feat(issues): add multi-provider issue tracking

[Bil0000]

Problem

Issue tracking should work across supported hosts. A full issue URL should remain readable and linkable when no project owns its repository. Provider gaps and project-only routing prevent those flows.

Change

Adds the Issues page and thread issue links for GitHub, GitLab, Azure DevOps, Forgejo/Gitea, and Linear. External issue URLs stay read-only; project-owned issues keep native permission checks.

• Adds native provider reads, edits, comments, labels, assignees, reactions, templates, history, and linked pull requests where supported. Keeps the retired Bitbucket tracker notice separate from repository and pull request support.
• Preserves saved issue URLs, host scope, old panel tabs, legacy Azure URLs, and custom Forgejo ports. Resolves main conflicts and the relocated Azure test import.
• Adds explicit Load more for history and PR links in the web/desktop detail panel and agent tools. Reads do not auto-continue or retry. Failed pages keep the loaded rows and cursor; old replies cannot replace a new issue's rows.
• Linear reads one page of 50 history entries or attachments. Plain templates stay native; form and rich templates open the exact template in Linear, preserving its field rules and defaults.
• Azure reads 100 updates or five PR refs per page. PR reads use concurrency two and current access checks. Missing PRs do not block the page; authentication and other access errors remain visible.
• Forgejo keeps a full timeline to one native read. Oversized timelines continue two physical pages per click, and PR refs continue in batches of five with concurrency two. Signed cursors keep client-supplied refs and close flags from being trusted. Compact server-side continuation state keeps all PR refs off the wire. Content-based cursors reuse unchanged snapshots in a cache of 64 entries for 15 minutes.
• Bounded, credential-scoped page caches avoid repeated reads only when a verified credential fingerprint is available. Native cooldown checks stop queued reads after a 429; Azure cooldowns stay within the organization, and Forgejo preserves Retry-After.

Verification

The latest local follow-up passed 745 focused tests across contracts, authorization, services, provider adapters, agent tools, and UI, including existing GitHub/GitLab and Forgejo source-control regression tests. Scoped server, web, contracts, client-runtime, and Forgejo typechecks passed. All 24 Linear GraphQL documents validated against the official schema. Focused formatting and lint passed with existing warnings.

Forgejo tests walk all 800 PR refs, cover native overflow, repeat reads, concurrent walks, expiry, eviction, credential changes, and signed cursor rejection before host calls.

The app check used fake local tracker data. It proved no page read before a click, one request for two fast clicks, page append, retry with retained rows, read-only paging, and the exact Linear form link. A mocked HTTP check through the real Forgejo CLI and adapter proved two overflow pages per click and no full-timeline retry. No live tracker write was made.

All eight required CI checks passed on 4acfcf830e. The requested review round completed with all 155 review threads resolved and no new actionable code findings. Maintainer approval remains pending.

Screenshots are local. The official GitHub attachment command previously rejected upload because it requires upstream write access. No PR-only assets are committed.

Limits and approval

Linear form submission runs in Linear because its public API does not define the native form-answer protocol. Forgejo oversized timelines remain marked partial: native private filtering cannot prove completion, and an empty physical page stops continuation. Expired or evicted continuation state and adapter restarts require refresh. Dense issue timestamp groups can require complete native paging; missing repository dates or reverse-page metadata can require a full scan with bounded ranking memory.

Live authenticated trackers and native mobile were not tested. Mobile has no issue detail screen. No deployment is claimed. Rate limits can still occur; the change reduces request bursts and honors host pauses.

Human approval remains pending. The prior CodeRabbit full review exceeded its 300-file limit, and Macroscope's review estimate exceeded the workspace cost limit. No bot or maintainer approval is claimed.

Implemented with GPT-6.1 Sol and Claude Opus 5.5 in T3 Code, using the Codex and Claude Agent harnesses.

