Here is a list of plugins that are available but not installed. - Airtable (airtable@openai-curated-remote) - Alpaca (alpaca@openai-curated-remote) - Apollo.io (apollo@openai-curated-remote) - Spotify (app-68de829bf7648191acd70a907364c67c@openai-curated-remote) - Apple Music (app-6938a94a61d881918ef32cb999ff937c@openai-curated-remote) - LONA Trading Assistant (app-694336b0c0948191a4ad234f9942885b@openai-curated-remote) - SciSpace (app-69439d715a7c8191aed9e2f6649e105f@openai-curated-remote) - Tarot (app-6943a2c078b0819188de39e4fe168d9b@openai-curated-remote) - Todoist: To Do List & Calendar (app-6943b73823548191a9f9216c6790c453@openai-curated-remote) - Consensus (app-6943e6f4a928819195962de16fb9ffe4@openai-curated-remote) - Sider Scholar (app-6948b485f5bc8191adb4df13f369cec7@openai-curated-remote) - True Sky (app-69490a4a06148191a0dd78606a3dbf1f@openai-curated-remote) - Bigdata.com (app-69491eceef3c8191beb70788b7840429@openai-curated-remote) - Gamma (app-698a098735908191989f5788d7ee317e@openai-curated-remote) - Tredict (app-69aef5b699a0819184512d57743fc1cd@openai-curated-remote) - Maersk (app-69b2b5a768d4819190d3a86c5f12e6d9@openai-curated-remote) - Dropbox (app-69b31dc2110c8191b8b47dc98fe5a052@openai-curated-remote) - Parqet (app-69b68652f0308191a27d7c7096cab4f6@openai-curated-remote) - Interactive Brokers (IBKR) (app-69bc11db874881918718abaca20b68ce@openai-curated-remote) - Financial Datasets (app-69cacd9394a88191ba6564e1bb0430fa@openai-curated-remote) - Fathom (app-69d88b99c5c481918e8da9225737e1e9@openai-curated-remote) - vidIQ (app-69dd11f3e50c8191b1ca48d03cf7e2ad@openai-curated-remote) - TickTick:To-Do List & Calendar (app-69ddbaba3fb48191a825f22c21b0599d@openai-curated-remote) - Plaud (app-69f3c30d68288191bbd428a394a78407@openai-curated-remote) - Wolfram (app-69fe0bf66c8481919c513d799406436e@openai-curated-remote) - Runway (app-6a05e3b201788191be12b590b43e6ce3@openai-curated-remote) - Caliber (app-6a05e8f22d408191b13ba3897157f6df@openai-curated-remote) - COROS (app-6a0694cbb2608191bbefb74ba810ab68@openai-curated-remote) - TradingCursor (app-6a0d835ff1dc8191972eeabd14967446@openai-curated-remote) - CoinMarketCap (app-6a172fe86f5481919f73cbc3bc3ad5bb@openai-curated-remote) - Trello (app-6a20b18a639081918c1b438f8381b27e@openai-curated-remote) - Longbridge (app-6a2baf2fad748191812393c3e00308ef@openai-curated-remote) - freddy (app-6a322b52a82c8191b7fb653f9e9f7891@openai-curated-remote) - Higgsfield (app-6a3293e129088191abf0875820e839da@openai-curated-remote) - Stocktwits (app-6a427a19b1f481919c5db13838af00c2@openai-curated-remote) - CoinGecko (app-6a4f02d735388191959c8328877e0bbd@openai-curated-remote) - Asana (asana@openai-curated-remote) - Base44 (base44@openai-curated-remote) - Binance (binance@openai-curated-remote) - Box (box@openai-curated-remote) - Canva (canva@openai-curated-remote) - ClickUp (clickup@openai-curated-remote) - Cloudflare (cloudflare@openai-curated-remote) - Codex Security (codex-security@openai-curated-remote) - Figma (figma@openai-curated-remote) # AGENTS.md instructions for /Users/gaganarora/workplace/open-inspect-72e95a # AGENTS.md Open-Inspect is a background coding agent system that spawns sandboxed dev environments to work on GitHub repositories. Single-tenant design. Stack: Cloudflare Workers (TypeScript), Modal (Python), Next.js (React), Terraform. ## Architecture Three tiers connected by WebSockets: 1. **Web Client** (Next.js on Vercel or Cloudflare Workers via OpenNext) — UI with GitHub OAuth, session dashboard, real-time streaming 2. **Control Plane** (Cloudflare Workers + Durable Objects) — session lifecycle, WebSocket hub, GitHub/auth integration. Each session is a Durable Object with SQLite storage. Uses D1 for the session index, repo metadata, environments, and encrypted secrets. 