chore: sync with upstream 2026-07-28

[NicolasWalter]

Automated upstream sync

Clean merge from ColeMurray/background-agents@main.

This PR was opened automatically by .github/workflows/sync-upstream.yml. Review the commit list and merge when CI is green.

Summary by CodeRabbit

• New Features

  • Browser sign-in now supports control-plane sessions with GitHub and optional Google authentication.
  • Bot-authored pull requests can be reviewed when explicitly allowed, using comment-only reviews.
  • Media viewers now include a prominent close button and improved sizing and scrolling.

• Bug Fixes

  • Invalid repository, prompt, callback, and integration responses are handled more safely.
  • Unsubscribed WebSocket actions are rejected consistently.
  • Users may need to sign in again after upgrading.

• Accessibility

  • Improved label associations across integration and sandbox settings.

[coderabbitai]

📝 Walkthrough

Walkthrough

The PR adds runtime validation for authentication, session, repository, and external API payloads; refactors WebSocket client-context handling; enables configured GitHub bot self-reviews; and updates web UI behavior, accessibility, and memoization.

Changes

Authentication and request validation

Layer / File(s)	Summary
Authentication and prompt validation contracts packages/control-plane/src/auth/user/better-auth.ts, packages/control-plane/src/routes/session-prompt.ts, packages/control-plane/vitest.integration.config.ts, CHANGELOG.md	Google direct ID-token sign-in is disabled, session prompt payloads use shared schemas, and Better Auth invalid-token errors are filtered in integration tests.
Browser authentication rejection coverage packages/control-plane/test/integration/browser-auth.test.ts	Tests cover untrusted origins and direct Google ID-token rejection without creating sessions.

WebSocket client context and presence

Layer / File(s)	Summary
Presence service client contract packages/control-plane/src/session/presence-service.ts, packages/control-plane/src/session/presence-service.test.ts	Presence updates now accept authenticated clients directly and broadcast updated presence state.
Authenticated WebSocket dispatch packages/control-plane/src/session/durable-object.ts	Prompt, history, and presence handlers receive one resolved client context per message.
Pre-subscription command tests packages/control-plane/test/integration/stop-execution.test.ts, packages/control-plane/test/integration/websocket-client.test.ts	Unsubscribed stop and typing commands are verified to close with code 4002.

Runtime payload validation

Layer / File(s)	Summary
Shared repository and session schemas packages/shared/src/types/repository-catalog.ts, packages/shared/src/types/session-api.ts, packages/shared/src/types/index.ts	Repository and callback-context interfaces are represented by exported Zod schemas and inferred types.
Schema validation coverage packages/shared/src/types/*test.ts	Tests cover valid and malformed repository, prompt, callback, and cached configuration payloads.
Slack repository response and cache validation packages/slack-bot/src/classifier/*, packages/slack-bot/src/index.test.ts	Control-plane and KV repository data are parsed before use, with normalized response fixtures.
Linear comment response validation packages/linear-bot/src/utils/linear-client.*	Linear comment mutation responses are validated and malformed JSON or shapes return failure.

GitHub bot self-review handling

Layer / File(s)	Summary
Self-review prompt behavior packages/github-bot/src/prompts.ts, packages/github-bot/src/handlers.ts, packages/github-bot/test/prompts.test.ts	Bot-authored reviews use comment-only events and self-review guidance.
Configured self-review gate packages/github-bot/test/handlers.test.ts	Bot-authored pull requests are processed only when the bot is an allowed trigger user.
Auto-review flow documentation packages/github-bot/README.md	The documented flow reflects configured trigger-user gating and comment-only self-reviews.

Web UI and rendering updates

Layer / File(s)	Summary
Media lightbox and API response handling packages/web/src/components/media-lightbox.tsx, packages/web/src/components/screenshot-media.test.tsx, packages/web/src/app/api/image-builds/route.ts	The media dialog gains an explicit close control and constrained scrolling, and image-build responses are parsed concurrently.
Settings controls and port normalization packages/web/src/components/settings/*	Settings labels are associated with controls, and port normalization is extracted into a reusable helper.
Memoized web context values packages/web/src/components/sidebar-layout.tsx, packages/web/src/components/ui/toggle-group.tsx	Context provider values are memoized before being passed to consumers.

