feat: GitHub connector OAuth

[felixschmetz]

Summary by cubic

Add GitHub OAuth browser flow and unify token handling under a single token field. Tokens are validated via the source lifecycle, and the UI now prefers OAuth when available.

• New Features

  • Enable GitHub OAuth2 authorization_code (oauth_type: access_only); add OAuth endpoints to dev and self-hosted integration YAMLs; send Accept: application/json on token exchange.
  • Unify credentials under GitHubAuthConfig.token; normalize personal_access_token/access_token; validate ghp_, github_pat_, gho_, and 40-hex formats; update frontend and cursor validation rules.
  • Frontend respects backend auth_methods order and defaults to the first.

• Other Changes

  • OAuth callback validates via SourceLifecycleService.validate; fix token validation by passing the raw string; lifecycle wraps into auth config when auth_config_ref is present.
  • GitHubSource: rename personal_access_token to token; allow token-only instantiation for validation paths; prefer oauth_browser in auth_methods; update auth headers.
  • Auth providers and tools updated for token rename: Composio and Pipedream now map token; monke broker normalizes access_token → token; GitHub bongo uses token.
  • Exclude local_storage from uvicorn reload; add tests for GitHub auth config, lifecycle validate, and OAuth callback; fix test imports and lints; format tests with ruff.

^{Written for commit 10f3d6f. Summary will update on new commits.}

[cubic-dev-ai]

3 issues found across 17 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="backend/airweave/platform/configs/tests/test_github_auth.py">

<violation number="1" location="backend/airweave/platform/configs/tests/test_github_auth.py:45">
P1: Custom agent: **Check for Cursor Rules Drift**

Update Cursor rule docs for GitHub token validation to include OAuth app tokens (`gho_`), since this PR adds that accepted format and currently violates the rule’s requirement to keep Cursor rules synchronized with API/auth pattern changes.</violation>
</file>

<file name="backend/airweave/domains/oauth/callback_service.py">

<violation number="1" location="backend/airweave/domains/oauth/callback_service.py:568">
P2: `SourceLifecycleService.validate` expects the raw access token for token-only sources (e.g., Todoist/Notion). Passing `{"access_token": ...}` results in a dict being treated as the token, breaking validation. Pass the access token string directly (as you already do in source connection creation).</violation>
</file>

<file name="backend/airweave/domains/sources/lifecycle.py">

<violation number="1" location="backend/airweave/domains/sources/lifecycle.py:183">
P2: `model_validate()` can raise before the `SourceCreationError` wrapper, so invalid credential payloads escape as raw exceptions instead of the service’s documented creation error type.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

4 issues found across 4 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="monke/auth/broker.py">

<violation number="1" location="monke/auth/broker.py:186">
P1: Custom agent: **Check for Cursor Rules Drift**

Update the Monke Cursor rules to match the new `token`-based credential flow; they still instruct `personal_access_token`/`access_token`, which is now drift for `monke/**` auth guidance.</violation>
</file>

<file name="backend/airweave/platform/auth_providers/composio.py">

<violation number="1" location="backend/airweave/platform/auth_providers/composio.py:40">
P1: Custom agent: **Check for Cursor Rules Drift**

Update the relevant Cursor rules for the unified GitHub `token` field. Rule `Check for Cursor Rules Drift` requires the auth-provider guidance to stay in sync, but the current rules still teach `personal_access_token`, so Cursor will keep suggesting the old credential shape for this flow.</violation>
</file>

<file name="monke/bongos/github.py">

<violation number="1" location="monke/bongos/github.py:30">
P1: Custom agent: **Check for Cursor Rules Drift**

Update the Cursor rules for GitHub Monke auth to use `token` instead of `personal_access_token`; they currently describe an auth contract this change no longer accepts.</violation>

<violation number="2" location="monke/bongos/github.py:30">
P2: Keep the legacy GitHub credential aliases here, or direct-auth GitHub runs will fail before the test starts.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}