[coderabbitai]

📝 Walkthrough

📝 Walkthrough

📝 Walkthrough

📝 Walkthrough

📝 Walkthrough

📝 Walkthrough

📝 Walkthrough

📝 Walkthrough

📝 Walkthrough

📝 Walkthrough

Walkthrough

This pull request adds issue tracking for GitHub, GitLab, Bitbucket, Azure DevOps, and Linear. It adds issue APIs, thread and pull-request issue links, saved work-item links, AI-assisted matching, agent tools, and web interfaces for browsing and managing issues.

Changes

Issue tracking and provider integrations

Layer / File(s)	Summary
Shared issue contracts and server provider services packages/contracts/src/issue.ts, packages/contracts/src/issueTracking.ts, packages/contracts/src/workItem.ts, apps/server/src/issue/*	Adds contracts for issue data, tracker connections, and work-item operations. Adds provider API clients and adapters, a provider registry, and an IssueService for listing, reading, and changing issues.
Tracker connection settings and RPC packages/contracts/src/settings.ts, packages/contracts/src/rpc.ts, apps/server/src/auth/RpcAuthorization.ts, apps/server/src/ws.ts, apps/server/src/issue/LinearConnection.ts	Adds issue-tracker settings and RPC methods for issue operations, tracker connections, work-item links, and matching. The server maps read RPCs to orchestration read scope and mutation RPCs to orchestration operate scope. Linear supports saved credentials and project-to-team bindings.
Issue browsing and detail UI apps/web/src/components/issue/*, apps/web/src/components/ChatView.tsx, apps/web/src/components/RightPanelTabs.tsx, apps/web/src/routes/-chatIssuesTitlebar.test.tsx, apps/web/src/routeTree.gen.ts	Adds the /issues route, issue list and detail panels, issue search in the composer, and issue surfaces in the right panel. The issue detail view supports provider-available actions, comments, labels, assignees, reactions, and issue-to-thread handoffs.
Linear settings and navigation apps/web/src/components/settings/LinearIntegrationSettings.tsx, apps/web/src/components/settings/IntegrationsSettings.tsx, apps/web/src/components/sidebar/SidebarChrome.tsx, apps/web/src/state/issueTracking.ts	Adds Linear account connection and project-binding controls. Adds Issues navigation when the primary environment advertises issue support.

Thread links, related issues, and agent features

Layer / File(s)	Summary
Thread issue links and synchronization packages/contracts/src/orchestrationV2.ts, apps/server/src/orchestration-v2/Orchestrator.ts, apps/server/src/orchestration-v2/ProjectionStore.ts, apps/server/src/orchestration-v2/IssueSyncReactor.ts, apps/server/src/persistence/Migrations/*	Adds issue links to thread metadata and projections, imports legacy issue links, and adds migrations for thread issue-link data and saved issue–pull-request links. IssueSyncReactor reads linked issues and dispatches updates when their title or state changes.
Pull-request linked issues and citations apps/server/src/pullRequest/*, apps/server/src/pullRequest/issueReferences.ts, packages/contracts/src/pullRequest.ts, apps/web/src/components/pullRequest/PullRequestSummaryTab.tsx	Adds linked issue data to pull-request details. GitHub and GitLab providers combine host-reported links with issue references resolved from pull-request titles and bodies.
Saved links, matching, and agent tools apps/server/src/workItems/*, apps/server/src/mcp/toolkits/issues/*, apps/server/src/provider/RuntimeInstructions.ts, apps/web/src/components/workItems/*, apps/web/src/hooks/useIssueLinking.ts	Adds saved issue–pull-request links and work-item matching. Adds MCP tools for reading and linking issues, and for managing saved issue–pull-request links. Provider runtime instructions include issue-linking instructions when the issue tools are available.

