Merge branch 'main' into linear/sou-1410-sourcebot-devsourcebot-GHSA-p6gq-j5cr-w38f-nodemailer-ab79

Author: brendan-kellam

.github/actions/check-prisma-migrations/action.yml

@@ -0,0 +1,114 @@
+name: Check Prisma Migrations
+description: >-
+  Verify Prisma migrations apply cleanly in order and reproduce schema.prisma
+  (drift check), and that no new migration predates the latest on the base
+  branch (ordering check). Designed to be embedded in an existing job so its
+  failure turns that job's status red.
+
+inputs:
+  base-ref:
+    description: >-
+      Base git ref to diff migrations against (e.g. a PR's base branch). When
+      set, the action skips work on PRs that don't touch migrations and runs the
+      ordering check. When empty (release builds), the drift check always runs
+      and the ordering check is skipped.
+    required: false
+    default: ""
+
+runs:
+  using: composite
+  steps:
+    - name: Detect Prisma changes
+      id: detect
+      shell: bash
+      run: |
+        if [ -z "${{ inputs.base-ref }}" ]; then
+          echo "changed=true" >> "$GITHUB_OUTPUT"
+          echo "No base-ref provided — running drift check unconditionally."
+          exit 0
+        fi
+        git fetch --no-tags --depth=1 origin "+refs/heads/${{ inputs.base-ref }}:refs/remotes/origin/${{ inputs.base-ref }}"
+        if git diff --name-only "origin/${{ inputs.base-ref }}" HEAD | grep -q '^packages/db/prisma/'; then
+          echo "changed=true" >> "$GITHUB_OUTPUT"
+          echo "Prisma changes detected — running migration checks."
+        else
+          echo "changed=false" >> "$GITHUB_OUTPUT"
+          echo "No Prisma changes — skipping migration checks."
+        fi
+
+    - name: Start Postgres
+      if: steps.detect.outputs.changed == 'true'
+      shell: bash
+      run: |
+        docker run -d --name prisma-check-pg \
+          -e POSTGRES_USER=postgres \
+          -e POSTGRES_PASSWORD=postgres \
+          -e POSTGRES_DB=sourcebot \
+          -p 5432:5432 postgres:16
+        for i in $(seq 1 30); do
+          if docker exec prisma-check-pg pg_isready -U postgres -q; then
+            echo "Postgres ready."
+            exit 0
+          fi
+          sleep 2
+        done
+        echo "Postgres failed to become ready." && exit 1
+
+    - name: Use Node.js
+      if: steps.detect.outputs.changed == 'true'
+      uses: actions/setup-node@v4
+      with:
+        node-version: "20.x"
+
+    - name: Install
+      if: steps.detect.outputs.changed == 'true'
+      shell: bash
+      run: yarn install --frozen-lockfile
+
+    # Check 1: migrations apply cleanly in order AND reproduce schema.prisma.
+    # `migrate deploy` fails if a migration is broken or applies out of sequence;
+    # `migrate diff` exits 2 when the applied history drifts from the schema.
+    - name: Apply migrations
+      if: steps.detect.outputs.changed == 'true'
+      shell: bash
+      working-directory: packages/db
+      env:
+        DATABASE_URL: postgresql://postgres:postgres@localhost:5432/sourcebot
+      run: yarn prisma migrate deploy
+
+    - name: Check for schema drift
+      if: steps.detect.outputs.changed == 'true'
+      shell: bash
+      working-directory: packages/db
+      env:
+        DATABASE_URL: postgresql://postgres:postgres@localhost:5432/sourcebot
+      run: |
+        yarn prisma migrate diff \
+          --from-url "$DATABASE_URL" \
+          --to-schema-datamodel prisma/schema.prisma \
+          --exit-code \
+        && echo "✅ No drift: migrations reproduce schema.prisma" \
+        || (echo "❌ schema.prisma has changes not captured in a migration. Run: yarn dev:prisma:migrate:dev --name <name>" && exit 1)
+
+    # Check 2 (PRs only): no new migration predates the latest on the base branch.
+    - name: Check migration ordering
+      if: steps.detect.outputs.changed == 'true' && inputs.base-ref != ''
+      shell: bash
+      run: |
+        MIG_DIR=packages/db/prisma/migrations
+        BASE="origin/${{ inputs.base-ref }}"
+        LATEST_ON_BASE=$(git ls-tree -r --name-only "$BASE" -- "$MIG_DIR" \
+          | sed -n "s#$MIG_DIR/\([0-9]\{14\}\)_.*#\1#p" | sort | tail -1)
+        echo "Latest migration on ${{ inputs.base-ref }}: ${LATEST_ON_BASE:-<none>}"
+        NEW=$(comm -23 \
+          <(ls "$MIG_DIR" | sed -n 's/^\([0-9]\{14\}\)_.*/\1/p' | sort -u) \
+          <(git ls-tree -r --name-only "$BASE" -- "$MIG_DIR" | sed -n "s#$MIG_DIR/\([0-9]\{14\}\)_.*#\1#p" | sort -u))
+        FAIL=0
+        for ts in $NEW; do
+          if [ -n "$LATEST_ON_BASE" ] && [ "$ts" -lt "$LATEST_ON_BASE" ]; then
+            echo "❌ New migration $ts predates latest migration on ${{ inputs.base-ref }} ($LATEST_ON_BASE). Rename it with a current timestamp."
+            FAIL=1
+          fi
+        done
+        [ "$FAIL" -eq 0 ] && echo "✅ Migration ordering OK"
+        exit $FAIL

