[teamleaderleo]

Changelog

Fixed: An interrupted GitHub repository listing can no longer advance its cursor onto a different installation when connections are added, revoked, reordered, or rescoped.

Change

• Replace index-based {installation, page} cursors with bounded v2 opaque cursors encoding an exact selected connectionId, page, and SHA-256 fence.
• Compute the fence from the authenticated principal, normalized query, current ordered connection identities, selected-connection state and team integration policy. A changed selection returns 409 cursor_stale and requests a fresh list.
• Re-check policy/connection/current membership after the GitHub request on every page, including pages with no matching repositories. Reusing a stale cursor never silently changes accounts.
• Keep the existing GitHub App, connection/token owner, auth, one-upstream-page limit, and response shape. Legacy index cursors return 400 and require a fresh list; clients already handle request.invalid for malformed cursors.

Regression

The first commit (dcbc9b820e3e97e558c50e7d8d2c3b76e26a4cd1) adds backend/apps/api/test/github-repos-cursor.test.ts: same-connection next page, next exact installation, changed order/revoke/insert, different principal/query/policy, invalid/oversized legacy cursors, and no connections. It initially fails to import the missing helper. The implementation is the next commit. Run cd backend && bun --filter @cmux/api test -- github-repos-cursor (or the matching backend Vitest invocation).

Observed / Not run

Observed in #27025 head cbbf1f3ca66063543866aa4bcdc4194686e7951e: the repo cursor used a numeric position in Object.values(state.connections); revocation/reordering can select another account mid-pagination. This PR is stacked on #27025 for an isolated review and changes two files. Live provider calls, deployment and account mutations were untouched. Local backend Vitest/TS typecheck are unavailable here; CI checks are the verification gate.

Related: cmux-platform issue #48. Stable account-aware resource-selection projection across the platform API remains with #48’s existing owner lane.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Fixes GitHub repository pagination so an interrupted listing can no longer silently switch to a different connection when connections are added, revoked, reordered, or rescoped.

• Replaces index-based {installation, page} cursors with v2 opaque cursors that carry the exact selected connectionId, page, and a fence hash of the principal, query, policy, and ordered connection list.
• Returns 409 cursor_stale when the fence changes, and 400 request.invalid for legacy or malformed cursors; clients already handle request.invalid.
• Re-checks policy and connection membership after every GitHub request, including pages with no matching repositories.
• Adds integration coverage that calls the authorized ConnectionDO paging method directly (the public route stays off in the test deployment) and verifies a stale cursor is refused before any further upstream call.

^{Written for commit f64da62. Summary will update on new commits.}

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

[teamleaderleo]

Review (codex gpt-6-astra high, next-review): BLOCK at f64da62

• [P1] backend/apps/api/src/integrations/github-token-route.ts:117 — The new write check requires mutate-own for every install, including VMs authorized through vm-self and the machine gate. Valid VM requests for contents: write or pull_requests: write now return 403 on both token endpoints, breaking GitHub push/PR workflows. Preserve the VM authorization path and add a VM write-token regression test.

[teamleaderleo]

Orphaned: no activity for 21 h, and no lane holds a lease on it. The orphan sweep could not merge feat-cmux-next in: conflicts in backend/apps/api/src/connection-do.ts, backend/apps/api/src/integrations/github-token-route.ts, backend/apps/api/src/integrations/github-tokens.ts. Listed for a lane to resolve.

[teamleaderleo]

Owned by an agent session · session

[teamleaderleo]

Closing as superseded: #27025 (merged) binds the repository cursor to the caller's connection and query and filters each page by current policy (the #48 account-switching case), and #27828 (merged) covers write-token grants. This branch is about 2,200 commits behind with conflicts in all three integration files, and its exact-head review BLOCKed (VM write tokens refused). No owner session is recorded on it. Reopen on current base if a gap remains.