Merge branch 'main' into brendan/associate-sentry-errors-with-users

Author: brendan-kellam

.agents/skills/gh-stack/SKILL.md

@@ -7,6 +7,22 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+- Added an optional `webUrl` field to the GitLab connection config, used to build links to repositories in the GitLab web UI when the API host differs from the browsable host. [#1457](https://github.com/sourcebot-dev/sourcebot/pull/1457)
+
+### Fixed
+- Prevented focus rings in workspace connector dialogs from being clipped. [#1457](https://github.com/sourcebot-dev/sourcebot/pull/1457)
+
+## [5.1.2] - 2026-07-16
+
+### Added
+- Added an opt-in `SOURCEBOT_LLM_USER_EMAIL_HEADER_ENABLED` environment variable that sends the authenticated user's lower-cased email to language model providers in the `X-Sourcebot-User-Email` header. [#1455](https://github.com/sourcebot-dev/sourcebot/pull/1455)
+
+### Fixed
+- [EE] Verified signed online license assertions before granting paid feature entitlements. [#1442](https://github.com/sourcebot-dev/sourcebot/pull/1442)
+- [EE] Fixed worker startup races that could disable GitHub App authentication and permission syncing until restart after an online license refresh. [#1454](https://github.com/sourcebot-dev/sourcebot/pull/1454)
+- [EE] Fixed GitHub connection sync jobs to fail safely when GitHub App authentication is configured without the required entitlement. [#1454](https://github.com/sourcebot-dev/sourcebot/pull/1454)
+
 ## [5.1.1] - 2026-07-14
 
 - Add book a call button to sidebar. [#1441](https://github.com/sourcebot-dev/sourcebot/pull/1441)

CHANGELOG.md

@@ -2,7 +2,7 @@
   "openapi": "3.0.3",
   "info": {
     "title": "Sourcebot Public API",
-    "version": "v5.1.1",
+    "version": "v5.1.2",
     "description": "OpenAPI description for the public Sourcebot REST endpoints used for search, repository listing, and file browsing. Authentication is instance-dependent: API keys are the standard integration mechanism, OAuth bearer tokens are EE-only, and some instances may allow anonymous access."
   },
   "tags": [

docs/api-reference/sourcebot-public.openapi.json

@@ -42,6 +42,7 @@ The following environment variables allow you to configure your Sourcebot deploy
 | `ALWAYS_INDEX_FILE_PATTERNS` | - | <p>A comma separated list of glob patterns matching file paths that should always be indexed, regardless of size or number of trigrams.</p> |
 | `SOURCEBOT_CHAT_ATTACHMENT_MAX_IMAGE_BYTES` | `10485760` (10 MiB) | <p>Maximum size in bytes of a single image attachment uploaded to Ask Sourcebot. Enforced server-side at upload time.</p> |
 | `SOURCEBOT_CHAT_ATTACHMENT_ORPHAN_TTL_HOURS` | `24` | <p>How long in hours an uploaded-but-unsent attachment is retained before being deleted by the orphan sweep. Set to `0` to disable the sweep.</p> |
+| `SOURCEBOT_LLM_USER_EMAIL_HEADER_ENABLED` | `false` | <p>When enabled, Sourcebot sends the authenticated user's lower-cased email address to configured language model providers in the `X-Sourcebot-User-Email` request header. Anonymous requests omit the header.</p> |
 | `NODE_USE_ENV_PROXY` | `0` | <p>Enables Node.js to automatically use `HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY` environment variables for network requests. Set to `1` to enable or `0` to disable. See [this doc](https://nodejs.org/en/learn/http/enterprise-network-configuration) for more info.</p> |
 | `HTTP_PROXY` | - | <p>HTTP proxy URL for routing non-SSL requests through a proxy server (e.g., `http://proxy.company.com:8080`). Requires `NODE_USE_ENV_PROXY=1`.</p> |
 | `HTTPS_PROXY` | - | <p>HTTPS proxy URL for routing SSL requests through a proxy server (e.g., `http://proxy.company.com:8080`). Requires `NODE_USE_ENV_PROXY=1`.</p> |

docs/docs/configuration/environment-variables.mdx

@@ -272,6 +272,15 @@
           ],
           "pattern": "^https?:\\/\\/[^\\s/$.?#].[^\\s]*$"
         },
+        "webUrl": {
+          "type": "string",
+          "format": "url",
+          "description": "The base URL used to construct links to repositories in the GitLab web UI. Useful when the API is served from a different host than the one users browse (e.g. `https://api.gitlab.example.com` for `url` and `https://gitlab.example.com` for `webUrl`). Defaults to the value of `url`.",
+          "examples": [
+            "https://gitlab.example.com"
+          ],
+          "pattern": "^https?:\\/\\/[^\\s/$.?#].[^\\s]*$"
+        },
         "all": {
           "type": "boolean",
           "default": false,

docs/snippets/schemas/v3/connection.schema.mdx

@@ -51,6 +51,15 @@
       ],
       "pattern": "^https?:\\/\\/[^\\s/$.?#].[^\\s]*$"
     },
+    "webUrl": {
+      "type": "string",
+      "format": "url",
+      "description": "The base URL used to construct links to repositories in the GitLab web UI. Useful when the API is served from a different host than the one users browse (e.g. `https://api.gitlab.example.com` for `url` and `https://gitlab.example.com` for `webUrl`). Defaults to the value of `url`.",
+      "examples": [
+        "https://gitlab.example.com"
+      ],
+      "pattern": "^https?:\\/\\/[^\\s/$.?#].[^\\s]*$"
+    },
     "all": {
       "type": "boolean",
       "default": false,

