Skip to content

[comp] Production Deploy#2332

Merged
Marfuen merged 7 commits intoreleasefrom
main
Mar 19, 2026
Merged

[comp] Production Deploy#2332
Marfuen merged 7 commits intoreleasefrom
main

Conversation

@github-actions
Copy link
Contributor

This is an automated pull request to release the candidate branch into production, which will trigger a deployment.
It was created by the [Production PR] action.

github-actions bot and others added 2 commits March 18, 2026 16:11
…y default (#2331)

Add a color-coded "Agent" column to the People table showing device agent
installation status (green dot for installed, red for not installed).
Platform admins and deactivated members show a dash. Deactivated users are
now hidden by default unless explicitly filtered. Migrates Laptop icon from
lucide-react to @trycompai/design-system/icons.

Co-authored-by: Mariano Fuentes <marfuen98@gmail.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@cursor
Copy link

cursor bot commented Mar 18, 2026

PR Summary

Medium Risk
Changes employee sync semantics for Google Workspace by optionally restricting the user set via OU filtering, which can affect imports/deactivations. Vendor risk assessment extraction now enforces domain-scoped URLs and seeds crawl targets, which may reduce returned links but is low security risk.

Overview
Google Workspace employee sync can now be scoped to configured Organizational Units. The sync controller applies a new filterUsersByOrgUnits step (with tests) using target_org_units, and uses the OU-filtered population for subsequent include/exclude email filtering and deactivation domain calculations; the Google Workspace manifest exposes this variable for sync as well as checks.

Vendor risk assessment Firecrawl outputs are now constrained to the vendor’s domain. Added shared url-validation utilities (with tests) to extract the registrable domain, validate/normalize returned URLs, and filter out off-domain links; the agent prompt is tightened and crawling is anchored with seed URLs.

People UI tweaks. Adds a DEVICE column showing device agent installed status for members (and for invites/admins/inactive), changes the default status filter to hide deactivated users unless explicitly selected, and refactors the employee tasks list rendering for the all-complete state.

Minor: stops exporting the Trigger updatePolicyQueue symbol.

Written by Cursor Bugbot for commit e3a9867. This will update automatically on new commits. Configure here.

@vercel
Copy link

vercel bot commented Mar 18, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
app (staging) Ready Ready Preview, Comment Mar 18, 2026 6:33pm
comp-api-test Ready Ready Preview, Comment Mar 18, 2026 6:33pm
1 Skipped Deployment
Project Deployment Actions Updated (UTC)
portal (staging) Skipped Skipped Mar 18, 2026 6:33pm

Request Review

Co-authored-by: Mariano Fuentes <marfuen98@gmail.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…eted (#2334)

The early return when allCompleted was true prevented Whistleblower Reports
and Access Requests from rendering. Changed to conditional render so
Company Forms always appears when enabled.

Closes CS-183

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…2335)

Firecrawl agent was returning URLs from wrong domains (e.g., x.com
instead of wix.com). Added domain validation, seed URLs for common
legal/security paths, and prompt hardening to keep research on the
vendor's actual domain. Also fixes pre-existing TS2742 error in
update-policy.ts.

Co-authored-by: Mariano Fuentes <marfuen98@gmail.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Marfuen
Marfuen previously approved these changes Mar 18, 2026
extractVendorDomain only stripped the www. prefix, so a vendor website
like https://app.slack.com yielded app.slack.com as the domain. This
caused validateVendorUrl to reject valid URLs on the parent domain
(slack.com/privacy) or sibling subdomains (trust.slack.com). Now uses
tldts to extract the root registrable domain correctly.

Co-authored-by: Mariano Fuentes <marfuen98@gmail.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…2336)

Users in unselected OUs were being synced and reactivated because the
employee sync ignored the target_org_units setting. Now the same OU
filter used for security checks also applies to employee sync.

Co-authored-by: Mariano Fuentes <marfuen98@gmail.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Copy link

@cursor cursor bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Fix All in Cursor

Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

@Marfuen Marfuen merged commit 88d76ed into release Mar 19, 2026
14 checks passed
@claudfuen
Copy link
Contributor

🎉 This PR is included in version 3.10.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants