[teamleaderleo]

Fix integration callbacks to preserve their originating team scope.

A Settings GitHub App connection started inside a shared team receives a signed state containing that team. The dashboard callback now decodes only the team-shaped claim as an untrusted routing hint and passes it as x-cmux-team; the API remains authoritative and verifies the signed state, user, connection, and team before completion. Personal-team callbacks use the same path without changing API behavior.

"one "Connect GitHub" in Settings and onboarding that uses the cmux GitHub App broker"

Changes:

• Add a bounded JWT-payload routing helper that accepts only team_<20 hex> claims.
• Extract the completion request frame so the callback and regression test share the same path.
• Cover shared/personal team routing and malformed/tampered state.

Validation:

• Focused fleet test passed on the previous head: run 40658965046.
• Exact-head focused fleet test passed (4 tests): run 40659508908, after restricting callback parameters to the provider fields and adding a conflicting-dashboard-scope regression.
• This changes callback request routing only; rendered UI is unchanged.

Agent session: agent session

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review 46501c5: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr26804 -f ref=launch-polish-github-callback-team -f platform=macos -f backend_mode=local

[teamleaderleo]

Bead cx-v5eqbz created for this PR by the cmux coordinator.

[blacksmith-sh]

Found 4 test failures on Blacksmith runners:

Failures

Test	View Logs
build_only must be a conjunctive exclusion on the helper, signing, and publication jobs , and must not gate the unsigned app build/ build_only must be a conjunctive exclusion on the helper, signing, and publication jobs , and must not gate the unsigned app build	View Logs
nightly.yml must derive the embedded key and sign every appcast through the helper/ nightly.yml must derive the embedded key and sign every appcast through the helper	View Logs
test_the_nightly_is_covered (main.NightlyStepCoverageTests.test_the_nightly_is_cove red)/ test_the_nightly_is_covered (main.NightlyStepCoverageTests.test_the_nightly_is_cove red)	View Logs
test_the_repository_highlights_validate (main.DigestTests.test_the_repository_highl ights_validate)/ test_the_repository_highlights_validate (main.DigestTests.test_the_repository_highl ights_validate)	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[teamleaderleo]

Owned by an agent session · session

[github-actions]

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4068813240101 (127a2705ef)
• cmux NEXT nightly 1.0.0-nightly.4069035197201 (2645001cde)