Merge origin/dev: resolve conflicts in SSO, model-selector, execution, ISSUES.md

Keep HMAC-signed SSO state (HEAD) over insecure dev version.
Accept dev versions for unrelated model-selector/execution changes.
Merge both sides of ISSUES.md work log entries.

Author: kaizen403

.env.dev

@@ -0,0 +1,31 @@
+# Database Configuration — Development branch
+DATABASE_URL=postgresql://neondb_owner:npg_FVijz3A5Srpl@ep-lively-tooth-aot5ofmy-pooler.c-2.ap-southeast-1.aws.neon.tech/neondb?sslmode=require&channel_binding=require
+# GitHub OAuth App
+GITHUB_CLIENT_ID=Ov23liy8A1JNx3VSY0la
+GITHUB_CLIENT_SECRET=2331aaed22c6ad6260d0ebde3f60ad6ac4af29fe
+GITHUB_REDIRECT_URI=http://localhost:3001/api/auth/github/callback
+# Optional: personal access token for higher rate limits on public repo fetches
+GITHUB_TOKEN=
+# JWT signing secret. REQUIRED in production.
+JWT_SECRET=openlinear-dev-secret-change-in-production
+# Token encryption key (AES-256-GCM, 32 bytes base64). REQUIRED — encrypts GitHub tokens at rest.
+TOKEN_ENCRYPTION_KEY=rl51+Xu6VEpVErimC3dj6TZ4h90HX3553fsGQKaEMBs=
+# Frontend URL (web flow OAuth redirect; ignored for ?client=desktop callbacks)
+FRONTEND_URL=http://localhost:3000
+# Cloud API base URL baked into the desktop UI build. In dev we point at the local API
+# so the Tauri "Sign in with GitHub" button opens the local OAuth endpoint instead of
+# the (currently unhosted) https://openlinear.tech/api/* endpoints.
+NEXT_PUBLIC_CLOUD_API_URL=http://localhost:3001
+# CORS origin. Comma-separated list. Tauri origins (tauri://localhost, https://tauri.localhost) are always added implicitly.
+CORS_ORIGIN=http://localhost:3000
+# API server port
+API_PORT=3001
+# OAuth interceptor port used by the local sidecar
+OAUTH_INTERCEPTOR_PORT=1455
+# Optional: where the sidecar clones repos into. Defaults to <tmp>/openlinear-repos.
+REPOS_DIR=
+# Brainstorm AI Configuration
+BRAINSTORM_API_KEY=
+BRAINSTORM_MODEL=gpt-4o-mini
+BRAINSTORM_PROVIDER=openai
+BRAINSTORM_BASE_URL=