3. **Data Plane** (Modal, Python) — sandboxed environments running coding agents. Manages sandbox creation, snapshots, and repository/environment image builds. **Bot integrations** — all Cloudflare Workers using Hono: - `slack-bot` — Slack messages → coding sessions - `github-bot` — PR review assignments and @mention commands - `linear-bot` — Linear agent webhooks → coding sessions **Data flow**: User prompt → web client → control plane DO (WebSocket) → Modal sandbox → streaming events back through the same WebSocket chain. ### Package Dependency Graph ``` @open-inspect/shared ← control-plane, web, slack-bot, github-bot, linear-bot ``` **Build `@open-inspect/shared` first** whenever you change shared types. Other packages import from it at build time. ## Package Overview | Package | Lang / Framework | Purpose | | --------------- | ---------------------------------- | ----------------------------------------------------------- | | `shared` | TypeScript | Shared types, auth utilities, model definitions | | `control-plane` | TypeScript / CF Workers + DO | Session management, WebSocket streaming, GitHub integration | | `web` | TypeScript / Next.js 16 + React 19 | User-facing dashboard, OAuth, real-time UI | | `slack-bot` | TypeScript / CF Workers + Hono | Slack event handler, session creation | | `github-bot` | TypeScript / CF Workers + Hono | PR review and @mention webhook handler | | `linear-bot` | TypeScript / CF Workers + Hono | Linear agent webhook handler | | `modal-infra` | Python 3.12 / Modal + FastAPI | Sandbox lifecycle, WebSocket bridge to control plane | ## Common Commands ```bash # Install & build npm install npm run build # all packages npm run build -w @open-inspect/shared # shared only (build first!) # Lint & format npm run lint:fix # ESLint + Prettier fix npm run format # Prettier only npm run typecheck # tsc across all TS packages # Tests — TypeScript (Vitest) npm test -w @open-inspect/control-plane # unit tests (node env) npm run test:integration -w @open-inspect/control-plane # integration (workerd/Miniflare + real D1) npm test -w @open-inspect/web npm test -w @open-inspect/github-bot npm test -w @open-inspect/slack-bot npm test -w @open-inspect/linear-bot # Tests — Python (pytest) cd packages/modal-infra && pytest tests/ -v # Python linting cd packages/modal-infra && ruff check --fix && ruff format ``` ## Testing All TypeScript packages use **Vitest**; Python uses **pytest** + pytest-asyncio. ### Test file locations - **control-plane unit**: co-located as `src/**/*.test.ts` — run in Node environment - **control-plane integration**: separate `test/integration/*.test.ts` — run in workerd via `@cloudflare/vitest-pool-workers` with real D1 bindings - **web, slack-bot, linear-bot**: co-located `src/**/*.test.ts` - **github-bot**: separate `test/*.test.ts` - **modal-infra**: `tests/test_*.py` ### Control-plane integration tests These run inside a real `workerd` runtime with Miniflare, using the `cloudflareTest()` plugin from `@cloudflare/vitest-pool-workers`. Important: - Integration tests share one D1 instance — use `cleanD1Tables()` or equivalent cleanup in `beforeEach`/`afterEach` to avoid cross-test pollution - D1 migrations from `terraform/d1/migrations/` are applied automatically via `test/integration/apply-migrations.ts` - Helpers in `test/integration/helpers.ts`: `initSession()`, `queryDO()`, `seedEvents()` ## Coding Conventions ### Durations and timeouts - **Use seconds for Python, milliseconds for TypeScript.** These match each ecosystem's conventions (Modal `timeout=` takes seconds; control-plane uses `_MS` suffixes throughout). - **Encode the unit in the name.** Python: `timeout_seconds`. TypeScript: `timeoutMs`, `INACTIVITY_TIMEOUT_MS`. Never use a bare `timeout`. - **Define each default value exactly once.