fix: handle GitHub connector branch refs and resyncs

[cyphercodes]

Summary

• Normalize GitHub connector branch inputs so bare branch refs like main validate against refs/heads/main.
• Run manual GitHub connector resync/retry work immediately so sync events do not stay queued forever.

Why

• Fixes the connector setup/resync failure reported in [Bug]: GitHub Connector Cloud MCP — sync stuck on queued, setup fails with github_branch_not_found #2533 where ref=main fails validation and resync remains queued without progress.

Issue

• Fixes [Bug]: GitHub Connector Cloud MCP — sync stuck on queued, setup fails with github_branch_not_found #2533

Scope

• GitHub connector setup validation, discovery target hydration, and manual resync/retry handling.
• Adds regression coverage for bare branch refs and repository identity validation.

Out of scope

• No UI changes.
• No changes to GitHub webhook sync behavior.

Testing

Ran

• bun test ee/apps/den-api/test/github-connector-app.test.ts
• pnpm --filter @openwork-ee/den-api build
• git diff --check HEAD~1..HEAD

Result

• pass: all 8 targeted connector tests passed.
• pass: den-api build completed.
• pass: diff whitespace check completed.

CI status

• pass: local targeted checks above.
• code-related failures: N/A locally.
• external/env/auth blockers: N/A.

Manual verification

1. Verified the issue, comments, timeline, and duplicate PR searches before opening.
2. Verified the branch-ref helper accepts branch=main / ref=main and stores canonical refs/heads/main.
3. Verified manual resync/retry now executes the GitHub import path and records a terminal event status instead of leaving the event queued.

Evidence

• N/A (API/backend regression tests)

Risk

• Low/medium: changes are limited to GitHub connector setup and manual sync paths. Sync now runs inline for manual resync, so callers get the same response shape after the event has been processed.

Rollback

• Revert this PR to restore previous queued-only manual resync behavior.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
openwork-landing	Ready	Preview, Comment, Open in v0	Jul 9, 2026 3:39am

[vercel]

@cyphercodes is attempting to deploy a commit to the Different AI Team on Vercel.

A member of the Team first needs to authorize it.

[Pablosinyores]

This reads well. normalizeGithubBranchRef correctly accepts both a bare main and a full refs/heads/main (stripping the prefix, rebuilding the canonical ref, and validating the caller's ref against either form), and threading the normalized branch through the branch-existence path and the path/branchExists checks keeps them consistent. The immediate-sync path is also careful: autoImportError is accumulated, the catch records it, and eventStatus resolves to failed/completed with completedAt set — so a failing manual sync ends in a terminal failed state rather than the "stuck forever" the queued path had. Good.

One design question on running the sync inline (runGithubConnectorSyncNow awaited directly in the route): the fix trades "sync event stays queued forever" for "the HTTP request now blocks until the whole import finishes." For a large repository that import could take a while — is there a bound on what a single manual resync pulls, or a request timeout in front of this route? If manual resync is always small/bounded, inline is fine; if it can be large, it might be worth keeping the work off the request path (respond running, do the import in the background) so a big repo doesn't time out the retry button. Not a blocker, just want to make sure the immediate path can't reintroduce a different failure mode.

Minor: the eventStatus nested ternary is a little hard to scan — a small helper or an explicit if/else would read easier for the next person, but purely cosmetic.

The test using both bare and fully-qualified refs is a good addition and covers the case #2533 hit.