Estimated code review effort: 4 (Complex) | ~45 minutes

Possibly related PRs

• primo-devs/primo-bg-coding-agent#38: Both changes modify Durable Object WebSocket handling.
• primo-devs/primo-bg-coding-agent#70: Both changes modify session prompt request validation.
• primo-devs/primo-bg-coding-agent#85: Both changes are code-adjacent to the Better Auth browser-authentication changes.

Suggested reviewers: colemurray

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 37.50% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately reflects that this is an upstream sync PR and includes the sync date, which matches the overall change set.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Terraform Validation Results

Step	Status
Format	✅
Init	✅
Validate	✅

Pushed by: @NicolasWalter, Action: pull_request

[github-actions]

Terraform Plan Results

Status: ✅ Success

Show Plan

terraform_data.cloudflare_custom_domain_gate: Refreshing state... [id=fa456fac-6c14-16e4-a484-3338d1a3718d]
terraform_data.access_control_gate: Refreshing state... [id=841ab6bc-98a7-018c-1031-ebad4f8b62bc]
random_password.service_auth_secret_github_bot: Refreshing state... [id=none]
null_resource.slack_bot_build[0]: Refreshing state... [id=7727411747602718703]
local_file.web_app_wrangler_production[0]: Refreshing state... [id=daff6090dd93678e6fd6719293e71437dc6f5d6b]
null_resource.control_plane_build: Refreshing state... [id=2042406076740975108]
null_resource.web_app_cloudflare_build[0]: Refreshing state... [id=1984921645726027654]
null_resource.github_bot_build[0]: Refreshing state... [id=7536682210187789111]
random_password.service_auth_secret_web: Refreshing state... [id=none]
random_password.service_auth_secret_slack_bot: Refreshing state... [id=none]
random_password.service_auth_secret_modal: Refreshing state... [id=none]
null_resource.linear_bot_build[0]: Refreshing state... [id=937584459833419549]
random_password.image_callback_token_pepper: Refreshing state... [id=none]
module.slack_kv[0].cloudflare_workers_kv_namespace.this: Refreshing state... [id=729b357dbb5e4c9d99ec9212cc45766e]
cloudflare_queue.slack_completion_delivery_dlq[0]: Refreshing state... [id=06ce03d2663f4aea937b0c0c1c379c17]
module.github_kv[0].cloudflare_workers_kv_namespace.this: Refreshing state... [id=87dbfaa1d9ce4a37a42e04c57c434a72]
cloudflare_r2_bucket.media: Refreshing state... [id=open-inspect-media-primo]
module.session_index_kv.cloudflare_workers_kv_namespace.this: Refreshing state... [id=7f18644fbed34121bbe3a196f373ea93]
cloudflare_d1_database.main: Refreshing state... [id=dba95b03-ace9-47a8-81e9-6e39d8d694c5]
module.linear_kv[0].cloudflare_workers_kv_namespace.this: Refreshing state... [id=d003f1ad81384910a1f48a0a33f18c09]
data.external.modal_source_hash[0]: Reading...
cloudflare_queue.slack_completion_delivery[0]: Refreshing state... [id=56ef0f3e13bd46a3a39f30c79ec547fa]
random_password.service_auth_secret_linear_bot: Refreshing state... [id=none]
module.modal_app[0].null_resource.modal_secrets[0]: Refreshing state... [id=2786381799123975256]
data.external.modal_source_hash[0]: Read complete after 0s [id=-]
module.modal_app[0].null_resource.modal_deploy: Refreshing state... [id=7095165949869290970]

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
-/+ destroy and then create replacement

Terraform planned the following actions, but then encountered a problem:

  # local_file.web_app_wrangler_production[0] will be created
  + resource "local_file" "web_app_wrangler_production" {
      + content              = (sensitive value)
      + content_base64sha256 = (known after apply)
      + content_base64sha512 = (known after apply)
      + content_md5          = (known after apply)
      + content_sha1         = (known after apply)
      + content_sha256       = (known after apply)
      + content_sha512       = (known after apply)
      + directory_permission = "0777"
      + file_permission      = "0777"
      + filename             = "../../..//packages/web/wrangler.production.toml"
      + id                   = (known after apply)
    }

  # null_resource.control_plane_build must be replaced
-/+ resource "null_resource" "control_plane_build" {
      ~ id       = "2042406076740975108" -> (known after apply)
      ~ triggers = { # forces replacement
          ~ "always_run" = "2026-07-27T06:28:07Z" -> (known after apply)
        }
    }

