fix: security release 2026-08-12 - #4735
Conversation
…l URLs reaching the agent worker (#95)
![trigger-release-bot[bot]](https://github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
|
WalkthroughThe changes add session-bound Slack OAuth state management, invite and authentication rate limits, dashboard-agent metadata and repository snapshot validation, environment-scoped waitpoint authorization, and TRQL rejection of 🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 8
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
apps/webapp/test/dashboardAgentClientMetadata.test.ts (1)
3-55: 📐 Maintainability & Code Quality | 🟠 Major | 🏗️ Heavy liftReplace mocked route tests with testcontainer coverage.
These changes test security boundaries through module mocks. This violates the repository test policy.
apps/webapp/test/dashboardAgentClientMetadata.test.tsalso imports the dashboard-agent route, which indirectly imports~/env.server.
apps/webapp/test/dashboardAgentClientMetadata.test.ts#L3-L55: Removevi.mock-based route setup. Pass configuration through options and use testcontainers for required services.apps/webapp/test/dashboardAgentCreateChatOrdering.test.ts#L137-L170: Test metadata persistence and session startup through testcontainer-backed dependencies instead of mock call arguments.As per coding guidelines, “We use vitest exclusively. Never mock anything - use testcontainers instead.” As per coding guidelines, “Test files must not import
app/env.server.ts; pass configuration as options instead.”Source: Coding guidelines
🧹 Nitpick comments (1)
internal-packages/tsql/src/query/security.test.ts (1)
213-215: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winAssert the
QueryErrortype as well as the message.A generic
Errorwith the same message would pass these tests. Assert that compilation throwsQueryError, defined ininternal-packages/tsql/src/query/errors.ts, and retain the message assertion.
🔇 Additional comments (25)
apps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.waitpoints.$waitpointFriendlyId.complete/route.tsx (1)
82-116: LGTM!Also applies to: 174-180
apps/webapp/test/waitpointCompleteRouteReplicaLag.guard.test.ts (1)
2-4: LGTM!Also applies to: 67-68, 150-151, 203-204
apps/webapp/app/services/inviteRateLimiter.server.ts (1)
19-73: LGTM!apps/webapp/app/services/mfa/multiFactorAuthentication.server.ts (1)
11-11: LGTM!Also applies to: 52-56, 180-184
apps/webapp/app/routes/_app.orgs.$organizationSlug.invite/route.tsx (1)
31-31: LGTM!Also applies to: 180-195
apps/webapp/app/routes/api.v1.orgs.$orgParam.invites.ts (1)
6-6: LGTM!Also applies to: 61-80
apps/webapp/app/routes/invite-resend.tsx (1)
6-7: LGTM!Also applies to: 54-70
apps/webapp/app/routes/login.magic/route.tsx (1)
32-32: LGTM!apps/webapp/app/routes/resources.account.mfa.setup/route.tsx (1)
12-12: LGTM!Also applies to: 141-148
apps/webapp/app/models/slackOAuthState.server.ts (2)
27-37: LGTM!Also applies to: 39-58, 60-86
120-139: LGTM!apps/webapp/test/slackOAuthState.test.ts (1)
29-205: LGTM!apps/webapp/app/models/orgIntegration.server.ts (1)
12-20: LGTM!Also applies to: 142-196
apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.alerts.new.connect-to-slack.ts (1)
47-55: LGTM!apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.errors.connect-to-slack.ts (1)
42-48: LGTM!apps/webapp/app/routes/integrations.$serviceName.callback.ts (1)
47-77: LGTM!apps/webapp/test/slackOAuthCallback.test.ts (1)
1-87: LGTM!apps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.dashboard-agent.ts (1)
603-621: LGTM!apps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.dashboard-agent.in.$.ts (1)
45-47: LGTM!internal-packages/dashboard-agent/src/agent-runtime.ts (1)
274-285: LGTM!Also applies to: 327-327
internal-packages/dashboard-agent/src/dashboard-agent.test.ts (1)
1130-1158: LGTM!internal-packages/dashboard-agent/src/repo-tools.test.ts (1)
197-216: LGTM!internal-packages/tsql/src/query/printer.ts (2)
432-438: 🩺 Stability & Availability | ⚡ Quick win
⚠️ Unverified finding
Sandbox verification was unavailable.Restore visitor state when rejecting
PREWHERE.
