watchdog-no
diff --git a/‎.github/workflows/terraform.yml‎
Lines changed: 4 additions & 0 deletions b/‎.github/workflows/terraform.yml‎
Lines changed: 4 additions & 0 deletions
diff --git a/‎docs/GETTING_STARTED.md‎
Lines changed: 54 additions & 43 deletions b/‎docs/GETTING_STARTED.md‎
Lines changed: 54 additions & 43 deletions
diff --git a/‎packages/control-plane/src/db/session-index.test.ts‎
Lines changed: 32 additions & 0 deletions b/‎packages/control-plane/src/db/session-index.test.ts‎
Lines changed: 32 additions & 0 deletions
diff --git a/‎packages/control-plane/src/db/session-index.ts‎
Lines changed: 15 additions & 1 deletion b/‎packages/control-plane/src/db/session-index.ts‎
Lines changed: 15 additions & 1 deletion
diff --git a/‎packages/control-plane/src/router.provider-identities.test.ts‎
Lines changed: 56 additions & 0 deletions b/‎packages/control-plane/src/router.provider-identities.test.ts‎
Lines changed: 56 additions & 0 deletions
@@ -189,6 +189,8 @@ jobs:
           TF_VAR_modal_token_id: ${{ secrets.MODAL_TOKEN_ID }}
           TF_VAR_modal_token_secret: ${{ secrets.MODAL_TOKEN_SECRET }}
           TF_VAR_modal_workspace: ${{ secrets.MODAL_WORKSPACE }}
+          TF_VAR_modal_environment: "${{ secrets.MODAL_ENVIRONMENT || 'main' }}"
+          TF_VAR_modal_environment_web_suffix: ${{ secrets.MODAL_ENVIRONMENT_WEB_SUFFIX }}
           TF_VAR_github_client_id: ${{ secrets.GH_OAUTH_CLIENT_ID }}
           TF_VAR_github_client_secret: ${{ secrets.GH_OAUTH_CLIENT_SECRET }}
           TF_VAR_github_app_id: ${{ secrets.GH_APP_ID }}
@@ -323,6 +325,8 @@ jobs:
           TF_VAR_modal_token_id: ${{ secrets.MODAL_TOKEN_ID }}
           TF_VAR_modal_token_secret: ${{ secrets.MODAL_TOKEN_SECRET }}
           TF_VAR_modal_workspace: ${{ secrets.MODAL_WORKSPACE }}
+          TF_VAR_modal_environment: "${{ secrets.MODAL_ENVIRONMENT || 'main' }}"
+          TF_VAR_modal_environment_web_suffix: ${{ secrets.MODAL_ENVIRONMENT_WEB_SUFFIX }}
           TF_VAR_github_client_id: ${{ secrets.GH_OAUTH_CLIENT_ID }}
           TF_VAR_github_client_secret: ${{ secrets.GH_OAUTH_CLIENT_SECRET }}
           TF_VAR_github_app_id: ${{ secrets.GH_APP_ID }}
 
@@ -150,7 +150,11 @@ Create an R2 API Token:
 1. Go to [Modal Settings](https://modal.com/settings)
 2. **Create a new API token**: Settings -> API Tokens -> New Token
 3. Note the **Token ID** and **Token Secret**
-4. Note your **Workspace name** (visible in your Modal dashboard URL)
+4. Note your **Workspace** and **Environment name** (visible in your Modal dashboard URL,
+   https://modal.com/apps/<modal_workspace>/<modal_environment>)
+5. Note the environment's **Web suffix** from Modal's environment settings. Use the normalized
+   lowercase suffix made of letters, digits, and dashes. Leave it empty for the environment whose
+   endpoints use `https://<workspace>--...modal.run`.
 
 ### Daytona
 
@@ -361,6 +365,8 @@ vercel_team_id              = "team_xxxxx"       # Your Vercel ID (even personal
 modal_token_id              = "your-modal-token-id"
 modal_token_secret          = "your-modal-token-secret"
 modal_workspace             = "your-modal-workspace"
+modal_environment           = "your-modal-environment"
+modal_environment_web_suffix = "your-modal-web-suffix" # Lowercase letters, digits, dashes; empty for https://workspace--... endpoints
 
 # Daytona (only required when sandbox_provider = "daytona")
 # daytona_api_url           = "https://app.daytona.io/api"
@@ -634,8 +640,11 @@ Or manually:
 # 1. Control Plane health check (replace {deployment_name} and YOUR-SUBDOMAIN)
 curl https://open-inspect-control-plane-{deployment_name}.YOUR-SUBDOMAIN.workers.dev/health
 
-# 2. Modal health check (replace YOUR-WORKSPACE)
-curl https://YOUR-WORKSPACE--open-inspect-api-health.modal.run
+# 2. Modal health check
+# Prefer the exact URL from terraform output verification_commands.
+# Manual form: https://<workspace>[-<modal_environment_web_suffix>]--open-inspect-api-health.modal.run
+MODAL_WORKSPACE_SLUG="YOUR-WORKSPACE" # or "YOUR-WORKSPACE-YOUR-MODAL-WEB-SUFFIX"
+curl https://${MODAL_WORKSPACE_SLUG}--open-inspect-api-health.modal.run
 
 # 3. Web app (should return 200)
 # Vercel:
@@ -659,46 +668,48 @@ Enable automatic deployments when you push to main by adding GitHub Secrets.
 