  # null_resource.github_bot_build[0] must be replaced
-/+ resource "null_resource" "github_bot_build" {
      ~ id       = "7536682210187789111" -> (known after apply)
      ~ triggers = { # forces replacement
          ~ "always_run" = "2026-07-27T06:28:07Z" -> (known after apply)
        }
    }

  # null_resource.linear_bot_build[0] must be replaced
-/+ resource "null_resource" "linear_bot_build" {
      ~ id       = "937584459833419549" -> (known after apply)
      ~ triggers = { # forces replacement
          ~ "always_run" = "2026-07-27T06:28:07Z" -> (known after apply)
        }
    }

  # null_resource.slack_bot_build[0] must be replaced
-/+ resource "null_resource" "slack_bot_build" {
      ~ id       = "7727411747602718703" -> (known after apply)
      ~ triggers = { # forces replacement
          ~ "always_run" = "2026-07-27T06:28:07Z" -> (known after apply)
        }
    }

  # null_resource.web_app_cloudflare_build[0] must be replaced
-/+ resource "null_resource" "web_app_cloudflare_build" {
      ~ id       = "1984921645726027654" -> (known after apply)
      ~ triggers = { # forces replacement
          ~ "always_run" = "2026-07-27T06:28:07Z" -> (known after apply)
        }
    }

Plan: 6 to add, 0 to change, 5 to destroy.

Error: failed to make http request

  with cloudflare_d1_database.main,
  on d1.tf line 5, in resource "cloudflare_d1_database" "main":
   5: resource "cloudflare_d1_database" "main" {

GET
"https://api.cloudflare.com/client/v4/accounts/bf66240843ed90d19b82e4b90916d29a/d1/database/dba95b03-ace9-47a8-81e9-6e39d8d694c5":
401 Unauthorized
{"result":null,"success":false,"errors":[{"code":10000,"message":"Authentication
error"}],"messages":[]}

Error: failed to make http request

  with cloudflare_r2_bucket.media,
  on r2.tf line 5, in resource "cloudflare_r2_bucket" "media":
   5: resource "cloudflare_r2_bucket" "media" {

GET
"https://api.cloudflare.com/client/v4/accounts/bf66240843ed90d19b82e4b90916d29a/r2/buckets/open-inspect-media-primo":
403 Forbidden
{"success":false,"errors":[{"code":10000,"message":"Authentication
error"}],"messages":[],"result":null}


Error: failed to make http request

  with cloudflare_queue.slack_completion_delivery[0],
  on workers-slack.tf line 5, in resource "cloudflare_queue" "slack_completion_delivery":
   5: resource "cloudflare_queue" "slack_completion_delivery" {

GET
"https://api.cloudflare.com/client/v4/accounts/bf66240843ed90d19b82e4b90916d29a/queues/56ef0f3e13bd46a3a39f30c79ec547fa":
403 Forbidden
{"success":false,"errors":[{"code":10000,"message":"Authentication
error"}],"messages":[],"result":null}


Error: failed to make http request

  with cloudflare_queue.slack_completion_delivery_dlq[0],
  on workers-slack.tf line 12, in resource "cloudflare_queue" "slack_completion_delivery_dlq":
  12: resource "cloudflare_queue" "slack_completion_delivery_dlq" {

GET
"https://api.cloudflare.com/client/v4/accounts/bf66240843ed90d19b82e4b90916d29a/queues/06ce03d2663f4aea937b0c0c1c379c17":
403 Forbidden
{"success":false,"errors":[{"code":10000,"message":"Authentication
error"}],"messages":[],"result":null}


Error: failed to make http request

  with module.linear_kv[0].cloudflare_workers_kv_namespace.this,
  on ../../modules/cloudflare-kv/main.tf line 4, in resource "cloudflare_workers_kv_namespace" "this":
   4: resource "cloudflare_workers_kv_namespace" "this" {

GET
"https://api.cloudflare.com/client/v4/accounts/bf66240843ed90d19b82e4b90916d29a/storage/kv/namespaces/d003f1ad81384910a1f48a0a33f18c09":
401 Unauthorized
{"result":null,"success":false,"errors":[{"code":10000,"message":"Authentication
error"}],"messages":[]}

