chore: sync fork with upstream (ColeMurray/background-agents)

.claude/skills/onboarding/SKILL.md

@@ -134,8 +134,10 @@ user selected GitHub:
 5. If GitHub sign-in is selected, set the **Callback URL** (under "Identifying and authorizing
    users"): `{deployed-web-app-url}/api/auth/callback/github`
    - **CRITICAL**: The origin must exactly match the Homepage URL selected above.
-6. **Repository permissions**: Contents (Read & Write), Issues (Read & Write), Pull requests (Read &
-   Write), Metadata (Read-only)
+6. **Repository permissions**: Contents (Read & Write), Pull requests (Read & Write), Metadata
+   (Read-only), and Issues (Read & Write) only if the GitHub bot is enabled. Pull requests
+   permission also authorizes creating and applying labels to session-created pull requests;
+   labeling does not require Issues permission.
 7. If GitHub sign-in uses email/domain admission, set **Account permissions**: Email addresses
    (Read-only)
 8. Create app, note **App ID**

.github/workflows/ci-python.yml

@@ -0,0 +1,220 @@
+name: CI (Python)
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - ".github/workflows/ci-python.yml"
+      - "packages/control-plane/src/image-builds/timeouts.ts"
+      - "packages/daytona-infra/**"
+      - "packages/e2b-infra/**"
+      - "packages/modal-infra/**"
+      - "packages/sandbox-runtime/**"
+      - "packages/shared/src/types/integrations.ts"
+      - "ruff.toml"
+      - "terraform/environments/production/modal.tf"
+      - "terraform/modules/modal-app/scripts/deploy.sh"
+      - "!**/*.md"
+  pull_request:
+    branches: [main]
+    paths:
+      - ".github/workflows/ci-python.yml"
+      - "packages/control-plane/src/image-builds/timeouts.ts"
+      - "packages/daytona-infra/**"
+      - "packages/e2b-infra/**"
+      - "packages/modal-infra/**"
+      - "packages/sandbox-runtime/**"
+      - "packages/shared/src/types/integrations.ts"
+      - "ruff.toml"
+      - "terraform/environments/production/modal.tf"
+      - "terraform/modules/modal-app/scripts/deploy.sh"
+      - "!**/*.md"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint-python-sandbox-runtime:
+    name: Lint & Format (Python - sandbox-runtime)
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    defaults:
+      run:
+        working-directory: packages/sandbox-runtime
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - name: Setup Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+          cache: "pip"
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e ".[dev]"
+
+      - name: Run Ruff linter
+        run: ruff check src/ tests/
+
+      - name: Run Ruff formatter check
+        run: ruff format --check src/ tests/
+
+  lint-python:
+    name: Lint & Format (Python - provider infra)
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - name: Setup Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+          cache: "pip"
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e packages/sandbox-runtime
+          pip install -e "packages/modal-infra[dev]"
+
+      - name: Run Ruff linter
+        run: ruff check packages/modal-infra/ packages/e2b-infra/ packages/daytona-infra/
+
+      - name: Run Ruff formatter check
+        run: ruff format --check packages/modal-infra/ packages/e2b-infra/ packages/daytona-infra/
+
+  typecheck-python:
+    name: TypeCheck (Python)
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    defaults:
+      run:
+        working-directory: packages/modal-infra
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - name: Setup Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+          cache: "pip"
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e ../sandbox-runtime
+          pip install -e ".[dev]"
+
+      - name: Run MyPy
+        run: mypy src/
+        continue-on-error: true # Allow failures initially as types are added
+
+  typecheck-python-sandbox-runtime:
+    name: TypeCheck (Python - sandbox-runtime)
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    needs: [lint-python-sandbox-runtime]
+    defaults:
+      run:
+        working-directory: packages/sandbox-runtime
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - name: Setup Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+          cache: "pip"
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e ".[dev]"
+
+      - name: Run MyPy
+        run: mypy src/
+        continue-on-error: true # Allow failures initially as types are added
+
+  test-python-sandbox-runtime:
+    name: Test (Python - sandbox-runtime)
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    needs: [lint-python-sandbox-runtime]
+    defaults:
+      run:
+        working-directory: packages/sandbox-runtime
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - name: Setup Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+          cache: "pip"
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: "22"
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e ".[dev]"
+
+      - name: Run tests
+        run: pytest tests/ -v
+
+      - name: Run Node.js tests
+        run: node --test tests/*.test.mjs
+
+  test-python:
+    name: Test (Python - modal-infra)
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    needs: [lint-python]
+    defaults:
+      run:
+        working-directory: packages/modal-infra
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - name: Setup Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+          cache: "pip"
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e ../sandbox-runtime
+          pip install -e ".[dev]"
+
+      - name: Run tests
+        run: pytest tests/ -v