 Go to your fork's Settings → Secrets and variables → Actions, and add:
 
-| Secret Name                   | Value                                                                         |
-| ----------------------------- | ----------------------------------------------------------------------------- |
-| `CLOUDFLARE_API_TOKEN`        | Your Cloudflare API token                                                     |
-| `CLOUDFLARE_ACCOUNT_ID`       | Your Cloudflare account ID                                                    |
-| `CLOUDFLARE_WORKER_SUBDOMAIN` | Your workers.dev subdomain                                                    |
-| `DEPLOYMENT_NAME`             | Your deployment name                                                          |
-| `R2_ACCESS_KEY_ID`            | R2 access key ID                                                              |
-| `R2_SECRET_ACCESS_KEY`        | R2 secret access key                                                          |
-| `WEB_PLATFORM`                | `vercel` or `cloudflare`                                                      |
-| `VERCEL_API_TOKEN`            | Vercel API token _(only if `web_platform = "vercel"`)_                        |
-| `VERCEL_TEAM_ID`              | Vercel team/account ID _(only if `web_platform = "vercel"`)_                  |
-| `VERCEL_PROJECT_ID`           | Vercel project ID _(only if `web_platform = "vercel"`)_                       |
-| `NEXTAUTH_URL`                | Your web app URL                                                              |
-| `MODAL_TOKEN_ID`              | Modal token ID                                                                |
-| `MODAL_TOKEN_SECRET`          | Modal token secret                                                            |
-| `MODAL_WORKSPACE`             | Modal workspace name                                                          |
-| `GH_OAUTH_CLIENT_ID`          | GitHub App OAuth client ID                                                    |
-| `GH_OAUTH_CLIENT_SECRET`      | GitHub App OAuth client secret                                                |
-| `GH_APP_ID`                   | GitHub App ID                                                                 |
-| `GH_APP_PRIVATE_KEY`          | GitHub App private key (PKCS#8 format)                                        |
-| `GH_APP_INSTALLATION_ID`      | GitHub App installation ID                                                    |
-| `ENABLE_SLACK_BOT`            | `true` to deploy Slack bot, `false` to skip (default: `true`)                 |
-| `SLACK_BOT_TOKEN`             | Slack bot token (required if enabled)                                         |
-| `SLACK_SIGNING_SECRET`        | Slack signing secret (required if enabled)                                    |
-| `ANTHROPIC_API_KEY`           | Optional Anthropic API key for metered fallback and bot classifiers           |
-| `ANTHROPIC_OAUTH_CLIENT_ID`   | Optional Claude subscription OAuth public client ID override                  |
-| `ANTHROPIC_OAUTH_TOKEN_URL`   | Optional Claude subscription OAuth token endpoint override                    |
-| `TOKEN_ENCRYPTION_KEY`        | Generated encryption key (OAuth tokens)                                       |
-| `REPO_SECRETS_ENCRYPTION_KEY` | Generated encryption key (repo secrets)                                       |
-| `INTERNAL_CALLBACK_SECRET`    | Generated callback secret                                                     |
-| `MODAL_API_SECRET`            | Generated Modal API secret                                                    |
-| `NEXTAUTH_SECRET`             | Generated NextAuth secret                                                     |
-| `ALLOWED_USERS`               | Comma-separated GitHub usernames (or empty for all users)                     |
-| `ALLOWED_EMAIL_DOMAINS`       | Comma-separated email domains (or empty for all domains)                      |
-| `ENABLE_GITHUB_BOT`           | `true` to deploy GitHub bot worker (or empty to skip)                         |
-| `GH_WEBHOOK_SECRET`           | GitHub webhook secret (required if GitHub bot enabled)                        |
-| `GH_BOT_USERNAME`             | GitHub App bot username, e.g., `my-app[bot]` (required if GitHub bot enabled) |
-| `APP_NAME`                    | Optional display name for whitelabeling (default: `Open-Inspect`)             |
-| `APP_SHORT_NAME`              | Optional short label for sidebar header (default: `Inspect`)                  |
-| `APP_ICON_URL`                | Optional URL to a custom logo/favicon (default: built-in icon)                |
+| Secret Name                    | Value                                                                                       |
+| ------------------------------ | ------------------------------------------------------------------------------------------- |
+| `CLOUDFLARE_API_TOKEN`         | Your Cloudflare API token                                                                   |