visit()removes the node fromstackand decrementsindentLevelonly after the visitor returns. This throw exits before cleanup. If aClickHousePrinterinstance is reused after a rejected query, the nextprint()can classify the query incorrectly and render invalid SQL. Move cleanup intofinally, or confirm that failed printer instances are always discarded and add a reuse regression test.
511-512: LGTM!.server-changes/reject-prewhere-in-trql.md (1)
1-6: LGTM!
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 3dc2371f-ee18-44ba-97a0-acfb451f3dbc
📒 Files selected for processing (30)
.server-changes/reject-benchmarking-webhook-addresses.md.server-changes/reject-prewhere-in-trql.mdapps/webapp/app/models/orgIntegration.server.tsapps/webapp/app/models/slackOAuthState.server.tsapps/webapp/app/routes/_app.orgs.$organizationSlug.invite/route.tsxapps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.alerts.new.connect-to-slack.tsapps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.errors.connect-to-slack.tsapps/webapp/app/routes/api.v1.orgs.$orgParam.invites.tsapps/webapp/app/routes/integrations.$serviceName.callback.tsapps/webapp/app/routes/invite-resend.tsxapps/webapp/app/routes/login.magic/route.tsxapps/webapp/app/routes/resources.account.mfa.setup/route.tsxapps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.dashboard-agent.in.$.tsapps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.dashboard-agent.tsapps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.waitpoints.$waitpointFriendlyId.complete/route.tsxapps/webapp/app/services/inviteRateLimiter.server.tsapps/webapp/app/services/magicLinkRateLimiter.server.tsapps/webapp/app/services/mfa/multiFactorAuthentication.server.tsapps/webapp/test/dashboardAgentClientMetadata.test.tsapps/webapp/test/dashboardAgentCreateChatOrdering.test.tsapps/webapp/test/slackOAuthCallback.test.tsapps/webapp/test/slackOAuthState.test.tsapps/webapp/test/waitpointCompleteRouteAuthorization.test.tsapps/webapp/test/waitpointCompleteRouteReplicaLag.guard.test.tsinternal-packages/dashboard-agent/src/agent-runtime.tsinternal-packages/dashboard-agent/src/dashboard-agent.test.tsinternal-packages/dashboard-agent/src/repo-tools.test.tsinternal-packages/dashboard-agent/src/repo-tools.tsinternal-packages/tsql/src/query/printer.tsinternal-packages/tsql/src/query/security.test.ts
Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.
📜 Review details
⏰ Context from checks skipped due to timeout. (35)
- GitHub Check: report
- GitHub Check: webapp / 🧪 Unit Tests: Webapp (23, 24)
- GitHub Check: webapp / 🧪 Unit Tests: Webapp (16, 24)
- GitHub Check: webapp / 🧪 Unit Tests: Webapp (4, 24)
- GitHub Check: webapp / 🧪 Unit Tests: Webapp (9, 24)
- GitHub Check: webapp / 🧪 Unit Tests: Webapp (24, 24)
- GitHub Check: webapp / 🧪 Unit Tests: Webapp (11, 24)
- GitHub Check: webapp / 🧪 Unit Tests: Webapp (7, 24)
- GitHub Check: webapp / 🧪 Unit Tests: Webapp (2, 24)
- GitHub Check: webapp / 🧪 Unit Tests: Webapp (21, 24)
- GitHub Check: webapp / 🧪 Unit Tests: Webapp (22, 24)
- GitHub Check: webapp / 🧪 Unit Tests: Webapp (6, 24)
- GitHub Check: webapp / 🧪 Unit Tests: Webapp (18, 24)
- GitHub Check: webapp / 🧪 Unit Tests: Webapp (17, 24)
- GitHub Check: webapp / 🧪 Unit Tests: Webapp (19, 24)
- GitHub Check: webapp / 🧪 Unit Tests: Webapp (20, 24)
- GitHub Check: webapp / 🧪 Unit Tests: Webapp (1, 24)
- GitHub Check: webapp / 🧪 Unit Tests: Webapp (12, 24)
- GitHub Check: webapp / 🧪 Unit Tests: Webapp (13, 24)
- GitHub Check: webapp / 🧪 Unit Tests: Webapp (15, 24)
- GitHub Check: webapp / 🧪 Unit Tests: Webapp (8, 24)
