Surface the built-in lane choice; default outbound User-Agent

[kentcdodds]

What

Live-testing the newly credentialed GitHub and Google built-ins (as the operator's own account) surfaced two rough edges:

1. The BYO-override was invisible

A complete bring-your-own record wins the connect lookup by design — but silently: clicking a built-in card reconnects the user's own app with zero indication. (Observed in production: the google built-in showed 0 connections after its operator "connected" to it; his complete BYO google record had won.) Now:

• /account/integrations.json?name= carries builtInAvailable — true when an enabled built-in exists that the returned record isn't using.
• /connect/oauth accepts platform=1, which forces the built-in prefill (and therefore the auto-start into the provider's consent screen). Forwarded through the SSR embed, the SPA route loader, and the in-component fallback identically.
• The connect page shows a notice on user-lane configs when a built-in exists: "This uses your own OAuth app for {provider}. Prefer the hosted one? Use the built-in {provider} integration instead — connecting it replaces this connection's tokens and scopes." No silent lane conversion in either direction; the choice (and the scope trade-off) is the user's.
• The notice link forces a full document load — a same-route SPA swap reuses the mounted route instance without re-running its init, so the auto-start would never fire (caught during verification).

2. Bare sandbox fetches to GitHub 403'd

GitHub rejects requests without a User-Agent and workerd sends none, so ad-hoc agent code calling api.github.com through createAuthenticatedFetch hit an opaque administrative 403 (packages that set their own UA were unaffected). The fetch gateway now sets kody-agent/1.0 when the caller doesn't provide one; caller values always win. Applied on both the placeholder-resolution path and the resolution-off fast path.

Testing

• Data tests: preferPlatform overrides a complete BYO win; hasAlternativeBuiltInApp true only for user-lane records shadowing an enabled built-in.
• Handler tests: platform=1 forwarding, builtInAvailable in the SSR embed shape.
• Gateway tests: default UA applied on both paths, caller UA preserved.
• Full validation green (one e2e re-run needed: the first run's failures were the e2e web server crashing from contention with the long-running dev server — all 7 pass in isolation).
• Browser-verified end to end: notice renders on a complete-BYO account, the built-in link does a full load with platform=1 and auto-redirects into GitHub's real sign-in/authorize flow.
• Production smoke tests via MCP: platform-lane GitHub token returns login: kentcdodds (with UA), google userinfo 200, integration_token_refresh fails cleanly on refresh-token-less connections, and refreshAccessToken throws the platform-lane teaching error.

  

Summary by CodeRabbit

• New Features

  • Added an option to switch from a custom OAuth app to an available hosted integration during setup and connection.
  • OAuth and integration details now indicate when a built-in alternative is available.
  • Added support for selecting the hosted integration when requested.

• Bug Fixes

  • Outbound requests now use kody-agent/1.0 by default while preserving custom User-Agent values.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: a18248b4-acc7-458b-a989-d74057899b64

📥 Commits

Reviewing files that changed from the base of the PR and between 1673c5b and 806cc03.

📒 Files selected for processing (10)

• packages/worker/client/routes/connect-oauth.tsx
• packages/worker/src/app/account-integrations-data.node.test.ts
• packages/worker/src/app/account-integrations-data.ts
• packages/worker/src/app/handlers/account-integrations.node.test.ts
• packages/worker/src/app/handlers/account-integrations.ts
• packages/worker/src/app/handlers/connect-oauth.node.test.ts
• packages/worker/src/app/handlers/connect-oauth.ts
• packages/worker/src/mcp/fetch-gateway.node.test.ts
• packages/worker/src/mcp/fetch-gateway.ts
• packages/worker/universal/loader-data.ts

---

📝 Walkthrough

Walkthrough

The OAuth flow now supports built-in integration preference, availability reporting, and switching from user-owned apps. Shared loader data and tests cover the new state. Gateway requests now use kody-agent/1.0 when no User-Agent is provided.

Changes

Built-in OAuth selection

Layer / File(s)	Summary
OAuth integration resolution packages/worker/src/app/account-integrations-data.ts, packages/worker/universal/loader-data.ts, packages/worker/src/app/account-integrations-data.node.test.ts	Integration loading can prefer enabled platform apps. The loader can report whether a built-in alternative exists. Loader data exposes builtInAvailable.
OAuth API and loader wiring packages/worker/src/app/handlers/account-integrations.ts, packages/worker/src/app/handlers/connect-oauth.ts, packages/worker/src/app/handlers/*.node.test.ts	Named integration requests accept platform=1. API and OAuth loader responses include built-in availability. Tests cover platform preference and response data.
Built-in alternative in connection UI packages/worker/client/routes/connect-oauth.tsx	The route preserves built-in availability and renders a navigation link during setup and connection. The link passes platform=1 and warns about replacing tokens and scopes.

Gateway User-Agent default

Layer / File(s)	Summary
Default gateway request header packages/worker/src/mcp/fetch-gateway.ts, packages/worker/src/mcp/fetch-gateway.node.test.ts	Outbound gateway requests use kody-agent/1.0 when no User-Agent is supplied. Caller-provided values remain unchanged. Tests cover both paths.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant OAuthClient
  participant ConnectOauth
  participant AccountIntegrations
  participant IntegrationData
  OAuthClient->>ConnectOauth: Request OAuth route with platform=1
  ConnectOauth->>IntegrationData: Load integration with preferPlatform=true
  OAuthClient->>AccountIntegrations: Request named integration
  AccountIntegrations->>IntegrationData: Resolve integration and built-in availability
  IntegrationData-->>AccountIntegrations: Integration and builtInAvailable
  AccountIntegrations-->>OAuthClient: JSON integration response

Loading

Possibly related PRs

• kentcdodds/kody#979: Introduced the OAuth integration loader and /connect-oauth flow extended by this change.
• kentcdodds/kody#1303: Introduced the platform OAuth integration flow modified here.
• kentcdodds/kody#1353: Modified the same integration loader and platform fallback behavior.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes both primary changes: the built-in OAuth lane choice and the default outbound User-Agent.
Description check	✅ Passed	The description explains the intent, summarizes the changes, and documents extensive testing, although it uses a custom heading instead of the template headings.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 2

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cursor/builtin-lane-choice-c0a2

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🔎 Preview deployed: https://kody-pr-1357.kody-a99.workers.dev

Worker: kody-pr-1357
D1: kody-pr-1357-db
KV: kody-pr-1357-oauth-kv

Mocks:

• cloudflare: https://kody-pr-1357-mock-cloudflare.kody-a99.workers.dev/__mocks (kody-pr-1357-mock-cloudflare)