.github/workflows/_build.yml

@@ -76,6 +76,14 @@ jobs:
           fetch-depth: 0
           token: ${{ inputs.use_app_token && steps.generate_token.outputs.token || github.token }}
 
+      # Release backstop: fail the build if migrations drift from schema.prisma.
+      # Runs once (amd64 only) since the check is platform-independent. base-ref
+      # is omitted, so the drift check always runs and the (PR-only) ordering
+      # check is skipped.
+      - name: Check Prisma migrations
+        if: matrix.platform == 'linux/amd64'
+        uses: ./.github/actions/check-prisma-migrations
+
       # Extract metadata (tags, labels) for Docker
       # https://github.com/docker/metadata-action
       - name: Extract Docker metadata

.github/workflows/generate-openapi.yml

@@ -0,0 +1,49 @@
+name: Generate OpenAPI Spec
+
+on:
+  pull_request:
+    branches: ["main"]
+    paths:
+      - "packages/web/**"
+      - "packages/shared/src/version.ts"
+
+jobs:
+  generate-openapi:
+    runs-on: ubuntu-latest
+    # Skip forks: the default GITHUB_TOKEN can't push back to a fork's branch.
+    if: github.event.pull_request.head.repo.full_name == github.repository
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          submodules: "true"
+          ref: ${{ github.head_ref }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Use Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20.x'
+          cache: 'yarn'
+          cache-dependency-path: '**/yarn.lock'
+
+      - name: Install
+        run: yarn install --frozen-lockfile
+
+      - name: Generate OpenAPI spec
+        run: yarn workspace @sourcebot/web openapi:generate
+
+      - name: Commit regenerated spec if changed
+        run: |
+          SPEC=docs/api-reference/sourcebot-public.openapi.json
+          if [ -z "$(git status --porcelain "$SPEC")" ]; then
+            echo "OpenAPI spec is up to date."
+            exit 0
+          fi
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add "$SPEC"
+          git commit -m "chore: regenerate OpenAPI spec"
+          git push

.github/workflows/pr-gate.yml

@@ -1,6 +1,7 @@
 name: PR Gate
 
-# This gate simply validates that we can build the docker container.
+# This gate validates that Prisma migrations are in order and that we can build
+# the docker container.
 
 on:
   pull_request:
@@ -16,6 +17,15 @@ jobs:
         uses: actions/checkout@v4
         with:
           submodules: "true"
+          # full history so migration checks can diff against the base branch
+          fetch-depth: 0
+
+      # Fails fast (before the docker build) when migrations drift from
+      # schema.prisma or a new migration is added out of timestamp order.
+      - name: Check Prisma migrations
+        uses: ./.github/actions/check-prisma-migrations
+        with:
+          base-ref: ${{ github.base_ref }}
 