Priority: ➖ Normal

Estimated code review effort: 5 (Critical) | ~120 minutes

---

Merge Risk: 🟡 Moderate · up to 8eade

The Issues feature is broad. Several open issues can still mislead users or block common actions: linked-issue lists can appear complete when they are not, the comment box can stay disabled after a failure, and a search shortcut can be captured from other inputs. These should be resolved before merging, or explicitly accepted.

Security Architecture Review

Security architecture risk: 🟡 Moderate · up to e5ed1

Externally authored tracker content can influence suggested relationships, and failure recovery can restore an outdated account binding. Authorization, repository checks, bounded suggestions, and deliberate user actions limit the exposure, but these issues warrant a moderate assessment.

Retained concerns

• Medium · security · observed: The new matching flow places externally authored tracker titles and bodies in the same instruction string as the matching criteria. Malicious item content can manipulate suggested relationships, confidence, or explanations. Deterministic candidate validation and deliberate UI actions limit the consequence but do not enforce the semantic distinction between tracker data and instructions.
• Medium · security · inferred: Linear disconnect recovery can overwrite a newer account binding. It snapshots bindings before clearing them and restores that snapshot if credential deletion fails. A concurrent accepted settings patch bypasses the connection coordinator and can replace or clear the same binding during that interval; restoration then reinstates the previous credential selection. Subsequent issue access can therefore use the old account despite the newer configuration choice.

Security review details

Security Blast Radius

• inferred — The content-manipulation path requires control of a tracker item's title or body that an authorized matching operation reads. It can affect users whose matching source or shortlist includes that item, without requiring the author to possess the application's authentication token. The demonstrated output scope is supplied-candidate suggestions and their explanations, not arbitrary account access or automatic tracker writes.
• observed — A thread-bound issue read can use a saved link's source project and that project's provider credential, rather than only the thread's project. The web linking flow deliberately records this source project from a fetched issue within the selected environment. Direct issue-tool inputs do not provide an arbitrary project selector; the server-side entitlement policy for persisted foreign-project links remains incompletely established.

Security Findings and Attack Paths

• observed — The retained finding traces tracker-authored content into the new matching instruction string. The instruction to ignore embedded directions and the output schema are meaningful counterevidence, but neither deterministically prevents malicious content from altering semantic selections or explanations. The application subsequently limits results to known candidates and presents them as suggestions with a separate linking action.
• inferred — The credential-routing recovery path requires overlapping authorized configuration changes and a disconnect failure. A newer binding or deliberate removal can be overwritten by the previous snapshot, causing subsequent reads to select the previous stored account. No increased caller privilege is demonstrated because settings updates and disconnect both require orchestration-operate authority.

Trust Boundaries and Controls

• observed — The issue toolkit checks membership in the authenticated invocation's actual capability set, requires a thread identity, and rejects missing or deleted threads. Provider-session tokens carry a specific thread and provider identity. External OAuth clients lack the issue capability and thread scope. Issue link and unlink commands target the authenticated thread rather than a caller-supplied thread.
• observed — RPC authorization rejects methods without a declared scope and checks connection scopes before running handlers. New issue mutations require operate authority. Assignee changes additionally require a matching project source, supported provider capability, and fresh provider-reported permission, so UI visibility is not the authorization boundary.

Resilience and Maintainability Implications

• observed — Binding cleanup and credential deletion are separate persistent operations. Settings persistence serializes individual writes, but that serialization does not encompass the entire disconnect sequence. Restoration handles ordinary deletion errors, while interruption or restoration failure can leave a stored credential without its former binding. A null binding prevents normal Linear source resolution, which limits immediate exposure but does not establish complete credential retirement.

Hardening Proposals

• proposed — Separate matching instructions from serialized, explicitly untrusted tracker records where the generation interface supports it. Exercise adversarial titles and bodies while retaining deterministic candidate validation and deliberate confirmation before any linking action.
• proposed — Coordinate all credential-bearing binding writers or use version-checked restoration so disconnect recovery cannot overwrite newer choices. Define an idempotent recovery state for interrupted credential removal across settings and secret persistence.

