Enable App Home
 
 1. App Home → Show Tabs → Enable **"Home Tab"**
-2. Save Changes
+2. Enable **"Messages Tab"** and allow users to send messages
+3. Save Changes
 
-The App Home provides a settings interface where users can configure their preferred Claude model.
+The App Home provides settings for users' preferred model, reasoning effort, and branch. The
+writable Messages tab lets users start direct-message sessions.
 
 ### Configure Event Subscriptions
 
-1. Event Subscriptions → Enable → Request URL:
-   `https://open-inspect-slack-bot-{deployment_name}.{subdomain}.workers.dev/events`
+1. Event Subscriptions → Enable → Request URL from `terraform output -raw slack_bot_events_url`
 2. Wait for "Verified" checkmark
-3. Subscribe to bot events: `app_home_opened`, `app_mention`, `message.im`
+3. Subscribe to bot events: `app_home_opened`, `app_mention`, `message.channels`, `message.groups`,
+   `message.im`
 
 ### Configure Interactivity
 
-4. Interactivity → Enable → Request URL:
-   `https://open-inspect-slack-bot-{deployment_name}.{subdomain}.workers.dev/interactions`
-5. Select Menus → Options Load URL:
-   `https://open-inspect-slack-bot-{deployment_name}.{subdomain}.workers.dev/interactions` Required
-   for searchable Slack repository pickers that use external data sources.
+4. Interactivity → Enable → Request URL from `terraform output -raw slack_bot_interactions_url`
+5. Select Menus → Use the same URL for **Options Load URL**. This is required for searchable Slack
+   repository pickers that use external data sources.
 
 ### Invite Bot to Channels
 

.github/workflows/ci-python.yml

@@ -0,0 +1,220 @@
+name: CI (Python)
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - ".github/workflows/ci-python.yml"
+      - "packages/control-plane/src/image-builds/timeouts.ts"
+      - "packages/daytona-infra/**"
+      - "packages/e2b-infra/**"
+      - "packages/modal-infra/**"
+      - "packages/sandbox-runtime/**"
+      - "packages/shared/src/types/integrations.ts"
+      - "ruff.toml"
+      - "terraform/environments/production/modal.tf"
+      - "terraform/modules/modal-app/scripts/deploy.sh"
+      - "!**/*.md"
+  pull_request:
+    branches: [main]
+    paths:
+      - ".github/workflows/ci-python.yml"
+      - "packages/control-plane/src/image-builds/timeouts.ts"
+      - "packages/daytona-infra/**"
+      - "packages/e2b-infra/**"
+      - "packages/modal-infra/**"
+      - "packages/sandbox-runtime/**"
+      - "packages/shared/src/types/integrations.ts"
+      - "ruff.toml"
+      - "terraform/environments/production/modal.tf"
+      - "terraform/modules/modal-app/scripts/deploy.sh"
+      - "!**/*.md"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint-python-sandbox-runtime:
+    name: Lint & Format (Python - sandbox-runtime)
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    defaults:
+      run:
+        working-directory: packages/sandbox-runtime
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - name: Setup Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+          cache: "pip"
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e ".[dev]"
+
+      - name: Run Ruff linter
+        run: ruff check src/ tests/
+
+      - name: Run Ruff formatter check
+        run: ruff format --check src/ tests/
+
+  lint-python:
+    name: Lint & Format (Python - provider infra)
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - name: Setup Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+          cache: "pip"
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e packages/sandbox-runtime
+          pip install -e "packages/modal-infra[dev]"
+
+      - name: Run Ruff linter
+        run: ruff check packages/modal-infra/ packages/e2b-infra/ packages/daytona-infra/
+
+      - name: Run Ruff formatter check
+        run: ruff format --check packages/modal-infra/ packages/e2b-infra/ packages/daytona-infra/
+
+  typecheck-python:
+    name: TypeCheck (Python)
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    defaults:
+      run:
+        working-directory: packages/modal-infra
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - name: Setup Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+          cache: "pip"
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e ../sandbox-runtime
+          pip install -e ".[dev]"
+
+      - name: Run MyPy
+        run: mypy src/
+        continue-on-error: true # Allow failures initially as types are added
+
+  typecheck-python-sandbox-runtime:
+    name: TypeCheck (Python - sandbox-runtime)
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    needs: [lint-python-sandbox-runtime]
+    defaults:
+      run:
+        working-directory: packages/sandbox-runtime
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - name: Setup Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+          cache: "pip"
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e ".[dev]"
+
+      - name: Run MyPy
+        run: mypy src/
+        continue-on-error: true # Allow failures initially as types are added
+
+  test-python-sandbox-runtime:
+    name: Test (Python - sandbox-runtime)
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    needs: [lint-python-sandbox-runtime]
+    defaults:
+      run:
+        working-directory: packages/sandbox-runtime
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - name: Setup Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+          cache: "pip"
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: "22"
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e ".[dev]"
+
+      - name: Run tests
+        run: pytest tests/ -v
+
+      - name: Run Node.js tests
+        run: node --test tests/*.test.mjs
+
+  test-python:
+    name: Test (Python - modal-infra)
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    needs: [lint-python]
+    defaults:
+      run:
+        working-directory: packages/modal-infra
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - name: Setup Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+          cache: "pip"
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e ../sandbox-runtime
+          pip install -e ".[dev]"
+
+      - name: Run tests
+        run: pytest tests/ -v