- GitHub Check: webapp / 🧪 Unit Tests: Webapp (14, 24)
- GitHub Check: webapp / 🧪 Unit Tests: Webapp (10, 24)
- GitHub Check: webapp / 🧪 Unit Tests: Webapp (5, 24)
- GitHub Check: webapp / 🧪 Unit Tests: Webapp (3, 24)
- GitHub Check: obsmap / 🧪 Unit Tests: Observability Map
- GitHub Check: internal / 🧪 Unit Tests: Internal
- GitHub Check: runops-guard / runops-guard
- GitHub Check: typecheck / typecheck
- GitHub Check: e2e-webapp / 🧪 E2E Tests: Webapp (1, 2)
- GitHub Check: fk-cascade-guard / fk-cascade-guard
- GitHub Check: e2e-webapp / 🧪 E2E Tests: Webapp (2, 2)
- GitHub Check: code-quality / code-quality
- GitHub Check: 🛡️ E2E Auth Tests (full)
- GitHub Check: Build and publish previews
🧰 Additional context used
📓 Path-based instructions (12)
**/*.{ts,tsx}
📄 CodeRabbit inference engine (.github/copilot-instructions.md)
**/*.{ts,tsx}: Use types over interfaces for TypeScript
Avoid using enums; prefer string unions or const objects instead
**/*.{ts,tsx}: Prefer static imports over dynamic imports. Only use dynamicimport()when:
- Circular dependencies cannot be resolved otherwise
- Code splitting is genuinely needed for performance
- The module must be loaded conditionally at runtime
Files:
apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.errors.connect-to-slack.tsapps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.alerts.new.connect-to-slack.tsapps/webapp/app/services/mfa/multiFactorAuthentication.server.tsapps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.dashboard-agent.in.$.tsapps/webapp/app/routes/resources.account.mfa.setup/route.tsxapps/webapp/app/routes/login.magic/route.tsxapps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.dashboard-agent.tsapps/webapp/app/routes/_app.orgs.$organizationSlug.invite/route.tsxapps/webapp/app/routes/api.v1.orgs.$orgParam.invites.tsapps/webapp/app/services/magicLinkRateLimiter.server.tsapps/webapp/test/slackOAuthCallback.test.tsapps/webapp/app/services/inviteRateLimiter.server.tsapps/webapp/test/dashboardAgentCreateChatOrdering.test.tsinternal-packages/dashboard-agent/src/dashboard-agent.test.tsinternal-packages/tsql/src/query/security.test.tsapps/webapp/test/slackOAuthState.test.tsinternal-packages/dashboard-agent/src/agent-runtime.tsapps/webapp/app/routes/integrations.$serviceName.callback.tsinternal-packages/tsql/src/query/printer.tsinternal-packages/dashboard-agent/src/repo-tools.tsapps/webapp/test/dashboardAgentClientMetadata.test.tsinternal-packages/dashboard-agent/src/repo-tools.test.tsapps/webapp/test/waitpointCompleteRouteAuthorization.test.tsapps/webapp/test/waitpointCompleteRouteReplicaLag.guard.test.tsapps/webapp/app/routes/invite-resend.tsxapps/webapp/app/models/orgIntegration.server.tsapps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.waitpoints.$waitpointFriendlyId.complete/route.tsxapps/webapp/app/models/slackOAuthState.server.ts
{packages/core,apps/webapp}/**/*.{ts,tsx}
📄 CodeRabbit inference engine (.github/copilot-instructions.md)
Use zod for validation in packages/core and apps/webapp
Files:
apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.errors.connect-to-slack.tsapps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.alerts.new.connect-to-slack.tsapps/webapp/app/services/mfa/multiFactorAuthentication.server.tsapps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.dashboard-agent.in.$.tsapps/webapp/app/routes/resources.account.mfa.setup/route.tsxapps/webapp/app/routes/login.magic/route.tsxapps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.dashboard-agent.tsapps/webapp/app/routes/_app.orgs.$organizationSlug.invite/route.tsxapps/webapp/app/routes/api.v1.orgs.$orgParam.invites.tsapps/webapp/app/services/magicLinkRateLimiter.server.tsapps/webapp/test/slackOAuthCallback.test.tsapps/webapp/app/services/inviteRateLimiter.server.tsapps/webapp/test/dashboardAgentCreateChatOrdering.test.tsapps/webapp/test/slackOAuthState.test.tsapps/webapp/app/routes/integrations.$serviceName.callback.tsapps/webapp/test/dashboardAgentClientMetadata.test.tsapps/webapp/test/waitpointCompleteRouteAuthorization.test.tsapps/webapp/test/waitpointCompleteRouteReplicaLag.guard.test.tsapps/webapp/app/routes/invite-resend.tsxapps/webapp/app/models/orgIntegration.server.tsapps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.waitpoints.$waitpointFriendlyId.complete/route.tsxapps/webapp/app/models/slackOAuthState.server.ts
**/*.{ts,tsx,js,jsx}
📄 CodeRabbit inference engine (.github/copilot-instructions.md)
Use function declarations instead of default exports
Files:
apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.errors.connect-to-slack.tsapps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.alerts.new.connect-to-slack.tsapps/webapp/app/services/mfa/multiFactorAuthentication.server.tsapps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.dashboard-agent.in.$.tsapps/webapp/app/routes/resources.account.mfa.setup/route.tsxapps/webapp/app/routes/login.magic/route.tsxapps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.dashboard-agent.tsapps/webapp/app/routes/_app.orgs.$organizationSlug.invite/route.tsxapps/webapp/app/routes/api.v1.orgs.$orgParam.invites.tsapps/webapp/app/services/magicLinkRateLimiter.server.tsapps/webapp/test/slackOAuthCallback.test.tsapps/webapp/app/services/inviteRateLimiter.server.tsapps/webapp/test/dashboardAgentCreateChatOrdering.test.tsinternal-packages/dashboard-agent/src/dashboard-agent.test.tsinternal-packages/tsql/src/query/security.test.tsapps/webapp/test/slackOAuthState.test.tsinternal-packages/dashboard-agent/src/agent-runtime.tsapps/webapp/app/routes/integrations.$serviceName.callback.tsinternal-packages/tsql/src/query/printer.tsinternal-packages/dashboard-agent/src/repo-tools.tsapps/webapp/test/dashboardAgentClientMetadata.test.tsinternal-packages/dashboard-agent/src/repo-tools.test.tsapps/webapp/test/waitpointCompleteRouteAuthorization.test.tsapps/webapp/test/waitpointCompleteRouteReplicaLag.guard.test.tsapps/webapp/app/routes/invite-resend.tsxapps/webapp/app/models/orgIntegration.server.tsapps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.waitpoints.$waitpointFriendlyId.complete/route.tsxapps/webapp/app/models/slackOAuthState.server.ts
**/*.ts
📄 CodeRabbit inference engine (.cursor/rules/otel-metrics.mdc)
**/*.ts: When creating or editing OTEL metrics (counters, histograms, gauges), ensure metric attributes have low cardinality by using only enums, booleans, bounded error codes, or bounded shard IDs
Do not use high-cardinality attributes in OTEL metrics such as UUIDs/IDs (envId, userId, runId, projectId, organizationId), unbounded integers (itemCount, batchSize, retryCount), timestamps (createdAt, startTime), or free-form strings (errorMessage, taskName, queueName)
When exporting OTEL metrics via OTLP to Prometheus, be aware that the exporter automatically adds unit suffixes to metric names (e.g., 'my_duration_ms' becomes 'my_duration_ms_milliseconds', 'my_counter' becomes 'my_counter_total'). Account for these transformations when writing Grafana dashboards or Prometheus queries
Files:
apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.errors.connect-to-slack.tsapps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.alerts.new.connect-to-slack.tsapps/webapp/app/services/mfa/multiFactorAuthentication.server.tsapps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.dashboard-agent.in.$.tsapps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.dashboard-agent.tsapps/webapp/app/routes/api.v1.orgs.$orgParam.invites.tsapps/webapp/app/services/magicLinkRateLimiter.server.tsapps/webapp/test/slackOAuthCallback.test.tsapps/webapp/app/services/inviteRateLimiter.server.tsapps/webapp/test/dashboardAgentCreateChatOrdering.test.tsinternal-packages/dashboard-agent/src/dashboard-agent.test.tsinternal-packages/tsql/src/query/security.test.tsapps/webapp/test/slackOAuthState.test.tsinternal-packages/dashboard-agent/src/agent-runtime.tsapps/webapp/app/routes/integrations.$serviceName.callback.tsinternal-packages/tsql/src/query/printer.tsinternal-packages/dashboard-agent/src/repo-tools.tsapps/webapp/test/dashboardAgentClientMetadata.test.tsinternal-packages/dashboard-agent/src/repo-tools.test.tsapps/webapp/test/waitpointCompleteRouteAuthorization.test.tsapps/webapp/test/waitpointCompleteRouteReplicaLag.guard.test.tsapps/webapp/app/models/orgIntegration.server.tsapps/webapp/app/models/slackOAuthState.server.ts
apps/webapp/**/*.{ts,tsx}
📄 CodeRabbit inference engine (.cursor/rules/webapp.mdc)
apps/webapp/**/*.{ts,tsx}: Access environment variables through theenvexport ofenv.server.tsinstead of directly accessingprocess.env
Use subpath exports from@trigger.dev/corepackage instead of importing from the root@trigger.dev/corepath
Files:
apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.errors.connect-to-slack.tsapps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.alerts.new.connect-to-slack.tsapps/webapp/app/services/mfa/multiFactorAuthentication.server.tsapps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.dashboard-agent.in.$.tsapps/webapp/app/routes/resources.account.mfa.setup/route.tsxapps/webapp/app/routes/login.magic/route.tsxapps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.dashboard-agent.tsapps/webapp/app/routes/_app.orgs.$organizationSlug.invite/route.tsxapps/webapp/app/routes/api.v1.orgs.$orgParam.invites.tsapps/webapp/app/services/magicLinkRateLimiter.server.tsapps/webapp/test/slackOAuthCallback.test.tsapps/webapp/app/services/inviteRateLimiter.server.tsapps/webapp/test/dashboardAgentCreateChatOrdering.test.tsapps/webapp/test/slackOAuthState.test.tsapps/webapp/app/routes/integrations.$serviceName.callback.tsapps/webapp/test/dashboardAgentClientMetadata.test.tsapps/webapp/test/waitpointCompleteRouteAuthorization.test.tsapps/webapp/test/waitpointCompleteRouteReplicaLag.guard.test.tsapps/webapp/app/routes/invite-resend.tsxapps/webapp/app/models/orgIntegration.server.tsapps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.waitpoints.$waitpointFriendlyId.complete/route.tsxapps/webapp/app/models/slackOAuthState.server.ts
apps/webapp/app/**/*.{ts,tsx}
📄 CodeRabbit inference engine (apps/webapp/CLAUDE.md)
apps/webapp/app/**/*.{ts,tsx}: For dashboard changes, visually verify the running Remix app with Chrome DevTools MCP, using snapshots, screenshots, interaction, and console-message checks as appropriate.
UseuseCallbackanduseMemoonly for context provider values, expensive derived data used as a dependency, or stable references required by dependency arrays; do not wrap ordinary event handlers or trivial computations.
Use named constants for sentinel or placeholder values instead of scattering raw string literals across comparisons.