---

---

Caution

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

• Ignore (reviewers only)

❌ Failed checks (1 error, 2 warnings)

Check name	Status	Explanation	Resolution
Approvability		The pull request adds a multi-provider issue-tracking subsystem and user workflow, which triggers the rule “Adds a subsystem or user workflow, or is a large refactor across apps or packages.” The diff…	A maintainer must review this pull request before CodeRabbit approval.
Linked Issues check		The description does not link a triaged issue or discussion with explicit maintainer approval, and it confirms that approval remains pending.	Link the governing issue or discussion and include explicit maintainer approval for the current scope and commit.
Description check		The description thoroughly covers the problem, implementation, verification, limitations, and approval status. However, it does not provide the required triaged issue or discussion link with an approv…	Add the triaged bug or design-discussion link and quote the maintainer approval comment, or explain the applicable exemption. Upload and embed clear before/after UI screenshots, plus a recording where interaction timing or transitions requi…

✅ Passed checks (2 passed)

Check name	Status	Explanation
Out of Scope Changes check		The server, contracts, orchestration, MCP, persistence, client, and shared UI changes support the stated multi-provider issue-tracking and work-item-linking objectives. No clearly unrelated change is …
Title check		The title clearly and concisely identifies the main change: adding multi-provider issue tracking. It uses a conventional commit format and matches the changeset.

---

Full details: Approvability

Explanation

The pull request adds a multi-provider issue-tracking subsystem and user workflow, which triggers the rule “Adds a subsystem or user workflow, or is a large refactor across apps or packages.” The diff adds issue operations in apps/server/src/issue/IssueService.ts, the browsing UI in apps/web/src/components/issue/IssuesPanel.tsx, and public contracts in packages/contracts/src/issue.ts. It spans 281 files across server, web, client-runtime, contracts, and shared packages. It also adds credential connection handling in apps/server/src/issue/LinearConnection.ts and persisted-data migrations in apps/server/src/persistence/Migrations/059_ProjectionThreadIssues.ts and 060_WorkItemLinks.ts. The pull request needs a maintainer's review before CodeRabbit approves it.

---

Full details: Description check

Explanation

The description thoroughly covers the problem, implementation, verification, limitations, and approval status. However, it does not provide the required triaged issue or discussion link with an approval comment, and it lacks the required uploaded before/after screenshots for the extensive UI changes.

Resolution

Add the triaged bug or design-discussion link and quote the maintainer approval comment, or explain the applicable exemption. Upload and embed clear before/after UI screenshots, plus a recording where interaction timing or transitions require evidence.

---

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

---

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Reviewed the new Effect service modules under apps/server/src/issue/ (CLI/API wrappers, providers, registry, IssueService), the touched pull-request services, and the contracts/client-runtime additions against the Effect service conventions.

Service shape, layer composition, dependency acquisition (yield* Foo.Foo), namespace imports, Foo["Service"] references, and the runtime boundaries in server.ts/ws.ts all follow the conventions. Two error-modelling findings in the new Azure DevOps issue modules are noted inline.

^{Posted via Macroscope — Effect Service Conventions}

[Bil0000]

Macroscope - Effect Service Conventions is reporting stale findings

Both retained findings are fixed in the code at the exact commit the check ran against (d61b0815). Its line numbers have drifted; the summary also notes it posted no inline comments because "both lines already carry review comments from an earlier run", which is what it appears to be keying off.

Finding 1 — AzureDevOpsIssueProvider.ts:102, claimed to be detail: error.message:

$ git show d61b0815:apps/server/src/issue/AzureDevOpsIssueProvider.ts | grep -n "error.message\|detail:"
102:        detail: error.detail,
113:        detail: "Azure DevOps work items cannot be changed this way from the CLI.",
133:              detail: "Azure DevOps records no mention of a person on a work item.",

Line 102 is already error.detail. There is no error.message in the file. Fixed in eef8a684 (now f2b0f2c-era after a reword), which is exactly the change the finding asks for.