+| `CLOUDFLARE_ACCOUNT_ID`        | Your Cloudflare account ID                                                                  |
+| `CLOUDFLARE_WORKER_SUBDOMAIN`  | Your workers.dev subdomain                                                                  |
+| `DEPLOYMENT_NAME`              | Your deployment name                                                                        |
+| `R2_ACCESS_KEY_ID`             | R2 access key ID                                                                            |
+| `R2_SECRET_ACCESS_KEY`         | R2 secret access key                                                                        |
+| `WEB_PLATFORM`                 | `vercel` or `cloudflare`                                                                    |
+| `VERCEL_API_TOKEN`             | Vercel API token _(only if `web_platform = "vercel"`)_                                      |
+| `VERCEL_TEAM_ID`               | Vercel team/account ID _(only if `web_platform = "vercel"`)_                                |
+| `VERCEL_PROJECT_ID`            | Vercel project ID _(only if `web_platform = "vercel"`)_                                     |
+| `NEXTAUTH_URL`                 | Your web app URL                                                                            |
+| `MODAL_TOKEN_ID`               | Modal token ID                                                                              |
+| `MODAL_TOKEN_SECRET`           | Modal token secret                                                                          |
+| `MODAL_WORKSPACE`              | Modal workspace name                                                                        |
+| `MODAL_ENVIRONMENT`            | Modal environment name (defaults to `main`)                                                 |
+| `MODAL_ENVIRONMENT_WEB_SUFFIX` | Modal environment web suffix for endpoint URLs; lowercase letters, digits, dashes, or empty |
+| `GH_OAUTH_CLIENT_ID`           | GitHub App OAuth client ID                                                                  |
+| `GH_OAUTH_CLIENT_SECRET`       | GitHub App OAuth client secret                                                              |
+| `GH_APP_ID`                    | GitHub App ID                                                                               |
+| `GH_APP_PRIVATE_KEY`           | GitHub App private key (PKCS#8 format)                                                      |
+| `GH_APP_INSTALLATION_ID`       | GitHub App installation ID                                                                  |
+| `ENABLE_SLACK_BOT`             | `true` to deploy Slack bot, `false` to skip (default: `true`)                               |
+| `SLACK_BOT_TOKEN`              | Slack bot token (required if enabled)                                                       |
+| `SLACK_SIGNING_SECRET`         | Slack signing secret (required if enabled)                                                  |
+| `ANTHROPIC_API_KEY`            | Optional Anthropic API key for metered fallback and bot classifiers                         |
+| `ANTHROPIC_OAUTH_CLIENT_ID`    | Optional Claude subscription OAuth public client ID override                                |
+| `ANTHROPIC_OAUTH_TOKEN_URL`    | Optional Claude subscription OAuth token endpoint override                                  |
+| `TOKEN_ENCRYPTION_KEY`         | Generated encryption key (OAuth tokens)                                                     |
+| `REPO_SECRETS_ENCRYPTION_KEY`  | Generated encryption key (repo secrets)                                                     |
+| `INTERNAL_CALLBACK_SECRET`     | Generated callback secret                                                                   |
+| `MODAL_API_SECRET`             | Generated Modal API secret                                                                  |
+| `NEXTAUTH_SECRET`              | Generated NextAuth secret                                                                   |
+| `ALLOWED_USERS`                | Comma-separated GitHub usernames (or empty for all users)                                   |
+| `ALLOWED_EMAIL_DOMAINS`        | Comma-separated email domains (or empty for all domains)                                    |
+| `ENABLE_GITHUB_BOT`            | `true` to deploy GitHub bot worker (or empty to skip)                                       |
+| `GH_WEBHOOK_SECRET`            | GitHub webhook secret (required if GitHub bot enabled)                                      |
+| `GH_BOT_USERNAME`              | GitHub App bot username, e.g., `my-app[bot]` (required if GitHub bot enabled)               |
+| `APP_NAME`                     | Optional display name for whitelabeling (default: `Open-Inspect`)                           |
+| `APP_SHORT_NAME`               | Optional short label for sidebar header (default: `Inspect`)                                |
+| `APP_ICON_URL`                 | Optional URL to a custom logo/favicon (default: built-in icon)                              |
 
