fix: explicitly send spawnSource from web session route

[ColeMurray]

Summary

• Adds spawnSource: "user" to the session creation body in packages/web/src/app/api/sessions/route.ts
• Previously the web route relied on the control plane defaulting missing spawnSource to "user" (via session.spawnSource ?? "user" in SessionIndexStore.create()) — every bot already sends its source explicitly, but the web route did not

Pre-step 4 of the unified user model migration (pre-steps doc). Makes the main migration's diff for this file purely additive (new actor* fields) rather than a mix of fixing omissions and adding new fields.

Test plan

• npm run typecheck -w @open-inspect/web passes
• npm test -w @open-inspect/web — all 185 tests pass

Summary by CodeRabbit

• Chores
  • Improved internal session tracking mechanisms to enhance monitoring and analytics visibility for session management.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: b94bba7e-9b1b-4b8f-8b52-2c4f5c2cf4da

📥 Commits

Reviewing files that changed from the base of the PR and between 6307481 and f52c05b.

📒 Files selected for processing (1)

• packages/web/src/app/api/sessions/route.ts

---

📝 Walkthrough

Walkthrough

A single field spawnSource with the value "user" has been added to the session creation payload in the API route handler. This property is now included when POST requests construct and send session bodies to the control plane.

Changes

Cohort / File(s)	Summary
Session Spawn Source packages/web/src/app/api/sessions/route.ts	Added spawnSource: "user" field to the sessionBody object in the POST handler to indicate user-initiated session creation.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

• fix: exclude bot and automation sessions from analytics #499: Sets spawnSource: "user" on session creation, complementing the related PR's routing and payload handling based on spawn_source values.
• fix: include bot-initiated sessions in analytics #531: This PR's addition of spawnSource field pairs with the related PR's analytics filtering and consumption of session spawn_source data.

Suggested reviewers

• open-inspect

Poem

🐰 A tiny field hops into view,
spawnSource: "user" rings true,
Sessions now whisper where they came,
From eager clicks that spark the flame,
One line, so small, yet marks the way—
Hop along, dear code, hooray! 🎉

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: adding explicit spawnSource field to the web session route. It accurately reflects the core modification in the changeset.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch pre-step-4/web-explicit-spawn-source

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

Terraform Validation Results

Step	Status
Format	✅
Init	✅
Validate	✅

Note: Terraform plan was skipped because secrets are not configured. This is expected for external contributors. See docs/GETTING_STARTED.md for setup instructions.

Pushed by: @ColeMurray, Action: pull_request

[open-inspect]

Summary

PR Title and number: fix: explicitly send spawnSource from web session route (#534)
Author: @ColeMurray
Files changed count: 1
Additions/deletions: +1/-0

This change makes the web session creation route explicit about its spawn source instead of relying on the control-plane default. I reviewed the diff against the route and the control-plane session init handler, and the change is correct, low risk, and consistent with the other session creators.

Critical Issues

None.

Suggestions

None.

Nitpicks

None.

Positive Feedback

• This keeps the web caller aligned with the bot callers that already send spawnSource explicitly.
• The change preserves backward compatibility because the control plane still defaults missing values to "user".
• The diff is intentionally minimal and improves clarity ahead of the larger unified user model migration.

Questions

None.

Verdict

Approve