Error: failed to make http request

  with module.github_kv[0].cloudflare_workers_kv_namespace.this,
  on ../../modules/cloudflare-kv/main.tf line 4, in resource "cloudflare_workers_kv_namespace" "this":
   4: resource "cloudflare_workers_kv_namespace" "this" {

GET
"https://api.cloudflare.com/client/v4/accounts/bf66240843ed90d19b82e4b90916d29a/storage/kv/namespaces/87dbfaa1d9ce4a37a42e04c57c434a72":
401 Unauthorized
{"result":null,"success":false,"errors":[{"code":10000,"message":"Authentication
error"}],"messages":[]}

Error: failed to make http request

  with module.slack_kv[0].cloudflare_workers_kv_namespace.this,
  on ../../modules/cloudflare-kv/main.tf line 4, in resource "cloudflare_workers_kv_namespace" "this":
   4: resource "cloudflare_workers_kv_namespace" "this" {

GET
"https://api.cloudflare.com/client/v4/accounts/bf66240843ed90d19b82e4b90916d29a/storage/kv/namespaces/729b357dbb5e4c9d99ec9212cc45766e":
401 Unauthorized
{"result":null,"success":false,"errors":[{"code":10000,"message":"Authentication
error"}],"messages":[]}

Error: failed to make http request

  with module.session_index_kv.cloudflare_workers_kv_namespace.this,
  on ../../modules/cloudflare-kv/main.tf line 4, in resource "cloudflare_workers_kv_namespace" "this":
   4: resource "cloudflare_workers_kv_namespace" "this" {

GET
"https://api.cloudflare.com/client/v4/accounts/bf66240843ed90d19b82e4b90916d29a/storage/kv/namespaces/7f18644fbed34121bbe3a196f373ea93":
401 Unauthorized
{"result":null,"success":false,"errors":[{"code":10000,"message":"Authentication
error"}],"messages":[]}
::error::Terraform exited with code 1.

Pushed by: @NicolasWalter

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (2)

packages/github-bot/src/prompts.ts (1)

48-62: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Move the parameter default to a named constant.

Use a named default constant for isSelfReview rather than an inline parameter default. As per coding guidelines, “Define each default value exactly once in a named constant and import or reuse that constant everywhere.”

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/github-bot/src/prompts.ts` around lines 48 - 62, Move the inline
default for isSelfReview in the surrounding prompt-building function to a named
constant, then reuse that constant when destructuring params. Ensure the default
value is defined only once and remains false.

Source: Coding guidelines

packages/shared/src/types/session-api.ts (1)

18-26: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick win

Slack/automation callback fields allow empty strings; Linear's don't.

slackCallbackContextSchema (channel, threadTs, repoFullName, model) and automationCallbackContextSchema (automationId, runId, automationName) use plain z.string(), while linearCallbackContextSchema uses nonEmptyStringSchema for its identifiers. Since callbackContextSchema is used to validate the externally-supplied callbackContext on prompt requests, an empty channel/repoFullName/automationId would pass validation here and only fail later against the Slack/automation API.

🔧 Suggested fix for tightening identifier fields

 export const slackCallbackContextSchema = z.object({
   source: z.literal("slack"),
-  channel: z.string(),
-  threadTs: z.string(),
-  repoFullName: z.string(),
-  model: z.string(),
+  channel: nonEmptyStringSchema,
+  threadTs: nonEmptyStringSchema,
+  repoFullName: nonEmptyStringSchema,
+  model: nonEmptyStringSchema,
   reasoningEffort: z.string().optional(),
   reactionMessageTs: z.string().optional(),
 });

Also applies to: 69-74

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/shared/src/types/session-api.ts` around lines 18 - 26, Update
slackCallbackContextSchema and automationCallbackContextSchema to use the
existing nonEmptyStringSchema for all required identifier fields, including
channel, threadTs, repoFullName, model, automationId, runId, and automationName,
so externally supplied callback contexts reject empty strings consistently with
linearCallbackContextSchema.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/github-bot/src/prompts.ts`:
- Around line 63-66: Update the reviewEvent value used by the command example so
it always contains one valid event rather than the literal pipe-separated list.
Preserve the self-review behavior while selecting a single valid placeholder or
concrete event for the non-self-review path, and keep the related
reviewEventGuidance in sync.