Files:
apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.errors.connect-to-slack.tsapps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.alerts.new.connect-to-slack.tsapps/webapp/app/services/mfa/multiFactorAuthentication.server.tsapps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.dashboard-agent.in.$.tsapps/webapp/app/routes/resources.account.mfa.setup/route.tsxapps/webapp/app/routes/login.magic/route.tsxapps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.dashboard-agent.tsapps/webapp/app/routes/_app.orgs.$organizationSlug.invite/route.tsxapps/webapp/app/routes/api.v1.orgs.$orgParam.invites.tsapps/webapp/app/services/magicLinkRateLimiter.server.tsapps/webapp/app/services/inviteRateLimiter.server.tsapps/webapp/app/routes/integrations.$serviceName.callback.tsapps/webapp/app/routes/invite-resend.tsxapps/webapp/app/models/orgIntegration.server.tsapps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.waitpoints.$waitpointFriendlyId.complete/route.tsxapps/webapp/app/models/slackOAuthState.server.ts
apps/webapp/app/routes/**/*.ts
📄 CodeRabbit inference engine (apps/webapp/CLAUDE.md)
apps/webapp/app/routes/**/*.ts: Use Remix flat-file route conventions with dot-separated segments; for example,api.v1.tasks.$taskId.trigger.tsmaps to/api/v1/tasks/:taskId/trigger.
PAT-authenticated API routes must resolve their target organization or project within the caller's membership scope, using a membership filter or a helper such asfindProjectByReforresolveOrganizationForApiUser; RBAC authorization alone is insufficient.
Files:
apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.errors.connect-to-slack.tsapps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.alerts.new.connect-to-slack.tsapps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.dashboard-agent.in.$.tsapps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.dashboard-agent.tsapps/webapp/app/routes/api.v1.orgs.$orgParam.invites.tsapps/webapp/app/routes/integrations.$serviceName.callback.ts
apps/webapp/app/**/*.ts
📄 CodeRabbit inference engine (apps/webapp/CLAUDE.md)
apps/webapp/app/**/*.ts: Never userequest.signalto detect client disconnects. UsegetRequestAbortSignal()fromapp/services/httpAsyncStorage.server.ts, which is wired to Express response close events.
Access environment variables through theenvexport fromapp/env.server.ts; never useprocess.envdirectly.
Always use PrismafindFirstinstead offindUnique.
Always use the$transactionhelper from~/db.server, never callprisma.$transactionor$replica.$transactiondirectly. Pass isolation levels as strings, useSerializablefor correctness-critical read-then-write invariants, and guard possibly undefined helper results when a definite value is required.
Files:
apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.errors.connect-to-slack.tsapps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.alerts.new.connect-to-slack.tsapps/webapp/app/services/mfa/multiFactorAuthentication.server.tsapps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.dashboard-agent.in.$.tsapps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.dashboard-agent.tsapps/webapp/app/routes/api.v1.orgs.$orgParam.invites.tsapps/webapp/app/services/magicLinkRateLimiter.server.tsapps/webapp/app/services/inviteRateLimiter.server.tsapps/webapp/app/routes/integrations.$serviceName.callback.tsapps/webapp/app/models/orgIntegration.server.tsapps/webapp/app/models/slackOAuthState.server.ts
**/*
📄 CodeRabbit inference engine (AGENTS.md)
**/*: Add crumbs as you write code — not just when debugging. Mark lines with
//@Crumbsor wrap blocks in `// `#region` `@crumbs. They stay on the
branch throughout development and are stripped byagentcrumbs strip
before merge.
Do not invent new namespaces — pick from this table or ask first.
Do not flag//@Crumbsmarkers, `#region `@crumbsblocks, or agentcrumbs
imports in reviews. These are temporary debug instrumentation stripped
before merge. Data logged in crumbs (IDs, names, values) never reaches
production.