docs/snippets/schemas/v3/gitlab.schema.mdx

@@ -763,6 +763,15 @@
                   ],
                   "pattern": "^https?:\\/\\/[^\\s/$.?#].[^\\s]*$"
                 },
+                "webUrl": {
+                  "type": "string",
+                  "format": "url",
+                  "description": "The base URL used to construct links to repositories in the GitLab web UI. Useful when the API is served from a different host than the one users browse (e.g. `https://api.gitlab.example.com` for `url` and `https://gitlab.example.com` for `webUrl`). Defaults to the value of `url`.",
+                  "examples": [
+                    "https://gitlab.example.com"
+                  ],
+                  "pattern": "^https?:\\/\\/[^\\s/$.?#].[^\\s]*$"
+                },
                 "all": {
                   "type": "boolean",
                   "default": false,

docs/snippets/schemas/v3/index.schema.mdx

@@ -54,6 +54,6 @@
         "prom-client": "^15.1.3",
         "redlock": "5.0.0-beta.2",
         "simple-git": "^3.36.0",
-        "zod": "^3.25.74"
+        "zod": "^3.25.76"
     }
 }

packages/backend/package.json

@@ -3,7 +3,7 @@ import { PrismaClient, AccountPermissionSyncJobStatus, Account, PermissionSyncSo
 import { env, createLogger, getIdentityProviderConfig, PERMISSION_SYNC_SUPPORTED_IDENTITY_PROVIDERS } from "@sourcebot/shared";
 import { hasEntitlement } from "../entitlements.js";
 import { ensureFreshAccountToken } from "./tokenRefresh.js";
-import { Job, Queue, Worker } from "bullmq";
+import { DelayedError, Job, Queue, Worker } from "bullmq";
 import { Redis } from "ioredis";
 import {
     createOctokitFromToken,
@@ -26,6 +26,7 @@ const createJobLogger = (jobId: string) => createLogger(`${LOG_TAG}:job:${jobId}
 
 const QUEUE_NAME = 'accountPermissionSyncQueue';
 const POLLING_INTERVAL_MS = 1000;
+const ENTITLEMENT_RETRY_DELAY_MS = 30 * 1000;
 
 type AccountPermissionSyncJob = {
     jobId: string;
@@ -59,13 +60,13 @@ export class AccountPermissionSyncer {
     }
 
     public async startScheduler() {
-        if (!await hasEntitlement('permission-syncing')) {
-            throw new Error('Permission syncing is not supported in current plan.');
-        }
-
         logger.debug('Starting scheduler');
 
         this.interval = setIntervalAsync(async () => {
+            if (!await hasEntitlement('permission-syncing')) {
+                return;
+            }
+
             const thresholdDate = new Date(Date.now() - this.settings.userDrivenPermissionSyncIntervalMs);
 
             const accounts = await this.db.account.findMany({
@@ -168,6 +169,11 @@ export class AccountPermissionSyncer {
     }
 
     private async runJob(job: Job<AccountPermissionSyncJob>) {
+        if (!await hasEntitlement('permission-syncing')) {
+            await job.moveToDelayed(Date.now() + ENTITLEMENT_RETRY_DELAY_MS, job.token);
+            throw new DelayedError('Permission syncing entitlement is not currently available.');
+        }
+
         const id = job.data.jobId;
         const logger = createJobLogger(id);
 
@@ -443,4 +449,4 @@ export class AccountPermissionSyncer {
             logger.error(errorMessage('unknown account (id not found)', 'unknown user (id not found)'));
         }
     }
-}
+}

packages/backend/src/ee/accountPermissionSyncer.ts

@@ -0,0 +1,57 @@
+import { beforeEach, describe, expect, test, vi } from 'vitest';
+
+const mocks = vi.hoisted(() => ({
+    loadConfig: vi.fn(),
+}));
+
+vi.mock('@sourcebot/shared', () => ({
+    createLogger: vi.fn(() => ({
+        debug: vi.fn(),
+        error: vi.fn(),
+        info: vi.fn(),
+        warn: vi.fn(),
+    })),
+    env: { CONFIG_PATH: '/tmp/config.json' },
+    getTokenFromConfig: vi.fn(),
+    loadConfig: mocks.loadConfig,
+}));
+
+vi.mock('@octokit/app', () => ({
+    App: vi.fn(),
+}));
+
+const getManager = async () => {
+    const { GithubAppManager } = await import('./githubAppManager.js');
+    return GithubAppManager.getInstance();
+};
+
+describe('GithubAppManager.ensureInitialized', () => {
+    beforeEach(() => {
+        vi.resetModules();
+        mocks.loadConfig.mockReset();
+    });
+
+    test('shares initialization across concurrent callers', async () => {
+        mocks.loadConfig.mockResolvedValue({});
+        const manager = await getManager();
+
+        await Promise.all([
+            manager.ensureInitialized(),
+            manager.ensureInitialized(),
+        ]);
+
+        expect(mocks.loadConfig).toHaveBeenCalledTimes(1);
+    });
+
+    test('retries initialization after a transient failure', async () => {
+        mocks.loadConfig
+            .mockRejectedValueOnce(new Error('GitHub unavailable'))
+            .mockResolvedValueOnce({});
+        const manager = await getManager();
+
+        await expect(manager.ensureInitialized()).rejects.toThrow('GitHub unavailable');
+        await expect(manager.ensureInitialized()).resolves.toBeUndefined();
+
+        expect(mocks.loadConfig).toHaveBeenCalledTimes(2);
+    });
+});