fix(webhook): bump local-channels pin to 0.27.1 for the filter-race fix

[defangdevs]

Problem

Follow-up to #618 (closed by defangdevs/local-channels#56
landing upstream, but this box — and every other deployment — still runs the
OLD pinned webhook.py until this pin moves).

webhook_subscribe --claim could report success while the on-disk filter
file's topics silently kept the pre-call state: FILTER_LOCK is a
threading.RLock, which only serializes threads inside one process, but the
one-shot CLI (agent-box-webhook subscribe, and every MCP tool call — each a
fresh stdio process) re-imports the module per invocation and gets its own
FILTER_LOCK sharing no memory with the long-running daemon. A CLI subscribe
landing in the same window as a delivery's route_event write could each
read-modify-write the file with no ordering between the two, so whichever
write landed last silently discarded the other's change — defeating the
ownership brake from #192/#251 and risking a sibling hook-* session
spawning on top of work already claimed, which is exactly what happened on
DefangLabs/station PR #38 per the original report.

Change

defangdevs/local-channels#56 (merged, local-webhook 0.27.1) adds a
cross-process flock on a sibling <filter>.lock file, held for the entire
read-modify-write in both the CLI/MCP tool-call path and the daemon's
delivery routing — closing the race regardless of which process wins the
timing.

This PR bumps nix/webhook-pin.nix (rev + sha256) to that commit and
regenerates modules/agent-box.nix via nix run .#assemble. No other file
changed by hand.

Verification

This box is aarch64, so the interactive runNixOSTest/qcow2 checks are out
of reach here (x86_64-linux-only per AGENTS.md), but the pin-only diff
touches no VM-test-only surface. Ran every native aarch64 check in the
flake, --keep-going, all green:

agentbox-render, assemble-module-escaping, backend-parity,
checkout-bootstrap, checkout-options, connect-card, connect-install,
download-route, envstore-format, fail2ban-jail, golden-snapshot,
jit-agents, lease-protocol, module-generated-up-to-date,
module-single-file, multi-user, one-spec-both-backends,
phantom-unit-overrides, portal-route, profile-panel, registry-protocol,
runtime-profile, session-route, sessions-registry,
socket-activated-restart, source-tree, upload-cli, vendor-integrity,
webhook-backfill, webhook-claim, webhook-defer, webhook-panel-state,
webhook-route, webhook-spawn-claim

module-generated-up-to-date in particular confirms modules/agent-box.nix
matches its sources after the pin bump, and golden-snapshot confirms the
rendered configuration (including the webhook.py fetch) still builds and
matches the committed fixture.

I did not run the x86_64-only interactive VM tests (sessions,
settings-page, etc.) — they need a same-arch KVM guest this box doesn't
have. If CI surfaces something there, I'll follow up.

🤖 Generated with Claude Code

https://claude.ai/code/session_01JLgCfi9EpxvsXpjvesS4JR

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 9c1f0250-8678-4602-bc04-8bf97a1c4d4d

📥 Commits

Reviewing files that changed from the base of the PR and between 173807e and 78a7da6.

📒 Files selected for processing (2)

• modules/agent-box.nix
• nix/webhook-pin.nix

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The pull request updates the pinned revisions and SHA-256 hashes for the defangdevs/local-channels and local-webhook sources.

Changes

Source pin updates

Layer / File(s)	Summary
Refresh source pins modules/agent-box.nix, nix/webhook-pin.nix	The Nix fetchers now use updated repository revisions and matching SHA-256 hashes.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 78a7d

This updates pinned local-webhook and local-channels sources, including the local-webhook filter-update locking fix. No concrete current-head merge-blocking risk remains.

Suggested reviewers: lionello

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the main change: bumping the local-channels webhook pin to version 0.27.1 for the filter-race fix.
Description check	✅ Passed	The description directly explains the filter-file race, the local-webhook 0.27.1 fix, the pin updates, regeneration, and verification results.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/618-webhook-pin-bump

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}