Show workers as their own labeled section in active sessions

[soorya-u]

Summary

• Login sessions from browser/desktop/mobile controllers and from the CLI worker (cyrusd) were indistinguishable in the active-sessions settings page.
• Add a nullable workerName field to the session model, set only by cyrusd (the only peer type that logs in via the OAuth device-authorization grant), and split the UI into Controllers and Workers sections — the latter shows a count and each row is labeled with the worker's name and a terminal icon instead of a browser/OS parse.
• The CLI pushes its name via better-auth's built-in updateSession client method rather than a custom endpoint. Both login and rename treat a failed push as fatal — login removes the just-stored token and rename leaves local config untouched — so a session can never end up desynced from its worker name.
• Along the way, fixed two pre-existing, unrelated bugs surfaced while wiring up the schema: drizzle-kit generate was emitting DROP TABLE for everything because drizzle.config.ts pointed at a schema module with no top-level table exports, and auth:generate was broken because the CLI-only auth config had no drizzle adapter for the current @better-auth/cli to recognize.

See docs/adr/0023-worker-name-discriminates-login-sessions.md for the full design rationale.

Test plan

• bun run check:types (all packages)
• bun run test:unit (148 web/server/shared + 122 CLI tests)
• bun run test:integration
• bun check (lint, scoped to touched files)
• New integration tests for cyrusd rename (success, server-rejects, not-logged-in) spawning the real CLI binary against a fake local server
• New component tests for the Controllers/Workers split and the worker name/icon rendering
• Applied the new D1 migration locally and verified db:generate is idempotent afterward

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features

  • Login sessions now synchronize worker names with the server.
  • Added support for renaming workers while keeping local and server settings aligned.
  • Active sessions are grouped into Controllers and Workers, with worker names clearly displayed.

• Bug Fixes

  • Failed or unauthenticated name updates now stop before changing local configuration.
  • Improved handling of sessions with missing device information.

• Documentation

  • Added glossary and architecture documentation describing login session types and worker names.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
cyrus	Ready	Preview	Aug 7, 2026 5:17am

[coderabbitai]

📝 Walkthrough

Walkthrough

The change adds optional workerName data to authentication sessions. The CLI synchronizes worker names during login and rename. The web interface groups active sessions into Controllers and Workers.

Changes

Worker session topology

Layer / File(s)	Summary
Session contract and storage apps/server/..., apps/server/src/db/migrations/..., apps/server/src/db/models/auth.ts, CONTEXT.md, docs/adr/...	Authentication configuration and database schema support nullable workerName session fields. The glossary and ADR document controller and worker session classification.
CLI session synchronization apps/cli/src/lib/auth.ts, apps/cli/src/commands/auth/login.ts, apps/cli/src/commands/config/rename.ts, apps/cli/src/commands/config/rename.test.ts	The CLI updates the authenticated session with the local worker name during login and rename. Failed updates stop the command before local configuration changes. Tests cover success, server errors, and unauthenticated use.
Active-session grouping and display apps/web/src/components/auth/security/active-session.tsx, apps/web/src/components/auth/security/active-sessions.tsx, apps/web/src/components/auth/security/*.test.tsx	The web interface identifies worker sessions by workerName, displays worker details, and separates Controllers from Workers. Tests cover worker rendering, counts, and empty worker sections.

Estimated code review effort: 3 (Moderate) | ~30 minutes

Sequence Diagram(s)

sequenceDiagram
  participant CLI
  participant authClient
  participant BetterAuth
  participant D1Session
  CLI->>authClient: syncWorkerName(name)
  authClient->>BetterAuth: updateSession(workerName)
  BetterAuth->>D1Session: update worker_name
  D1Session-->>BetterAuth: update result
  BetterAuth-->>authClient: session update result
  authClient-->>CLI: Result<void, string>

Loading

Possibly related PRs

• soorya-u/cyrus#38: Modifies authentication and session handling for CLI worker sessions.
• soorya-u/cyrus#120: Introduces the server-side Drizzle authentication schema extended here with workerName.
• soorya-u/cyrus#136: Modifies the active-session components extended here for worker-session display.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main user-facing change: displaying worker sessions in a separate labeled section.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/worker-login-session-badge

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@apps/server/src/auth/options.ts`:
- Around line 34-41: Restrict the workerName configuration in the session
additionalFields definition so generic client updateSession calls cannot write
it. Add a worker-authenticated server-side update path for the CLI that accepts
only non-empty names and verifies device-authorization provenance. Update the
related ADR to describe the server-only CLI path rather than claiming generic
updateSession restricts workerName to the CLI.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 2ab12529-5684-4105-a0fb-e20afcef2677

📥 Commits

Reviewing files that changed from the base of the PR and between 0964dd7 and 885faad.

📒 Files selected for processing (16)

• CONTEXT.md
• apps/cli/src/commands/auth/login.ts
• apps/cli/src/commands/config/rename.test.ts
• apps/cli/src/commands/config/rename.ts
• apps/cli/src/lib/auth.ts
• apps/server/drizzle.config.ts
• apps/server/src/auth/cli.ts
• apps/server/src/auth/options.ts
• apps/server/src/db/migrations/20260806160054_add_worker_name_to_session/migration.sql
• apps/server/src/db/migrations/20260806160054_add_worker_name_to_session/snapshot.json
• apps/server/src/db/models/auth.ts
• apps/web/src/components/auth/security/active-session.test.tsx
• apps/web/src/components/auth/security/active-session.tsx
• apps/web/src/components/auth/security/active-sessions.test.tsx
• apps/web/src/components/auth/security/active-sessions.tsx
• docs/adr/0023-worker-name-discriminates-login-sessions.md