Add GitHub session logic, and refactor logging

[PaytonWebber]

This PR introduces GitHub based trigger event support, which allows users to now trigger Cyrus via @ mentions on GitHub issues or PR's. When users post a comment that contains '@cyrusagent', an agent session is triggered in a dedicated Git worktree, with the context of the comment that Cyrus was triggered by.

---

[devin-ai-integration]

Devin Review found 1 potential issue.

View 8 additional findings in Devin Review.

[devin-ai-integration]

🔴 HMAC signature verification uses re-serialized JSON instead of raw request body

In signature verification mode, the code computes the HMAC-SHA256 digest over JSON.stringify(request.body) (the re-serialized parsed JSON) instead of the original raw request body bytes. GitHub computes its x-hub-signature-256 over the exact raw bytes sent in the HTTP request. Re-serializing the already-parsed body with JSON.stringify() can produce different output than the original payload (e.g., different whitespace, key ordering, unicode escaping, number formatting), causing the signature comparison to fail.

Root Cause

The route is correctly configured with rawBody: true at GitHubEventTransport.ts:75, which tells Fastify to preserve the raw body as request.rawBody. However, at line 116, the code ignores request.rawBody and instead uses JSON.stringify(request.body):

const body = JSON.stringify(request.body); // ← re-serialized, NOT raw bytes
const isValid = this.verifyGitHubSignature(body, signature, this.config.secret);

The verifyGitHubSignature method at line 252 then computes:

const expectedSignature = `sha256=${createHmac("sha256", secret).update(body).digest("hex")}`;

Since body is JSON.stringify(request.body) rather than the original raw bytes, any difference between the two (whitespace, key order, etc.) causes timingSafeEqual to return false, rejecting valid webhooks.

Impact: Signature-mode verification (verificationMode: "signature") will reject legitimate GitHub webhooks whenever JSON.stringify(parsed) does not byte-for-byte match the original payload. This effectively breaks the cloud/signature verification mode entirely.

Suggested change

	const body = JSON.stringify(request.body);
	const body = (request as any).rawBody ?? JSON.stringify(request.body);

---

Was this helpful? React with 👍 or 👎 to provide feedback.