       - name: Build Docker image
         id: build

CHANGELOG.md

@@ -7,8 +7,27 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+- [EE] Improved Ask Sourcebot prompt caching by splitting static and dynamic prompt sections and advancing cache breakpoints after every agent step instead of only after each message. [#1366](https://github.com/sourcebot-dev/sourcebot/pull/1366)
+- Refactored Ask Sourcebot user message text extraction into a shared helper that robustly handles non-text message parts. [#1371](https://github.com/sourcebot-dev/sourcebot/pull/1371)
+- Made the backend worker API address configurable via the `WORKER_API_URL` environment variable (default `http://localhost:3060`) instead of being hardcoded. [#1409](https://github.com/sourcebot-dev/sourcebot/pull/1409)
+
 ### Added
 - Added per-step token cost tracking and estimated tool call token usage to Ask Sourcebot chat history. [#1353](https://github.com/sourcebot-dev/sourcebot/pull/1353)
+- [EE] Added mermaid diagram rendering to Ask Sourcebot answers, with pan/zoom, copy/export, in-thread deep links, and an interleaved right-panel view. [#1369](https://github.com/sourcebot-dev/sourcebot/pull/1369)
+- [EE] Added a context-window usage gauge to the Ask Sourcebot chat details, showing how much of the selected model's context window each turn occupies. Window sizes are resolved from the models.dev catalog. [#1370](https://github.com/sourcebot-dev/sourcebot/pull/1370)
+- Added language model input-modality and document capability resolution, automatically resolved from the models.dev catalog (falls back to text-only for uncatalogued/self-hosted models). [#1372](https://github.com/sourcebot-dev/sourcebot/pull/1372)
+- [EE] Added DPoP sender-constrained OAuth tokens for MCP clients. [#1395](https://github.com/sourcebot-dev/sourcebot/pull/1395)
+- [EE] Added text file attachments to Ask Sourcebot, letting users attach text/code/config files to a chat message via the paperclip button, drag-and-drop, or paste, with large pastes auto-converted to attachments. [#1374](https://github.com/sourcebot-dev/sourcebot/pull/1374)
+- [EE] Added image attachments to Ask Sourcebot, letting users attach images to a chat message when the selected model supports image input. [#1375](https://github.com/sourcebot-dev/sourcebot/pull/1375)
+
+### Fixed
+- Send anonymous server-side PostHog events as personless so unauthenticated requests don't inflate person counts. [#1367](https://github.com/sourcebot-dev/sourcebot/pull/1367)
+- [EE] Fixed Ask Sourcebot mermaid diagrams overflowing their container by contain-fitting them to both width and height, and made revealing a diagram from the answer jump it into view instantly to avoid over/undershooting. [#1373](https://github.com/sourcebot-dev/sourcebot/pull/1373)
+- Verified GitHub review webhook deliveries before processing them. [#1378](https://github.com/sourcebot-dev/sourcebot/pull/1378)
+- Passed Zoekt index parameters via argv to preserve revision names with punctuation. [#1376](https://github.com/sourcebot-dev/sourcebot/pull/1376)
+- [EE] Validated OAuth bearer token scopes before allowing access to the Sourcebot MCP resource server. [#1396](https://github.com/sourcebot-dev/sourcebot/pull/1396)
+- Added HTTP security headers to all web app responses. [#1407](https://github.com/sourcebot-dev/sourcebot/pull/1407)
 
 ### Fixed
 - Upgraded `nodemailer` to `^9.0.1`. [#1356](https://github.com/sourcebot-dev/sourcebot/pull/1356)
@@ -45,6 +64,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Added
 - Added the ability to configure email code and credentials login from the security settings. [#1303](https://github.com/sourcebot-dev/sourcebot/pull/1303)
 - Added a list of configured SSO providers from the security settings. [#1303](https://github.com/sourcebot-dev/sourcebot/pull/1303)
+- [EE] Added a SCIM 2.0 server for automated user provisioning and deprovisioning from identity providers (Okta, Entra). [#1306](https://github.com/sourcebot-dev/sourcebot/pull/1306)
 
 ### Fixed
 - Validated that `SOURCEBOT_ENCRYPTION_KEY` is exactly 32 characters at startup, failing fast with an actionable message instead of a runtime encryption error. [#1305](https://github.com/sourcebot-dev/sourcebot/pull/1305)

CLAUDE.md

@@ -96,7 +96,7 @@ When implementing a new API route, ask the user whether it should be part of the
 3. Add the endpoint to the relevant group in the `API Reference` tab of `docs/docs.json`.
 4. Regenerate the OpenAPI spec by running `yarn workspace @sourcebot/web openapi:generate`.
 
-Route handlers should validate inputs using Zod schemas.
+Route handlers should validate inputs using Zod schemas. Put coercion, defaults, minimums, maximums, and cross-field validation in the schema instead of scattering parsing logic through the handler.
 
 **Query parameters** (GET requests):
 
@@ -105,8 +105,9 @@ import { queryParamsSchemaValidationError, serviceErrorResponse } from "@/lib/se
 import { z } from "zod";
 
 const myQueryParamsSchema = z.object({
-    q: z.string().default(''),
+    repo: z.string(),
     page: z.coerce.number().int().positive().default(1),
+    perPage: z.coerce.number().int().positive().max(100).default(50),
 });
 
 export const GET = apiHandler(async (request: NextRequest) => {
@@ -124,11 +125,42 @@ export const GET = apiHandler(async (request: NextRequest) => {
         );
     }
 
-    const { q, page } = parsed.data;
+    const { page, perPage, ...searchParams } = parsed.data;
+    const skip = (page - 1) * perPage;
     // ... rest of handler
 });
 ```
 
+**Search query parameters**:
+
+```ts
+import { queryParamsSchemaValidationError, serviceErrorResponse } from "@/lib/serviceError";
+import { z } from "zod";
+
+const searchMembersQueryParamsSchema = z.object({
+    query: z.string().default(''),
+});
+
+export const GET = apiHandler(async (request: NextRequest) => {
+    const rawParams = Object.fromEntries(
+        Object.keys(searchMembersQueryParamsSchema.shape).map(key => [
+            key,
+            request.nextUrl.searchParams.get(key) ?? undefined
+        ])
+    );
+    const parsed = searchMembersQueryParamsSchema.safeParse(rawParams);
+
+    if (!parsed.success) {
+        return serviceErrorResponse(
+            queryParamsSchemaValidationError(parsed.error)
+        );
+    }
+
+    const { query } = parsed.data;
+    // ... use query in the database/search call
+});
+```
+
 **Request body** (POST/PUT/PATCH requests):
 
 ```ts
@@ -155,6 +187,13 @@ export const POST = apiHandler(async (request: NextRequest) => {
 });
 ```
 
+Use `safeParseAsync` when the schema has async refinements, as in search routes:
+
+```ts
+const body = await request.json();
+const parsed = await searchRequestSchema.safeParseAsync(body);
+```
+
 ## Data Fetching
 
 For GET requests, prefer using API routes with react-query over server actions. This provides caching benefits and better control over data refetching.
@@ -226,6 +265,41 @@ export const GET = apiHandler(async (request: NextRequest) => {
 });
 ```
 
+## Membership States
+
+Organization membership state is derived from fields on `UserToOrg`:
+
+- **Active**: `suspendedAt` is `null` and `lastActiveAt` is not `null`. Active members can access the org and count as billable seats.
+- **Pending**: `suspendedAt` is `null` and `lastActiveAt` is `null`. Pending users can access the org, but are not billable yet.
+- **Suspended**: `suspendedAt` is not `null`. Suspended users cannot access the org and are not billable.
+
+When filtering memberships, use the helper predicates from `packages/web/src/features/membership/utils.ts` instead of writing these conditions inline. This keeps auth, billing, SCIM, and UI queries aligned as the state rules evolve.
+
+```ts
+import {
+    activeMembershipWhere,
+    activeOrPendingMembershipWhere,
+    pendingMembershipWhere,
+    suspendedMembershipWhere,
+} from "@/features/membership/utils";
+
+// Billable seat count.
+await prisma.userToOrg.count({
+    where: {
+        orgId,
+        ...activeMembershipWhere(),
+    },
+});
+
+// Users who should be able to access the org.
+await prisma.userToOrg.findMany({
+    where: {
+        orgId,
+        ...activeOrPendingMembershipWhere(),
+    },
+});
+```
+
 ## Next.js Router Navigation
 
 Do NOT call `router.refresh()` immediately after `router.push()`. In Next.js 16, the prefetch cache and navigation system was completely rewritten, and calling `router.refresh()` right after `router.push()` creates a race condition. The refresh invalidates the cache and can interrupt the in-flight navigation, leaving the page stuck or not loading.

docs/api-reference/sourcebot-public.openapi.json

@@ -1148,6 +1148,11 @@
               "MEMBER"
             ]
           },
+          "suspendedAt": {
+            "type": "string",
+            "nullable": true,
+            "format": "date-time"
+          },
           "createdAt": {
             "type": "string",
             "format": "date-time"
@@ -1163,6 +1168,7 @@
           "name",
           "email",
           "role",
+          "suspendedAt",
           "createdAt",
           "lastActivityAt"
         ]