.env.prod

@@ -0,0 +1,48 @@
+.env.production — Production (61 lines)
+# Production Environment
+# Copy this file to `.env` on your production server or use your deployment platform's secret management.
+# Production Database
+# Branch: br-patient-art-aocs682x (production, primary)
+# Endpoint: ep-wild-feather-aolgvb3d-pooler
+DATABASE_URL=postgresql://neondb_owner:npg_FVijz3A5Srpl@ep-wild-feather-aolgvb3d-pooler.c-2.ap-southeast-1.aws.neon.tech/neondb?sslmode=require&channel_binding=require
+# GitHub OAuth App (same app handles both web and desktop via ?client=desktop)
+# Homepage URL: https://openlinear.tech
+# Callback URL: https://openlinear.tech/api/auth/github/callback (web + desktop deep-link)
+GITHUB_CLIENT_ID=Ov23limWISAAOhkqDFXX
+GITHUB_CLIENT_SECRET=6f41d6806ac0c79301f5a47c9c61279a50dbaee1
+GITHUB_REDIRECT_URI=https://openlinear.tech/api/auth/github/callback
+# Optional: GitHub PAT for higher rate limits on public repo fetches
+GITHUB_TOKEN=
+# JWT signing secret. REQUIRED — use a strong random string (e.g. `openssl rand -base64 32`).
+JWT_SECRET=
+# Token encryption key (AES-256-GCM, 32 bytes base64). REQUIRED — encrypts GitHub tokens at rest.
+# Generate with: openssl rand -base64 32
+TOKEN_ENCRYPTION_KEY=
+# Frontend URL
+FRONTEND_URL=https://openlinear.tech
+# Cloud API base URL baked into the desktop UI build
+NEXT_PUBLIC_CLOUD_API_URL=https://openlinear.tech
+# CORS origin. Tauri origins (tauri://localhost, https://tauri.localhost) are always added implicitly.
+CORS_ORIGIN=https://openlinear.tech
+# API server port
+API_PORT=3001
+# OAuth interceptor port used by the local sidecar
+OAUTH_INTERCEPTOR_PORT=1455
+# Optional: where the sidecar clones repos into
+REPOS_DIR=
+# Brainstorm AI Configuration
+BRAINSTORM_API_KEY=
+BRAINSTORM_MODEL=gpt-4o-mini
+BRAINSTORM_PROVIDER=openai
+BRAINSTORM_BASE_URL=
+# Home Chat LLM Configuration
+CHAT_LLM_BASE_URL=https://api.fireworks.ai/inference/v1
+CHAT_LLM_API_KEY=
+CHAT_LLM_MODEL=accounts/fireworks/models/kimi-k2p6
+CHAT_LLM_TIMEOUT_MS=60000
+CHAT_RATE_LIMIT_PER_MIN=60
+# ElevenLabs Speech-to-Text
+ELEVENLABS_API_KEY=
+ELEVENLABS_STT_MODEL_ID=scribe_v2
+ELEVENLABS_STT_TIMEOUT_MS=30000
+ELEVENLABS_STT_MAX_UPLOAD_MB=25

