merge: integration/2026-06-11-pending-backlog into develop (#316, #253, upstream fixes, CI gates)

PR-equivalent merge performed via temporary branch-protection lift because
PR functionality is currently disabled platform-side on this fork (GitHub
returns 410 on all PR endpoints despite PRs working through #314). Protection
restored immediately after this push. Full CI-equivalent checks run locally.

Included work:
- fix/issue-316-provider-auth-errors (#316): map model-provider auth/billing
  failures to actionable chat messages instead of the generic 'Workspace
  setup failed'; all Sonnet review findings fixed (narrow auth matching,
  explicit HTTP 401/402 forms, tightened billing regex, negative tests).
- fix/issue-253-sidebar-offcanvas-collapse (#253): sessions sidebar switched
  from icon-rail to offcanvas collapse per issue spec; visible collapse +
  reopen controls; persisted state; dead icon-rail code removed; rail-actions
  contract tests added.
- chore/upstream-clean-fixes: upstream cherry-picks vercel-labs#878/#879/#886
  (stale sandbox head before broker commits, git fetch stderr handling,
  web-fetch tool approval gate — approval UI verified wired).
- claude/dev-pipeline-robustness: machine-enforced pipeline gates (additive
  CI build+guards jobs, production-smoke workflow, migration-safety and
  test-touch scripts, opt-in pre-push hook, pipeline-gates process doc,
  concurrent test-isolated runner).

Checks (CI-equivalent of required lint-and-typecheck, run at 52427ff):
git diff --check clean; bun run check 0 warnings/0 errors; bun run typecheck
4/4; bun run test:isolated 342/342 files pass; db:check migrations in sync.

Review: independent integration review (Opus) found no blocking issues across
the combined diff (31 files, +1571/-188); two non-blocking hardening items
were fixed in 52427ff. bun.lock unchanged.

Deploy notes: no migrations, no env/secret changes (production-smoke.yml
reuses existing VERCEL_AUTOMATION_BYPASS_SECRET). Rollback: revert this
merge commit.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: dennisonbertram

.githooks/pre-push

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+#
+# Fast local gate that runs before every `git push`.
+#
+# It catches the cheap, deterministic failures (whitespace conflict markers,
+# lint/format drift, type errors) before they burn a CI cycle or land in a
+# reviewer's lap. This is intentionally a *fast* subset of `bun run ci`; the
+# full test suite still runs in CI.
+#
+# Install:   bun run hooks:install   (or ./init.sh)
+# Bypass:    SKIP_HOOKS=1 git push   (or git push --no-verify)
+set -Eeuo pipefail
+
+if [[ "${SKIP_HOOKS:-0}" == "1" ]]; then
+  printf '\033[1;33mpre-push:\033[0m SKIP_HOOKS=1 set, skipping checks\n' >&2
+  exit 0
+fi
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT_DIR"
+
+step() {
+  printf '\033[1;34mpre-push:\033[0m %s\n' "$*" >&2
+}
+
+fail() {
+  printf '\033[1;31mpre-push failed:\033[0m %s\n' "$*" >&2
+  printf 'Fix the issue, or bypass with: SKIP_HOOKS=1 git push\n' >&2
+  exit 1
+}
+
+step "git diff --check (whitespace / merge markers)"
+git diff --check || fail "git diff --check found whitespace or conflict-marker errors"
+
+step "bun run check (lint + format)"
+bun run check || fail "lint/format check failed (try: bun run fix)"
+
+step "bun run typecheck"
+bun run typecheck || fail "typecheck failed"
+
+printf '\033[1;32mpre-push:\033[0m checks passed\n' >&2

