Fetch discussion and inline review comments concurrently while retaining dispatch and delivery access checks. Preserve partial results and comment ordering. Add synthetic overlap regression and a rerunnable reader benchmark.
* feat(identity): support configurable Enterprise GitHub coauthor credit
Co-authored-by: galiniliev <5711535+galiniliev@users.noreply.github.com>
* fix(identity): preserve enterprise credit consent across profile merges
Keep enterprise credit preferences through chained profile merges, explain host-selected credit independently of the displayed primary account, and separate worker writes from identity readers.
Co-authored-by: galiniliev <5711535+galiniliev@users.noreply.github.com>
* refactor(identity): name Enterprise GitHub coauthor support consistently
Rename the feature, internal types, worker operations and source files to Enterprise GitHub while retaining the deployed proxy header names. Carry enterprise identities through the resident profile catalog introduced on main, using the same identity projection as direct reads.
Co-authored-by: galiniliev <5711535+galiniliev@users.noreply.github.com>
* feat(control-ui): scope opted-in link readers to pane sessions
(cherry picked from commit d14e9c16b230d425eb9aca5622bef039b8d493df)
* fix(control-ui): preserve keyboard previews in session panes
* feat(github): admit foreground session reads through the selected App
* fix(github): retain Factory actor authority through session reads
* fix(github): keep App credentials scoped to foreground reads
* fix(github): read Enterprise previews through the current session App
* test(github): use an explicit synthetic App profile identifier
* test(github): use a synthetic profile in preview admission proof
* test(control-ui): mount chat panes with their application context
* fix(github): complete Factory admission integration contracts
* fix(identity): preserve issuer scope and editable coauthor consent
Co-authored-by: galiniliev <5711535+galiniliev@users.noreply.github.com>
* fix(github): isolate App keys and narrow admitted repository reads
Co-authored-by: galiniliev <5711535+galiniliev@users.noreply.github.com>
* fix(github): retain preview authority through token cleanup
Move the preview identity contract to its leaf owner and pass the selected repository into admission.
Co-authored-by: galiniliev <5711535+galiniliev@users.noreply.github.com>
* chore(github): regenerate integrated App config documentation
Canonical config docs generator and verification passed in secretless isolation, with focused admission, exec and preview regression suites plus core/plugin typechecks and lint.
Co-authored-by: galiniliev <5711535+galiniliev@users.noreply.github.com>
* fix(github): export the admitted Enterprise account resolver
The session admission caller introduced here needs the helper that main made private while it had only same-module consumers. Restore only the required export; keep metadata resolution private. Build, 72 focused tests, and core types pass.
Co-authored-by: galiniliev <5711535+galiniliev@users.noreply.github.com>
* test(gateway): prepare canonical config for native session controls
The native row in the actor/native fixture uses the storage accessor runtime snapshot, not the mocked config/io getter. Install the fixture config before each case and clear it afterward. The exact pinned Bun regression fails before this setup and all nine tests pass after it; assertions and production behavior are unchanged.
Co-authored-by: galiniliev <5711535+galiniliev@users.noreply.github.com>
---------
Co-authored-by: galiniliev <5711535+galiniliev@users.noreply.github.com>
* perf(github): share public avatars across hover previews
Replace per-item decoration tracking with bounded anonymous avatar reuse across items and credential scopes. Preserve each preview deadline when joining shared work. Metadata and repository authorization remain credential-scoped.
* fix(github): give shared avatars an independent deadline
* test(github): reject canceled avatar requests with AbortError
Expose the existing public GitHub reader through github_read, with Gateway-held identity selection, current caller authority, cancellation and bounded results.
Keep live credential validation at dispatch and delivery, and log slow preview phase durations without URLs or content. Preserve stale background refresh and the existing upstream deadline.
Keep ETags and response bodies with the existing preview cache so refreshes
can reuse unchanged GitHub responses without a second invalidation owner.
Preserve public visibility checks and per-reader authority; separate injected
transports, token rotations, and anonymous fallback representations.
Synthetic WAN replay: unchanged refresh p50 416 to 47 ms and p99 431 to 51 ms;
HTTP count unchanged, 30 of 60 requests now return 304. Cold loads are neutral.
Focused preview, API, detail, and cache tests: 102 passed. Independent review
found no actionable P0-P2 findings. Broad proof belongs to PR CI.
Render named emoji shortcodes in GitHub reader descriptions and comments using the existing Markdown emoji plugin. Preserve literal code, URLs, attributes, unknown shortcodes, and emoticons without changing chat rendering or sanitization.
Reported by Jacob Tomlinson (@jacobtomlinson).
Co-authored-by: jacobtomlinson <1610850+jacobtomlinson@users.noreply.github.com>
Coalesce concurrent hover previews, fetch independent PR metadata together,
and keep cached previews scoped to each reader's current GitHub identity.
Limit publication-options reads to five seconds while preserving ownership
of OAuth token rotations and final authorization checks.
Public repository admission and final visibility checks remain in place.
Update the alias-owner regression for the deadline callback, retaining the
complete RPC response and repeated cross-agent routing assertions.
Each upstream request inside a GitHub hover preview received its own
eight-second deadline, so the metadata -> commits -> co-author avatar chain
could stack several waits before the card appeared. Carry one abort signal
through visibility checks, redirects, the optional-auth fallback, item and
body reads, commits, and avatars. Slow required metadata keeps the existing
retryable unavailable response; slow optional content is omitted while the
card is preserved. Completed cache hits still make zero network requests
and the full detail reader keeps its own timeout.
Microbenchmark with an abort-aware slow transport: slow avatars after a
700 ms commits page 8,704 -> 2,001 ms wall; stalled required item
8,001 -> 2,002 ms; reopened completed previews unchanged at zero requests.
* fix(ui): show actionable GitHub errors across previews and status views
Preserve safe Gateway errors in link readers, hover cards, CI details, and project search, and warn when session PR status is stale. Keep cached details, request scoping, and credential policy intact.
* test(ui): verify visible GitHub failures through browser interactions
Keep public GitHub issues, pull requests, commits, comments, images, and diffs readable beside chat in a resizable, tabbed reader. Preserve external navigation for modified clicks and explicit links.
Move GitHub transport and document mapping into the bundled plugin, and expose the passive reader through the shared plugin contract. Preserve operator plugin controls, managed-preview credential authority, anonymous detail reads, and existing host read-library behavior.
Bind responses to their requested resource, retain rapid reader opens in FIFO order, and cancel stale batches on close or session replacement. Add regression coverage and synchronize heartbeat and attachment tests with their actual completion boundaries.
Co-authored-by: steipete <58493+steipete@users.noreply.github.com>