** Extract to a named constant and import everywhere. - **Don't restate literal values in comments.** Write `Defaults to DEFAULT_SANDBOX_TIMEOUT_SECONDS`, not `Default: 7200`. ### Extending existing patterns - When threading an existing field through new code paths, evaluate whether the existing design (naming, types, units) is correct — don't blindly propagate it. Fix bad names or units in the same change rather than spreading the problem. ### Commit messages Use conventional commits: `feat:`, `fix:`, `docs:`, `refactor:`, `chore:`, `test:`. Keep the subject under 72 characters. Use the PR body for details, not the commit message. ## Key Gotchas - **Build order**: always build `@open-inspect/shared` before packages that depend on it. - **PKCS#8 keys**: Cloudflare Workers require PKCS#8 format for GitHub App private keys — convert with `openssl pkcs8 -topk8 -inform PEM -outform PEM -nocrypt`. - **Durable Object bindings**: new DO bindings require a two-phase Terraform deploy — first with `enable_durable_object_bindings = false`, then `true`. - **No `wrangler.toml`**: control-plane config is generated by Terraform, not checked in. - **Modal deployment**: from `packages/modal-infra`, run `uv run python deploy.py --build-sandbox-image` before `uv run modal deploy deploy.py` (or `uv run modal deploy -m src`). Never deploy `src/app.py` directly; it doesn't import function modules. - **Modal image rebuild**: update `CACHE_BUSTER` in `src/images/base.py` to force a rebuild. - **Web platform choice**: set `web_platform = "cloudflare"` in Terraform variables to deploy the web app to Cloudflare Workers via OpenNext instead of Vercel. When using Cloudflare, Vercel credentials are not required (dummy defaults are used). `NEXT_PUBLIC_WS_URL` must be available at build time since Next.js inlines `NEXT_PUBLIC_*` vars into the client bundle. - **Repo owners can be nested namespaces**: a `repo_owner` is not always a single segment. GitHub owners are (`octocat`), but GitLab subgroups nest (`group/subgroup`), so an owner may contain `/`. Only `repo_name` is a single path segment (it's the checkout directory under `/workspace`); the owner remains part of the repository identity in clone URLs, API routes, manifests, and storage keys. Don't validate or split owners as single segments. Use the shared repository identity helpers in TypeScript; where a full `owner/name` string is unavoidable, split on the **last** `/` and encode the owner as one API route segment. `repo_config.parse_repositories` accepts `/`-joined owners (see `is_safe_repo_owner`). ## CI/CD Pushing to `main` auto-deploys changed services: - **Terraform** → control plane + D1 migrations + web app if `web_platform = "cloudflare"` (triggers: `terraform/`, `packages/*/`) - **Vercel** → web app when `web_platform = "vercel"` (triggers: `packages/web/`, `packages/shared/`) - **Modal** → data plane (triggers: `packages/modal-infra/`, deployed via Terraform apply) CI runs lint, typecheck, and tests for all TypeScript and Python packages on every push and PR. ## Further Reading - [docs/GETTING_STARTED.md](docs/GETTING_STARTED.md) — deploy your own instance - [docs/HOW_IT_WORKS.md](docs/HOW_IT_WORKS.md) — detailed architecture and session lifecycle - [CONTRIBUTING.md](CONTRIBUTING.md) — contribution guidelines - [packages/control-plane/README.md](packages/control-plane/README.md) — API reference, WebSocket protocol, D1 schema, security model - [packages/modal-infra/README.md](packages/modal-infra/README.md) — sandbox internals, Modal deployment, endpoint URLs /Users/gaganarora/workplace/open-inspect-72e95a zsh 2026-09-14 America/Toronto /Users/gaganarora/workplace/open-inspect-72e95a:root

Summary

Summary