.github/CODEOWNERS

@@ -0,0 +1,43 @@
+# CODEOWNERS for fork-open-agents
+#
+# This file documents the high-risk surfaces named in the Production Release
+# Runbook (auth, ownership, secrets, billing, inference, GitHub App, sandbox,
+# workflows, migrations). Changes to these paths warrant extra scrutiny.
+#
+# Today this is a solo project, so a single owner is listed. Once a second
+# regular reviewer exists, enable "Require review from Code Owners" in branch
+# protection so these paths automatically request that reviewer.
+
+# Default owner for everything not matched below.
+*                                   @dennisonbertram
+
+# --- High-risk surfaces ------------------------------------------------------
+
+# Auth / OAuth / sessions
+/apps/web/lib/auth/                 @dennisonbertram
+
+# Database schema and migrations (irreversible / data-loss risk)
+/apps/web/lib/db/schema.ts          @dennisonbertram
+/apps/web/lib/db/migrations/        @dennisonbertram
+/apps/web/lib/db/migrate.ts         @dennisonbertram
+
+# Inference / model wiring
+/apps/web/lib/inference/            @dennisonbertram
+/packages/agent/                    @dennisonbertram
+
+# GitHub App / webhook flows
+/apps/web/lib/github/               @dennisonbertram
+
+# Sandbox lifecycle and managed runtime
+/apps/web/lib/sandbox/              @dennisonbertram
+/apps/web/lib/managed-runtime/      @dennisonbertram
+/packages/sandbox/                  @dennisonbertram
+
+# Background agents
+/apps/web/lib/background-agents/    @dennisonbertram
+
+# CI / deploy / pipeline configuration
+/.github/                           @dennisonbertram
+/turbo.json                         @dennisonbertram
+/init.sh                            @dennisonbertram
+/scripts/                           @dennisonbertram

.github/workflows/ci.yml

@@ -41,3 +41,80 @@ jobs:
 
       - name: DB Check
         run: bun run --cwd apps/web db:check
+
+  # Compiles the Next.js app the same way Vercel does. Typecheck does not catch
+  # RSC/"use client" boundary errors, route export shape, or bundler failures;
+  # without this job those only surface on the production deploy from `main`.
+  build:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.event.pull_request.head.sha }}
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: "1.2.14"
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      # Placeholder env so `next build` can compile without a live database.
+      # This is a compile/bundle check, not an env-validation check.
+      - name: Build (next build)
+        run: bun run --cwd apps/web build:ci
+        env:
+          POSTGRES_URL: postgres://user:pass@localhost:5432/db
+          BETTER_AUTH_SECRET: ci_placeholder_secret_at_least_32_chars_long
+          ENCRYPTION_KEY: ci_placeholder_secret_at_least_32_chars_long
+          JWE_SECRET: ci_placeholder_secret_at_least_32_chars_long
+          GITHUB_CLIENT_SECRET: ci-placeholder
+          VERCEL_APP_CLIENT_SECRET: ci-placeholder
+          NEXT_PUBLIC_GITHUB_CLIENT_ID: ci-placeholder
+          NEXT_PUBLIC_VERCEL_APP_CLIENT_ID: ci-placeholder
+          NEXT_PUBLIC_AUTH_PROVIDERS: vercel
+          NEXT_TELEMETRY_DISABLED: "1"
+
+  # PR-only guardrails: enforce the migration rollback rule and surface
+  # behavior changes that ship without tests. test-touch warns by default; set
+  # STRICT_TEST_TOUCH=1 here to make it blocking once desired.
+  guards:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 0
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: "1.2.14"
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Fetch base ref
+        run: git fetch --no-tags --depth=1 origin "$BASE_REF:refs/remotes/origin/$BASE_REF"
+        env:
+          BASE_REF: ${{ github.base_ref }}
+
+      - name: Migration safety
+        run: bun run check:migration-safety
+        env:
+          BASE_REF: origin/${{ github.base_ref }}
+
+      - name: Test-touch guard
+        run: bun run check:test-touch
+        env:
+          BASE_REF: origin/${{ github.base_ref }}