ISSUES.md

@@ -5,6 +5,66 @@
 
 ---
 
+## [2026-06-02] — Fix SSO CSRF, session security, and upload auth (Greptile review)
+
+**Status:** Done
+**Agent:** Sisyphus (OpenCode)
+
+### What was done
+- Implemented all 8 findings from Greptile review c29aea46
+- **P0:** SSO state now HMAC-signed (prevents CSRF), OIDC `expectedState` properly passed instead of `undefined` cast
+- **P1:** SSO login creates Session records (tokens now revocable), revoke-others derives session ID from JWT hash, 2FA tempToken delivered via URL fragment, /uploads requires auth
+- **P2:** TOTP validate endpoint rate-limited (10 req/min/IP)
+
+### Files changed
+- `apps/api/src/routes/sso.ts` — HMAC sign/verify for SSO state, createSession on login
+- `apps/api/src/services/sso.ts` — expectedState parameter to authorizationCodeGrant
+- `apps/api/src/routes/sessions.ts` — derive currentSessionId from JWT hash
+- `apps/api/src/routes/auth.ts` — tempToken via URL fragment
+- `apps/api/src/app.ts` — requireAuth on /uploads static serving
+- `apps/api/src/routes/totp.ts` — express-rate-limit on /validate
+
+---
+## [2026-05-31] — Fix critical migration drift + docs accuracy + sidecar logging
+
+**Status:** Done
+**Agent:** Kiro
+
+### What was done
+- **CRITICAL — Migration drift fixed.** The committed Prisma migrations were badly out of sync with `schema.prisma`: a fresh `db:migrate deploy` produced only 21 tables / 8 `users` columns, while `db:push` (and prod, patched out-of-band) had 30+ tables / 12 `users` columns. This broke the documented `db:migrate:deploy` deploy path and the API test suite (14/18 files failed at setup with `column totpEnabled does not exist`).
+  - Generated reconciliation SQL via `prisma migrate diff` (migration-built DB → schema.prisma) and added migration `20260531000000_reconcile_schema_drift`. It adds the 10 missing tables (`task_assignees`, `sso_configs`, `roles`, `chat_attachments`, `mcp_tool_calls`, `invitations`, `comment_mentions`, `notification_preferences`, `audit_logs`, `sessions`), 3 enums (`invitation_statuses`, `permissions`, `task_assignee_roles`), 4 `users` columns (`totpSecret`, `totpEnabled`, `backupCodes`, `displayName`), `settings.taskDeletionMode`, and `roleId` FKs on workspace_members/team_members/project_access — all with indexes + FKs.
+  - Made every statement **idempotent** (`IF NOT EXISTS`, guarded `DO $$ ... EXCEPTION WHEN duplicate_object` blocks) so it is safe against the already-reconciled production DB.
+  - Added the missing `prisma/migrations/migration_lock.toml` (provider = postgresql) — without it, `prisma migrate diff --from-migrations` could not read the migrations dir.
+  - **Verified:** fresh `migrate deploy` (all migrations incl. reconcile) → 31 tables, 12 user columns, and `prisma migrate diff` reports **"No difference detected"** vs schema. API test suite went from **14 failed/4 passed** to **18 passed / 149 tests / exit 0**.
+- **Docs accuracy.** Removed the false "100% test coverage on execution services" claim from `docs/CODEBASE_INDEX.md` (sidecar actually has 0 automated tests). Updated `docs/ARCHITECTURE.md` deployment section (DigitalOcean/PM2 → Azure Container Apps + ACR, current `deploy-azure.yml` pipeline) and auth section (added PAT + TOTP 2FA + SSO alongside GitHub OAuth). Softened the "GitHub OAuth is the only login method" line in `docs/features/api-reference.md`.
+- **Sidecar logging.** Confirmed the `console.*` → pino `logger` migration across all `apps/sidecar/src` services/routes (was already present in the working tree; verified 0 `console.` calls remain in non-test sidecar source, typecheck clean). This closes the last open guardrail from the F1 plan-compliance review (REJECT-4).
+
+### Files changed
+- `packages/db/prisma/migrations/20260531000000_reconcile_schema_drift/migration.sql` — new reconciliation migration (idempotent)
+- `packages/db/prisma/migrations/migration_lock.toml` — new (was missing)
+- `docs/CODEBASE_INDEX.md` — removed false 100% coverage claims (2 spots)
+- `docs/ARCHITECTURE.md` — Azure deployment + CI/CD rewrite; auth section updated (PAT/2FA/SSO)
+- `docs/features/api-reference.md` — auth line corrected
+- `apps/sidecar/src/**` — console→logger (verified; bulk of this was pre-existing working-tree work)
+
+### Verification
+- `prisma migrate deploy` on a fresh DB → 31 tables / 12 user cols; `migrate diff` vs schema → no difference
+- `pnpm --filter @openlinear/api test` → 18 files passed, 149 tests, exit 0 (was 14 failing)
+- `@openlinear/api`, `@openlinear/sidecar`, `@openlinear/db` typecheck → all exit 0
+- `db:generate` → clean
+
+### Issues encountered / notes
+- Prod Neon DB already has all 31 tables + TOTP columns (someone ran `db:push` against it directly), but its `_prisma_migrations` history is the same incomplete set. The new idempotent reconcile migration is safe to mark-applied or run there; recommend `prisma migrate resolve --applied 20260531000000_reconcile_schema_drift` on prod so history matches without re-running DDL.
+- Both CI workflows (`deploy.yml` legacy/disabled, `deploy-azure.yml` active) use `db:push` for their ephemeral test DB, which is why CI didn't catch the drift. Consider switching CI to `migrate deploy` so the migration path is continuously exercised.
+- Pre-existing uncommitted working-tree changes (chat attachments, transcribe Cartesia URL, opencode init-guard, etc.) were left untouched per protocol.
+
+### Next steps / blockers (follow-ups — NOT done this session)
+- **Sidecar/execution-core test coverage: 0 tests.** The execution engine (clones repos, force-pushes branches, creates PRs) and `packages/execution-core` have no automated tests. Highest-value remaining gap. Add Vitest coverage for lifecycle, git, worktree, batch orchestrator/completion, and the pure `event-stream-processor`.
+- **Multi-tenant OpenCode isolation** (`docs/limitations.md`): cloud deployment still shares one OpenCode process/auth store across users, gated only by `OPENLINEAR_ALLOW_SHARED_OPENCODE=1`. Real per-user isolation (per-user `XDG_DATA_HOME` + process pool) still pending.
+- Consider making CI run `prisma migrate deploy` against a fresh DB (in addition to / instead of `db:push`) to prevent future drift.
+
+---
+
 ## [2026-05-26] — Fix sidecar startup crash (missing openid-client + otpauth + ALLOW_SHARED_OPENCODE)
 
