Integration: dev 0.15.3 PR stack#6
Open
pascalandr wants to merge 128 commits into
Open
Conversation
Add the LLM provider credential kind/opencode auth storage contract, migration, and passive credential redaction/flags needed by follow-up provider credential and worker sync PRs.
Add Den API create/update/read/import handling for API-key versus OpenCode OAuth provider credentials on top of the credential contract base.
Include organization context variables in worker route typing so managed provider sync typechecks without changing runtime behavior.
Add Den API OpenAI OAuth device-flow routes/tests and Den Web provider UI for OAuth-backed provider credentials on top of the credential handling stack.
Add the LLM provider credential kind/opencode auth storage contract, migration, and passive credential redaction/flags needed by follow-up provider credential and worker sync PRs.
Add Den API create/update/read/import handling for API-key versus OpenCode OAuth provider credentials on top of the credential contract base.
Allow desktop cloud-provider import to consume OpenCode OAuth-backed organization providers from the Den credential import endpoint.
Translate Den catalog model metadata through an explicit OpenCode-compatible allowlist before writing managed provider runtime config. Preserve boolean experimental values while dropping incompatible catalog metadata covered by focused regression tests.
Filter Den-managed provider-list responses to configured model IDs so OAuth providers keep native auth IDs without exposing the full OpenCode catalog. Adds focused regression coverage for OpenAI OAuth and NVIDIA API-key managed providers.
Apply only product code from the mixed integration commit for the managed provider sync PR branch, excluding workflow and evidence artifacts.
Add Den API OpenAI OAuth device-flow routes/tests and Den Web provider UI for OAuth-backed provider credentials on top of the credential handling stack.
Route Den-backed remote workspaces through the managed-provider sync endpoint for background sync and manual Cloud Provider import. Add focused client coverage for successful and sanitized failure paths.
Apply the cloud managed model allowlist to session and compact model picker options, refresh provider-list queries after managed-provider sync, and add focused regression coverage for stale OpenAI catalog filtering.
Merge upstream/dev into pr/credential-contract-managed-sync and resolve managed-provider sync route plus Den DB migration numbering conflicts.
Merge upstream/dev into pr/managed-desktop-bootstrap and resolve managed desktop bootstrap conflicts.
Reject removed members during LLM provider access assignment, hide stale removed-member access rows, and add the missing Drizzle snapshot metadata for the OAuth provider migration.
Use runtime provider IDs for OAuth/OpenWork managed providers, require applied-provider IDs for partial remote sync results, and constrain default model picker entries to managed allowlists.
# Conflicts: # apps/server/src/server.ts
# Conflicts: # ee/apps/den-api/src/routes/org/llm-providers.ts # ee/apps/den-api/test/llm-providers-oauth.test.ts
# Conflicts: # apps/app/src/react-app/shell/settings-route.tsx
Add Electron browser native tool coverage that proves list, select, create, and close page tools use the tab-management callbacks wired by the bootstrap remediation.
Update managed-provider sync proxy assertions to use the normal bearer token path so the tests remain valid after host tokens are limited to host-only routes.
Cast the MCP server test handle before invoking registered tools so the Electron typecheck covers the page callback regression without touching private fields directly.
Annotate invitation member lookup helpers as nullable so the placeholder-claim flow typechecks while preserving duplicate-member prevention.
Move desktop workspace discovery to a tested helper that sends only bearer auth to /workspaces, keep host tokens for host-only routes, and add dedicated desktop fetch timeout regression coverage.
Add mocked Den API invitation lifecycle tests for preview by invite token, accept by invite token, placeholder-member claim without duplicate active members, and retained team association.
Run invitation placeholder claims through post member-change hooks, keep repeated removals idempotent with active-member guards, and fix nullable placeholder member typing surfaced by Den API typecheck.
Move stale managed-provider auth deletion after config commit so rollback never restores config that references already-deleted stale auth, with regression coverage for deletion failure.
Use invitation fallback data for pending LLM provider member access rows and keep invited placeholders visible in access listings.
Keep stale managed provider IDs in metadata until auth deletion succeeds so failed stale cleanup remains retryable without restoring config that references deleted auth.
Allow Den web to parse pending invited LLM provider access rows with nullable user IDs and cover the serialized API parser contract.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
Integration branch for the
dev-0.15.3PR stack, rebuilt fromdevusing the PR branches as the source of truth. This PR is intended for full-stack automated review, including Greptile, before moving fixes back into the source PR branches.Included PR Sources
pr/den-api-windows-buildpr/managed-desktop-bootstrappr/static-provisioner-backendpr/static-worker-attach-securitypr/entra-sso-auto-joinpr/docker-onprem-runbookpr/credential-contract-managed-syncpr/den-oauth-provider-flowpr/desktop-import-oauth-den-providersScope
Verification
Passed locally:
git diff --checkpnpm --filter @openwork-ee/den-db buildpnpm --dir ee/apps/den-api exec tsc -p tsconfig.json --noEmitpnpm --filter @openwork/app typecheckpnpm --filter openwork-server typecheckpnpm --filter openwork-server test src/workspace-activate.e2e.test.ts src/managed-provider-sync.e2e.test.tspnpm --dir ee/apps/den-api exec bun test test/provisioner-static.test.tspnpm --dir ee/apps/den-api exec bun test test/managed-provider-sync.test.ts test/llm-provider-credentials.test.ts test/llm-providers-oauth.test.ts test/entra-sso.test.tsNot run:
Review Notes
This is an integration review PR, not the source of truth for follow-up fixes. Any issues found here should be fixed in the relevant source PR branch first, then re-integrated into
dev-0.15.3.