---

Nitpick comments:
In `@packages/github-bot/src/prompts.ts`:
- Around line 48-62: Move the inline default for isSelfReview in the surrounding
prompt-building function to a named constant, then reuse that constant when
destructuring params. Ensure the default value is defined only once and remains
false.

In `@packages/shared/src/types/session-api.ts`:
- Around line 18-26: Update slackCallbackContextSchema and
automationCallbackContextSchema to use the existing nonEmptyStringSchema for all
required identifier fields, including channel, threadTs, repoFullName, model,
automationId, runId, and automationName, so externally supplied callback
contexts reject empty strings consistently with linearCallbackContextSchema.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: e7dcb3eb-bfde-42a3-97cb-c842e922e3f5

📥 Commits

Reviewing files that changed from the base of the PR and between 18a0b55 and 24993fc.

📒 Files selected for processing (33)

• CHANGELOG.md
• packages/control-plane/src/auth/user/better-auth.ts
• packages/control-plane/src/routes/session-prompt.ts
• packages/control-plane/src/session/durable-object.ts
• packages/control-plane/src/session/presence-service.test.ts
• packages/control-plane/src/session/presence-service.ts
• packages/control-plane/test/integration/browser-auth.test.ts
• packages/control-plane/test/integration/stop-execution.test.ts
• packages/control-plane/test/integration/websocket-client.test.ts
• packages/control-plane/vitest.integration.config.ts
• packages/github-bot/README.md
• packages/github-bot/src/handlers.ts
• packages/github-bot/src/prompts.ts
• packages/github-bot/test/handlers.test.ts
• packages/github-bot/test/prompts.test.ts
• packages/linear-bot/src/utils/linear-client.test.ts
• packages/linear-bot/src/utils/linear-client.ts
• packages/shared/src/types/boundary-schemas.test.ts
• packages/shared/src/types/index.ts
• packages/shared/src/types/repository-catalog.test.ts
• packages/shared/src/types/repository-catalog.ts
• packages/shared/src/types/session-api.ts
• packages/slack-bot/src/classifier/repos.test.ts
• packages/slack-bot/src/classifier/repos.ts
• packages/slack-bot/src/index.test.ts
• packages/web/src/app/api/image-builds/route.ts
• packages/web/src/components/media-lightbox.tsx
• packages/web/src/components/screenshot-media.test.tsx
• packages/web/src/components/settings/integrations/github-integration-settings.tsx
• packages/web/src/components/settings/integrations/linear-integration-settings.tsx
• packages/web/src/components/settings/sandbox-settings.tsx
• packages/web/src/components/sidebar-layout.tsx
• packages/web/src/components/ui/toggle-group.tsx

[coderabbitai]

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
curl --fail --silent --show-error \
  https://docs.github.com/en/rest/pulls/reviews \
  | rg -n 'APPROVE|REQUEST_CHANGES|COMMENT'

Repository: primo-devs/primo-bg-coding-agent

Length of output: 50389

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Inspect the relevant file around the changed lines and nearby prompt assembly.
FILE="packages/github-bot/src/prompts.ts"
wc -l "$FILE"
sed -n '1,220p' "$FILE"

# Find other uses of the reviewEvent / reviewEventGuidance fields.
rg -n "reviewEvent|reviewEventGuidance|COMMENT\|APPROVE\|REQUEST_CHANGES|isSelfReview" packages/github-bot/src -S

Repository: primo-devs/primo-bg-coding-agent

Length of output: 7256

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Inspect the prompt consumer and surrounding review-submission flow.
sed -n '320,390p' packages/github-bot/src/handlers.ts
sed -n '1,140p' packages/github-bot/src/prompts.ts

Repository: primo-devs/primo-bg-coding-agent

Length of output: 6414

---

Use a single review event in the command example. event only accepts APPROVE, REQUEST_CHANGES, or COMMENT; COMMENT|APPROVE|REQUEST_CHANGES is invalid if copied literally. Replace it with a single placeholder or one concrete event before showing the command.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/github-bot/src/prompts.ts` around lines 63 - 66, Update the
reviewEvent value used by the command example so it always contains one valid
event rather than the literal pipe-separated list. Preserve the self-review
behavior while selecting a single valid placeholder or concrete event for the
non-self-review path, and keep the related reviewEventGuidance in sync.