 **Status:** Done
@@ -1583,3 +1643,23 @@ The sidecar was likely not running when login was attempted (single-tenant guard
 
 ### Next steps / blockers
 - None for the execution workflow and Activity tab fixes.
+## [2026-05-27] — Full codebase review, index, and CODEBASE_INDEX.md
+
+**Status:** Done
+**Agent:** Sisyphus (OpenCode)
+
+### What was done
+- Ran 4 parallel `kiroExplore` background agents exploring API, Frontend, Sidecar, and MCP/DB layers
+- Read ~40+ key source files directly across all layers
+- Cross-referenced results with direct reads to verify accuracy
+- Created comprehensive `docs/CODEBASE_INDEX.md` (651 lines, 12 sections)
+
+### Files changed
+- `docs/CODEBASE_INDEX.md` — New. Complete index covering: architecture overview, API (28 routes, 5 middleware, 12 services, 34 chat tools, auth, error handling, rate limiting, tests), Sidecar execution engine (17 execution files, 5 batch files, safeguards, execution flow), Frontend (15 pages, 27 component dirs, state management, API client, SSE, keyboard shortcuts), Desktop Tauri (4 Rust files, sidecar manager, deeplink), MCP Server (8 tools, stateless Worker, API integration), Database (25+ models, 13 enums, Prisma patterns, migrations), shared packages, CI/CD, patterns/conventions, production URLs, and key commands
+
+### Issues encountered
+- 3 of 4 background sessions returned no output (likely expired); recovered by reading files directly
+- Background sessions were "idle" but had full results in the final turn — retrieve messages worked on resumption
+
+### Next steps / blockers
+- None. Codebase fully indexed.

apps/api/src/app.ts

@@ -119,6 +119,8 @@ function isGithubOAuthPath(path: string): boolean {
 export function createApp(): Application {
   const app: Application = express();
 
+  app.set('trust proxy', 1);
+
   // Security headers — CSP disabled because Tauri owns CSP in the desktop UI
   app.use(
     helmet({

apps/api/src/lib/chat-prompts.ts

@@ -15,9 +15,9 @@ export function buildChatSystemPrompt(input: BuildSystemPromptInput): string {
     'When a tool returns a permission error, explain the permission boundary plainly and do not suggest bypasses.',
     'Prefer deterministic identifiers from tool results over fuzzy names. If a user names something ambiguously, call search first.',
     'For combined setup requests that mention many issues/tasks plus labels, label colors, or a deadline, use setup_project_plan in one call instead of separate create_label/update_project/bulk_create_issues calls.',
-    'When the user explicitly asks to create/add/done, create the requested records; use dryRun=true only when the user asks for a preview or brainstorm.',
+    'When the user explicitly asks to create/add/done, create the requested records; use dryRun=true only when the user literally says "preview" or "dry run".',
     'Never say records were created, updated, moved, or archived until the corresponding mutating tool has returned ok=true.',
-    'For standalone bulk issue planning, use bulk_create_issues with dryRun=true first unless the user explicitly asks to create/add now.',
+    'For standalone bulk issue planning, use bulk_create_issues with dryRun=false to create immediately. Only use dryRun=true when the user literally asks for a preview.',
     'For changing many existing issues at once, use bulk_update_issues. Map user words like completed/complete to the done status.',
     'For deleting/removing/clearing existing active issues in a selected project, use archive_issues. Omit issue ids only when the user clearly means all active issues in the project.',
     'Keep final answers short, source-grounded, and action-oriented. Mention the exact records changed when tools mutate data.',