.github/workflows/production-smoke.yml

@@ -0,0 +1,49 @@
+name: Production Smoke
+
+# Closes the gap where preview-smoke.yml explicitly skips production: this runs
+# the same smoke checks against a production deployment as soon as Vercel
+# reports it succeeded. A failure here turns the commit's checks red and pages
+# whoever is watching, instead of relying on a human to remember to smoke prod.
+#
+# This does NOT auto-roll-back. See docs/process/production-release-runbook.md
+# for the manual `vercel rollback` path when this check fails.
+
+on:
+  deployment_status:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.deployment_status.target_url }}
+  cancel-in-progress: true
+
+jobs:
+  production-smoke:
+    if: >-
+      github.event.deployment_status.state == 'success' &&
+      github.event.deployment_status.target_url != '' &&
+      (github.event.deployment.environment == 'Production' ||
+       github.event.deployment.environment == 'production')
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: "1.2.14"
+
+      - name: Run production smoke
+        env:
+          DEPLOYMENT_URL: ${{ github.event.deployment_status.target_url }}
+          VERCEL_AUTOMATION_BYPASS_SECRET: ${{ secrets.VERCEL_AUTOMATION_BYPASS_SECRET }}
+        run: bun run --cwd apps/web preview:smoke
+
+      - name: Rollback reminder on failure
+        if: failure()
+        run: |
+          echo "::error::Production smoke failed for ${DEPLOYMENT_URL}." >&2
+          echo "::error::Roll back first, debug second: \`vercel rollback\` (see production-release-runbook.md)." >&2
+        env:
+          DEPLOYMENT_URL: ${{ github.event.deployment_status.target_url }}

apps/web/app/sessions/sessions-route-shell.tsx

@@ -1,6 +1,6 @@
 "use client";
 
-import { X } from "lucide-react";
+import { PanelLeft, X } from "lucide-react";
 import { useParams, usePathname, useRouter } from "next/navigation";
 import type { CSSProperties, ReactNode } from "react";
 import {
@@ -22,8 +22,13 @@ import {
   SidebarContent,
   SidebarInset,
   SidebarProvider,
-  SidebarRail,
+  useSidebar,
 } from "@/components/ui/sidebar";
+import {
+  Tooltip,
+  TooltipContent,
+  TooltipTrigger,
+} from "@/components/ui/tooltip";
 import { useBackgroundChatNotifications } from "@/hooks/use-background-chat-notifications";
 import { useSessions, type SessionWithUnread } from "@/hooks/use-sessions";
 import { useUserPreferences } from "@/hooks/use-user-preferences";
@@ -51,7 +56,12 @@ const RouteContentShell = memo(function RouteContentShell({
 }: {
   children: ReactNode;
 }) {
+  const { state, isMobile, openMobile, toggleSidebar } = useSidebar();
   const { target, closeWorkspaceSettings } = useWorkspaceSettings();
+  // The sidebar uses offcanvas collapse: it slides fully off-screen when
+  // collapsed, leaving nothing visible to reopen it with.  Surface a
+  // persistent "Open panel" button in the content area whenever it is hidden.
+  const sidebarHidden = isMobile ? !openMobile : state === "collapsed";
 
   useEffect(() => {
     if (!target) {
@@ -68,6 +78,25 @@ const RouteContentShell = memo(function RouteContentShell({
 
   return (
     <SidebarInset className="relative flex min-w-0 flex-1 flex-col overflow-hidden">
+      {sidebarHidden ? (
+        <Tooltip>
+          <TooltipTrigger asChild>
+            <Button
+              type="button"
+              variant="outline"
+              size="icon"
+              onClick={toggleSidebar}
+              className="absolute left-2.5 top-2.5 z-30 h-8 w-8 bg-background/80 shadow-sm backdrop-blur"
+              aria-label="Open panel"
+            >
+              <PanelLeft className="h-4 w-4" />
+            </Button>
+          </TooltipTrigger>
+          <TooltipContent side="right" sideOffset={4}>
+            Open panel
+          </TooltipContent>
+        </Tooltip>
+      ) : null}
       {children}
       {target ? (
         <div
@@ -363,8 +392,7 @@ export function SessionsRouteShell({
             } as CSSProperties
           }
         >
-          <Sidebar collapsible="icon" className="border-r border-border">
-            <SidebarRail />
+          <Sidebar collapsible="offcanvas" className="border-r border-border">
             <SidebarContent className="bg-muted/20">
               <InboxSidebar
                 sessions={sessions}