feat: complete #120 cross-surface continuity + real device oauth e2e

[anand-testcompare]

Issue

• Closes epic - diagram studio + convex agent threads (ai sdk v6) #120

Summary

This PR completes issue #120 end-to-end across phases 1-5:

• migrates OpenCode device auth endpoints to real WorkOS device grant (no Convex table)
• preserves durable session/thread continuity between CLI-style API usage and web Diagram Studio
• hardens real E2E coverage for continuity, idempotency, OCC conflicts, and auth-gated UX
• updates CI to fail fast when required authenticated E2E creds are missing

No API key/rate-limit/billing/M2M scope was added.

Acceptance Criteria Mapping (#120)

1) Thread-backed architecture

• Durable thread/session state used by /api/diagrams/thread-run flows in continuity scenarios.
• Web and CLI/API resume same sessionId + threadId with full history continuity.
• In-memory-only continuity assumptions replaced by thread-backed end-to-end assertions.

2) Tool loop + correctness

• Generate/restructure/tweak exercised through the agent tool loop in real runs.
• Idempotency via promptMessageId verified (duplicate prompt id does not fork session).
• Tool history/status persisted and rendered in web continuity verification.
• OCC scene-write safety verified via explicit stale expectedVersion conflict + recovery.

3) Streaming + high-reactivity UX

• Web run lifecycle is asserted in scenarios (Running -> Persisted).
• Tool lifecycle/status UI is validated in continuity screenshots and visual review notes.
• Stop/send/scroll behavior remains covered by existing diagram studio scenarios; continuity scenario adds cross-surface run persistence checks.

4) Cross-surface continuity

• CLI-style device auth flow obtains bearer token through /api/auth/device/start|token.
• API creates/resumes thread-backed session; web opens same session with preserved history.
• API resumes again after web interaction on same session/thread.
• Trace-id propagation is asserted on all relevant API routes in continuity scenario.

5) UX polish

• Auth gate behavior validated (/diagrams redirect, generator sign-in gating, device start URL contract).
• Stagehand scenarios hardened to reduce brittleness against provider UI variance.

Implementation Details

Auth/device flow migration

• Added WorkOS helper: apps/web/src/lib/workos-device-auth.ts
• Added tests: apps/web/src/lib/workos-device-auth.test.ts
• Updated routes:
  • apps/web/src/app/api/auth/device/start/route.ts
  • apps/web/src/app/api/auth/device/token/route.ts
• Removed legacy Convex table/device auth implementation:
  • packages/backend/convex/deviceAuth.ts (deleted)
  • packages/backend/convex/deviceAuth.test.ts (deleted)
  • schema/test setup/generated api updated accordingly
• Removed legacy page: apps/web/src/app/opencode/device/page.tsx

E2E/CI hardening

• Added mint script used in CI and local real-flow verification:
  • packages/backend/scripts/mint-device-token.mjs
• Updated API workflow to mint via real device auth and hard-fail without creds:
  • .github/workflows/e2e-api.yml
• Added hardened continuity scenario:
  • tests/e2e/src/scenarios/unauthenticated/opencode-web-continuity.ts
  • wired in .github/workflows/e2e-web.yml
• Hardened auth gate scenario expectations for provider path variants:
  • tests/e2e/src/scenarios/unauthenticated/auth-gates.ts
• Added .vercelignore to reduce preview deploy payload noise.

Verification Evidence

Required commands (local)

All required commands completed successfully:

• bun x ultracite check ✅
• bun run check-types ✅
• bun run build ✅
• cd packages/backend && bunx convex codegen && bun run test ✅ (20 files / 70 tests passed)

Targeted tests

• bun test apps/web/src/lib/workos-device-auth.test.ts ✅ (4 tests passed)

Real E2E scenarios (non-mock core continuity)

• opencode-web-continuity (Browserbase) ✅
  • Replay: https://www.browserbase.com/sessions/02cfc63e-43e2-4731-9ec1-0b4ccdc4b87d
• opencode-web-continuity (Local Stagehand against preview) ✅
• auth-gates (Browserbase) ✅
  • Replay: https://www.browserbase.com/sessions/d6a2d638-ae58-4788-8dcf-c77ca0c63922
• Venom API suites against preview with minted device token ✅
  • tests/api/auth-device.yml
  • tests/api/diagrams.yml

Notes for Reviewers

• This intentionally removes the legacy Convex device-auth table path and standardizes on WorkOS device grant behavior.
• CI now explicitly requires SKETCHI_E2E_EMAIL + SKETCHI_E2E_PASSWORD for authenticated continuity runs; missing creds are hard failures by design.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
sketchi-web	Ready	Preview, Comment	Mar 2, 2026 3:03am

[github-actions]

Browserbase Replays

• Session 56a26b3b-3a7c-41a1-b03f-a869d0f93207 (scenario: visual-sanity.ts): replay | debug
• Session 8d3718c7-1baa-49c2-9abc-64d0cf8fbf5d (scenario: auth-gates.ts): replay | debug
• Session 8d95797e-3c4c-4ce4-8793-64950cf6ab69 (scenario: opencode-web-continuity.ts): replay | debug
• Session d712cd70-2e81-442e-930f-6c224d3a0fd4 (scenario: diagram-studio-happy-path.ts): replay | debug
• Session d3159895-3715-4106-9e3a-191fcd64b40f (scenario: diagram-studio-occ-conflict.ts): replay | debug

Workflow run: 22559637289