 **Bulk upload secrets with `gh` CLI:**
 
 
@@ -307,6 +307,14 @@ class FakeD1Database {
         const nameVal = args[argIdx++] as string;
         rows = rows.filter((r) => r.repo_name === nameVal);
       }
+
+      const userIdMatch = conditions.match(/user_id IN \(([^)]+)\)/);
+      if (userIdMatch) {
+        const userIdCount = userIdMatch[1].split(",").length;
+        const userIds = new Set(args.slice(argIdx, argIdx + userIdCount) as string[]);
+        argIdx += userIdCount;
+        rows = rows.filter((r) => r.user_id !== null && userIds.has(r.user_id));
+      }
     }
 
     return rows;
@@ -484,6 +492,30 @@ describe("SessionIndexStore", () => {
       expect(result.total).toBe(2);
     });
 
+    it("filters by creator user ids", async () => {
+      await store.create(makeSession({ id: "alice-old", userId: "alice", updatedAt: 1000 }));
+      await store.create(makeSession({ id: "bob", userId: "bob", updatedAt: 3000 }));
+      await store.create(makeSession({ id: "alice-new", userId: "alice", updatedAt: 4000 }));
+      await store.create(makeSession({ id: "historical", userId: null, updatedAt: 5000 }));
+
+      const result = await store.list({ createdByUserIds: ["alice"] });
+
+      expect(result.sessions.map((s) => s.id)).toEqual(["alice-new", "alice-old"]);
+      expect(result.total).toBe(2);
+      expect(result.hasMore).toBe(false);
+    });
+
+    it("supports multiple creator user ids", async () => {
+      await store.create(makeSession({ id: "alice", userId: "alice", updatedAt: 1000 }));
+      await store.create(makeSession({ id: "bob", userId: "bob", updatedAt: 3000 }));
+      await store.create(makeSession({ id: "carol", userId: "carol", updatedAt: 4000 }));
+
+      const result = await store.list({ createdByUserIds: ["alice", "bob"] });
+
+      expect(result.sessions.map((s) => s.id)).toEqual(["bob", "alice"]);
+      expect(result.total).toBe(2);
+    });
+
     it("supports pagination with limit and offset", async () => {
       for (let i = 0; i < 5; i++) {
         await store.create(makeSession({ id: `s${i}`, updatedAt: i * 1000 }));
 
@@ -54,6 +54,7 @@ export interface ListSessionsOptions {
   excludeStatus?: SessionStatus;
   repoOwner?: string;
   repoName?: string;
+  createdByUserIds?: readonly string[];
   limit?: number;
   offset?: number;
 }
@@ -131,7 +132,15 @@ export class SessionIndexStore {
   }
 
   async list(options: ListSessionsOptions = {}): Promise<ListSessionsResult> {
-    const { status, excludeStatus, repoOwner, repoName, limit = 50, offset = 0 } = options;
+    const {
+      status,
+      excludeStatus,
+      repoOwner,
+      repoName,
+      createdByUserIds,
+      limit = 50,
+      offset = 0,
+    } = options;
 
     const conditions: string[] = [];
     const params: unknown[] = [];
@@ -156,6 +165,11 @@ export class SessionIndexStore {
       params.push(repoName.toLowerCase());
     }
 
+    if (createdByUserIds?.length) {
+      conditions.push(`user_id IN (${createdByUserIds.map(() => "?").join(", ")})`);
+      params.push(...createdByUserIds);
+    }
+
     const where = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
 
     // Get total count
 
@@ -0,0 +1,56 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { generateInternalToken } from "./auth/internal";
+import { handleRequest } from "./router";
+
+const mockUserStore = {
+  resolveOrCreateUser: vi.fn(),
+};
+
+vi.mock("./db/user-store", () => ({
+  UserStore: vi.fn().mockImplementation(() => mockUserStore),
+}));
+
+describe("provider identity router integration", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mockUserStore.resolveOrCreateUser.mockResolvedValue({
+      id: "0123456789abcdef0123456789abcdef",
+      displayName: "Ada",
+      email: "ada@example.com",
+      isNew: false,
+    });
+  });
+
+  it("serves provider identity upserts even when the SCM provider is not github", async () => {
+    const env = {
+      INTERNAL_CALLBACK_SECRET: "test-secret",
+      SCM_PROVIDER: "gitlab",
+      DB: {
+        prepare: vi.fn(),
+        batch: vi.fn(),
+        exec: vi.fn(),
+        dump: vi.fn(),
+      },
+    };
+
+    const token = await generateInternalToken(env.INTERNAL_CALLBACK_SECRET);
+    const response = await handleRequest(
+      new Request("https://test.local/provider-identities/github/12345", {
+        method: "PUT",
+        headers: {
+          "Content-Type": "application/json",
+          Authorization: `Bearer ${token}`,
+        },
+        body: JSON.stringify({
+          providerLogin: "ada",
+        }),
+      }),
+      env as never
+    );
+
+    expect(response.status).toBe(200);
+    await expect(response.json()).resolves.toEqual({
+      userId: "0123456789abcdef0123456789abcdef",
+    });
+  });
+});