Files:
apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.errors.connect-to-slack.tsapps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.alerts.new.connect-to-slack.tsapps/webapp/app/services/mfa/multiFactorAuthentication.server.tsapps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.dashboard-agent.in.$.tsapps/webapp/app/routes/resources.account.mfa.setup/route.tsxapps/webapp/app/routes/login.magic/route.tsxapps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.dashboard-agent.tsapps/webapp/app/routes/_app.orgs.$organizationSlug.invite/route.tsxapps/webapp/app/routes/api.v1.orgs.$orgParam.invites.tsapps/webapp/app/services/magicLinkRateLimiter.server.tsapps/webapp/test/slackOAuthCallback.test.tsapps/webapp/app/services/inviteRateLimiter.server.tsapps/webapp/test/dashboardAgentCreateChatOrdering.test.tsinternal-packages/dashboard-agent/src/dashboard-agent.test.tsinternal-packages/tsql/src/query/security.test.tsapps/webapp/test/slackOAuthState.test.tsinternal-packages/dashboard-agent/src/agent-runtime.tsapps/webapp/app/routes/integrations.$serviceName.callback.tsinternal-packages/tsql/src/query/printer.tsinternal-packages/dashboard-agent/src/repo-tools.tsapps/webapp/test/dashboardAgentClientMetadata.test.tsinternal-packages/dashboard-agent/src/repo-tools.test.tsapps/webapp/test/waitpointCompleteRouteAuthorization.test.tsapps/webapp/test/waitpointCompleteRouteReplicaLag.guard.test.tsapps/webapp/app/routes/invite-resend.tsxapps/webapp/app/models/orgIntegration.server.tsapps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.waitpoints.$waitpointFriendlyId.complete/route.tsxapps/webapp/app/models/slackOAuthState.server.ts
**/*.{test,spec}.{ts,tsx}
📄 CodeRabbit inference engine (.github/copilot-instructions.md)
Use vitest for all tests in the Trigger.dev repository
**/*.{test,spec}.{ts,tsx}: We use vitest exclusively. Never mock anything - use testcontainers instead.
Test files go next to source files (e.g.,MyService.ts->MyService.test.ts).
Files:
apps/webapp/test/slackOAuthCallback.test.tsapps/webapp/test/dashboardAgentCreateChatOrdering.test.tsinternal-packages/dashboard-agent/src/dashboard-agent.test.tsinternal-packages/tsql/src/query/security.test.tsapps/webapp/test/slackOAuthState.test.tsapps/webapp/test/dashboardAgentClientMetadata.test.tsinternal-packages/dashboard-agent/src/repo-tools.test.tsapps/webapp/test/waitpointCompleteRouteAuthorization.test.tsapps/webapp/test/waitpointCompleteRouteReplicaLag.guard.test.ts
apps/webapp/**/*.test.{ts,tsx}
📄 CodeRabbit inference engine (.cursor/rules/webapp.mdc)
Do not import
env.server.tsdirectly or indirectly into test files; instead pass environment-dependent values through options/parameters to make code testable
Files:
apps/webapp/test/slackOAuthCallback.test.tsapps/webapp/test/dashboardAgentCreateChatOrdering.test.tsapps/webapp/test/slackOAuthState.test.tsapps/webapp/test/dashboardAgentClientMetadata.test.tsapps/webapp/test/waitpointCompleteRouteAuthorization.test.tsapps/webapp/test/waitpointCompleteRouteReplicaLag.guard.test.ts
apps/webapp/**/*.{test,spec}.{ts,tsx}
📄 CodeRabbit inference engine (apps/webapp/CLAUDE.md)
Test files must not import
app/env.server.ts; pass configuration as options instead.