apps/api/src/lib/constants.ts

@@ -0,0 +1 @@
+export const PRISMA_TX_OPTIONS = { timeout: 15_000, maxWait: 5_000 } as const;

apps/api/src/routes/activity-log.ts

@@ -8,6 +8,7 @@ import {
   assertTeamRole,
 } from '../services/ownership';
 import { getUserTeamIds } from '../services/team-scope';
+import { PRISMA_TX_OPTIONS } from '../lib/constants';
 import { paginated, paginationSkipTake } from '../schemas/pagination';
 import { ValidationError } from '../errors';
 
@@ -71,7 +72,7 @@ router.get('/', requireAuth, async (req: AuthRequest, res: Response) => {
       const count = await tx.activityLog.count({ where });
       return [items, count] as const;
     },
-    { timeout: 15000, maxWait: 5000 },
+    PRISMA_TX_OPTIONS,
   );
 
   res.json(paginated(activities, total, page, pageSize));

apps/api/src/routes/agent-runs.ts

@@ -6,6 +6,7 @@ import { assertTaskAccess } from '../services/ownership';
 import { getUserTeamIds } from '../services/team-scope';
 import { paginated, paginationSkipTake } from '../schemas/pagination';
 import { HttpError, ValidationError } from '../errors';
+import { PRISMA_TX_OPTIONS } from '../lib/constants';
 
 const router: Router = Router();
 
@@ -75,7 +76,7 @@ router.get(
         const count = await tx.agentRun.count({ where });
         return [items, count] as const;
       },
-      { timeout: 15000, maxWait: 5000 },
+      PRISMA_TX_OPTIONS,
     );
 
     res.json(paginated(runs, total, page, pageSize));

apps/api/src/routes/dashboard.ts

@@ -17,7 +17,7 @@ router.get(
       ? { OR: [{ creatorId: userId }, { assigneeId: userId }, { teamId: { in: teamIds } }] }
       : { OR: [{ creatorId: userId }, { assigneeId: userId }] };
 
-    const [statusCounts, priorityCounts, overdue, unassigned, total, recent] = await Promise.all([
+    const results = await Promise.allSettled([
       prisma.task.groupBy({
         by: ['status'],
         where: { ...where, archived: false },
@@ -54,6 +54,13 @@ router.get(
       }),
     ]);
 
+    const statusCounts = results[0].status === 'fulfilled' ? results[0].value : [];
+    const priorityCounts = results[1].status === 'fulfilled' ? results[1].value : [];
+    const overdue = results[2].status === 'fulfilled' ? results[2].value : 0;
+    const unassigned = results[3].status === 'fulfilled' ? results[3].value : 0;
+    const total = results[4].status === 'fulfilled' ? results[4].value : 0;
+    const recent = results[5].status === 'fulfilled' ? results[5].value : 0;
+
     const statusMap = Object.fromEntries(statusCounts.map((s) => [s.status, s._count._all]));
     const priorityMap = Object.fromEntries(priorityCounts.map((p) => [p.priority, p._count._all]));
 

apps/api/src/routes/inbox.ts

@@ -5,6 +5,7 @@ import { validateQuery, ValidatedRequest } from '../middleware/validate';
 import { getUserTeamIds } from '../services/team-scope';
 import { assertTaskOwned } from '../services/ownership';
 import { paginationQuerySchema, paginated, paginationSkipTake, PaginationQuery } from '../schemas/pagination';
+import { PRISMA_TX_OPTIONS } from '../lib/constants';
 
 const router: Router = Router();
 
@@ -70,7 +71,7 @@ router.get(
         const count = await tx.task.count({ where });
         return [items, count] as const;
       },
-      { timeout: 15000, maxWait: 5000 },
+      PRISMA_TX_OPTIONS,
     );
 
     const flatTasks = tasks.map(task => ({