Finding 2 — AzureDevOpsIssueCli.ts:191, claimed to manufacture an Error for a required cause:

$ git show d61b0815:apps/server/src/issue/AzureDevOpsIssueCli.ts | sed -n '188,193p'
      return " AND [System.State] NOT IN ('Closed', 'Completed', 'Done', 'Removed', 'Resolved')";
    case "closed":
      return " AND [System.State] IN ('Closed', 'Completed', 'Done', 'Removed', 'Resolved')";

$ git show d61b0815:apps/server/src/issue/AzureDevOpsIssueCli.ts | grep -n "new Error("
(no matches)

Line 191 is a WIQL state clause. The project-lookup path moved to line 257 and now takes the second option the finding suggested — its own tagged error, modelled on the neighbouring AzureDevOpsWorkItemIncompleteError:

return name.length === 0
  ? Effect.fail(new AzureDevOpsProjectUnknownError({ command: "az", cwd }))
  : Effect.succeed(name);

AzureDevOpsProjectUnknownError carries command and cwd and no cause, because az succeeded here.

For what it is worth, this same check passed at 3d628e68b once the two inline threads were resolved, and only came back on the merge commit. All 39 review threads on this PR are resolved.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This is a substantial multi-provider issue-tracking feature spanning server integrations, persistence, RPC contracts, UI workflows, agent tooling, and background synchronization. It also changes authorization code and product defaults, so the scope and runtime impact require human review.

Not approved because:

• Per-review cost limit exceeded (workspace setting). Approvability relies on correctness review in order to determine eligibility

^{Review your spending limits in Billing settings, or comment @macroscope-app review this PR to bypass the limit and review now. You can add or adjust custom eligibility rules. Learn more.}

[Bil0000]

@macroscope-app Please resynchronize this repository and rerun Macroscope - Effect Service Conventions against current head 53d4f040c2927d57b7e9cb33db02d4660aea3b69.

The latest check still says it reviewed head 559580a, which is stale. Both retained claims are absent at current head:

• AzureDevOpsIssueProvider.ts uses detail: error.detail.
• AzureDevOpsIssueCli.ts uses AzureDevOpsProjectUnknownError for an empty successful project lookup and does not manufacture a cause.

All related review threads are resolved. Please refresh the indexed Git state before rerunning the custom check.

[macroscopeapp]

Sorry, I'm unable to act on this request because you do not have permissions within this repository.

[macroscopeapp]

Reviewed the changed web UI for shared-primitive use, Tailwind ownership and visual/interaction preservation. Five concrete findings, all introduced by this patch:

• The issues page's scroll fade names a utility that does not exist, so the page has no fade at all.
• Three controls were reconstructed by hand in the new shared source-control components instead of using Input/InputGroup/Button, which drops the primitives' focus-visible ring, disabled/dark treatment and coarse-pointer hit target. Two of these are on the existing pull request surfaces too, because PullRequestSearchInput and the reviewer picker's field were replaced by them.
• The new issue filter trigger duplicates the shared ListFilterMenu trigger's geometry verbatim.

Details inline.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

One finding: the new GitHub GraphQL rate-limit budget is a process-wide mutable singleton that two Effect services depend on without declaring it in their environment. The Azure DevOps error findings from the previous run (stacked detail/message in AzureDevOpsIssueProvider, manufactured Error for cause in AzureDevOpsIssueCli) are both resolved at this head.

^{Posted via Macroscope — Effect Service Conventions}

[Bil0000]

@coderabbitai full review

Please review the current head 4947d6ec4f0538bbde502536da797de4d2dff0bf. The automatic incremental review was skipped. This is the single review round for this update.

[coderabbitai]

⚠️ Action not completed

Review skipped: 330 files exceed the limit of 300.