PR #16205 - onyx-dot-app/onyx

Description

Backend PR for the connector checks redesign, stacked on #16204. The Confluence, Jira and GitHub config models check the design's field formats. This is the first half of the format-rule work. Google Drive, Microsoft, Slack and Notion follow in a later PR.

Rules (field validators in each config.py)

Connector	Field	Rejects	Message (the design's line)
Confluence	`page_id`	a value that is not a number	Enter the number from the page URL, e.g. 131368.
Confluence	`cql_query`	`lastModified` outside a quoted value	Unsupported filter: lastModified. Each sync adds its own.
Confluence	`cql_query`	`ORDER BY` outside a quoted value	Unsupported clause: ORDER BY. Each sync orders the results itself.
Jira	`jql_query`	`ORDER BY` outside a quoted value	Unsupported clause: ORDER BY. Jira does not allow it inside the sync filter.
GitHub	`repositories`	a name with an owner (`onyx-dot-app/onyx`)	Enter the name without the owner, e.g. onyx.

Where the errors go. /plan and draft runs already return field errors as form_errors, keyed by the field name. Create and edit validate the full config with the same rules. The checks that read the field wait in the form, and fail as "Invalid connector settings: {field}: {message}" in other runs.
Clean messages. A new helper, field_format_error in connector_config.py, raises a PydanticCustomError. So the message has no "Value error, " prefix. Its message must be a literal string, so it cannot hold the input value.
One source. The CQL and JQL rules share one module, onyx/connectors/atlassian_query.py. The checks no longer test these formats: a check cannot run while its field is invalid, so that code could not run.

Not in this PR (the design's other field rules for these connectors):

Jira "Email (account)" and GitHub "Enterprise Server URL": these are credential fields, not config fields.
GitHub "Select at least one: pull requests, issues or documents": this rule reads three fields. A config model must not have model validators (the form validates field by field), so the "Check selected content" check keeps it.

Stored connectors. A stored config that breaks a rule still indexes: build_connector_kwargs uses the stored config as-is, and logs a warning. The detail page's breakdown uses the top-level nodes for it. Its stored check runs fail the config-reading checks as invalid settings. The indexing hold reads only a pair's first attempt, so a pair that indexed before is not held. An edit that changes the config must fix the field.

How Has This Been Tested?

New unit test (test_draft_plan_format_rules.py): /plan gives each rule's message on its field; create and edit validation reject the same values; valid values (quoted words, blank values) give no error; a stored config that breaks a rule still builds the connector.
Existing Confluence, Jira and GitHub check tests updated: an invalid field makes the check wait on the form, and fail as an invalid setting in other runs, without a request.
The daily live tests lose the ORDER BY and owner-in-name cases: these no longer reach the source. I did not run the live tests.
Connector and server unit tests: 6689 passed, 1 failed. The failure (test_browser_lifecycle.py::test_download_is_not_retried_and_does_not_relaunch_browser) also fails on the stack tip without this PR. ty and pre-commit are clean.

Additional Options

[Optional] Please cherry-pick this PR to the latest release version.
[Optional] Override Linear Check

Generated by Claude Code

Summary by cubic

The Confluence, Jira, and GitHub config models now validate field formats at config time, so invalid values are rejected before a capability check runs or a request reaches the source.

Validators reject non-numeric Confluence page_id, lastModified and ORDER BY outside quoted values in Confluence CQL, ORDER BY outside quoted values in Jira JQL, and GitHub repository names that include an owner.
Violations surface as form_errors keyed by field in /plan and create/edit, with the design's line as the message; checks wait on the form and fail as invalid settings in other runs.
The CQL and JQL shape rules move to a shared atlassian_query.py module, and the checks no longer test these formats.
Stored configs that break a rule still index; any check that reads the field fails as invalid settings until the config is fixed on edit.

Summary by CodeRabbit

New Features
- Added connector configuration validation for Confluence page IDs and unsupported CQL clauses.
- Added Jira validation to reject JQL queries containing ORDER BY.
- Added GitHub repository-name validation requiring names without the owner prefix.
- Added clearer field-specific configuration errors in setup forms.
Bug Fixes
- Improved handling and messaging for invalid Confluence, Jira, and GitHub configurations.
- Added case-insensitive query checks that ignore quoted values.