Files:
apps/webapp/test/slackOAuthCallback.test.tsapps/webapp/test/dashboardAgentCreateChatOrdering.test.tsapps/webapp/test/slackOAuthState.test.tsapps/webapp/test/dashboardAgentClientMetadata.test.tsapps/webapp/test/waitpointCompleteRouteAuthorization.test.tsapps/webapp/test/waitpointCompleteRouteReplicaLag.guard.test.ts
🧠 Learnings (4)
📚 Learning: 2026-07-26T13:14:02.968Z
Learnt from: ericallam
Repo: triggerdotdev/trigger.dev PR: 4378
File: .server-changes/realtime-run-reads-from-primary.md:0-0
Timestamp: 2026-07-26T13:14:02.968Z
Learning: For files in the .server-changes directory, the body text is published verbatim as dashboard-facing user release notes. Write entries in terms of user-visible behavior (what users can do/see), and avoid implementation-oriented details such as environment-variable names, internal mechanisms, or configuration knobs. If you need to include operational/configuration specifics, put those details in the PR description instead of the .server-changes entry.
Applied to files:
.server-changes/reject-benchmarking-webhook-addresses.md.server-changes/reject-prewhere-in-trql.md
📚 Learning: 2026-05-18T14:40:02.173Z
Learnt from: ericallam
Repo: triggerdotdev/trigger.dev PR: 3658
File: packages/core/src/v3/realtimeStreams/manager.test.ts:1-147
Timestamp: 2026-05-18T14:40:02.173Z
Learning: In the triggerdotdev/trigger.dev repo, the policy “Never mock anything — use testcontainers instead” should only be enforced for integration tests that interact with real external services (e.g., Redis, Postgres) via actual infrastructure. For unit tests that exercise pure in-memory logic (e.g., cache semantics) it is OK to stub collaborators such as `ApiClient` using Vitest (`vi.fn()`) to assert call counts or control behavior. Do not flag `vi.fn()`-based `ApiClient` stubs in unit tests as violations of the testcontainers policy.
Applied to files:
apps/webapp/test/slackOAuthCallback.test.ts
📚 Learning: 2026-06-16T09:19:47.637Z
Learnt from: d-cs
Repo: triggerdotdev/trigger.dev PR: 3960
File: apps/webapp/test/prismaInfrastructureErrorCapture.test.ts:0-0
Timestamp: 2026-06-16T09:19:47.637Z
Learning: In this repo’s Vitest setup, `vitest.config.ts` uses `globals: true`, so identifiers like `vi`, `describe`, `it`, and `expect` are available as globals in Vitest test files. During code review, do not flag missing `vi`/`describe`/`it`/`expect` imports as a runtime error or correctness issue when they’re used in `*.test.ts/tsx` or `*.spec.ts/tsx` files. Explicit imports are still preferred for consistency, but they’re not required for runtime behavior.
Applied to files:
apps/webapp/test/dashboardAgentCreateChatOrdering.test.tsinternal-packages/dashboard-agent/src/dashboard-agent.test.tsapps/webapp/test/dashboardAgentClientMetadata.test.tsapps/webapp/test/waitpointCompleteRouteAuthorization.test.ts
📚 Learning: 2026-05-12T21:04:05.815Z
Learnt from: ericallam
Repo: triggerdotdev/trigger.dev PR: 3542
File: apps/webapp/app/components/sessions/v1/SessionStatus.tsx:1-3
Timestamp: 2026-05-12T21:04:05.815Z
Learning: In this Remix + TypeScript codebase, do not flag a server/client boundary violation when a file imports only types from a module matching `*.server`.
Specifically, it’s safe to import types using `import type { Foo } from "*.server"` or `import { type Foo } from "*.server"` because TypeScript erases type-only imports at compile time and they emit no JavaScript, so they won’t cross the Remix server/client bundle boundary.
Only raise the boundary concern for value imports (e.g., `import { Foo }` without `type`, or `import Foo`), since those produce JavaScript output.
Applied to files:
apps/webapp/app/models/orgIntegration.server.ts
🪛 ast-grep (0.45.1)
internal-packages/dashboard-agent/src/repo-tools.ts
[warning] Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: import { execFile } from "node:child_process";
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process-typescript)
[warning] Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: import { execFile } from "node:child_process";
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process-typescript)
[warning] Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: import { execFile } from "node:child_process";
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process-typescript)
internal-packages/dashboard-agent/src/repo-tools.test.ts
[warning] Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: import { execFileSync } from "node:child_process";
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process-typescript)
2 participants
Security release batch. Advisory details to be published with the release.