Merge - #295
Merged
Merged
Conversation
Scope CRM idempotency hashes to the concrete record being changed so identical reviewed updates cannot replay across organizations, people, opportunities, or tasks. Normalize stored customer websites to credential-free HTTP(S) URLs and defensively suppress unsafe legacy links in the admin UI. Add focused regressions for cross-record identity, URL schemes, and hostname ports, and make the receivables due-date assertion timezone-independent.
Add first-class commercial quote records with immutable PDF storage, integrity metadata, validity and voiding state, audited fresh-auth mutations, and admin-only document retrieval. Expose quote preview, issue, download, and void workflows consistently through Conat, the admin UI, and cocalc-cli. Add a dedicated billing-details correction action for replacing billing and procurement contacts plus future invoice address and memo fields after approval or fulfillment. Preserve agreement approval and fulfillment state, reject changes once a non-void invoice exists, retain all unrelated contacts, and record the correction in the order audit timeline. Document both workflows in the source and bundled admin runbooks, and cover PDF round trips, idempotency, optimistic concurrency, fulfilled-order corrections, CLI safety previews, fresh authentication, and accessible UI flows.
Treat an explicit provider-missing instance as stopped for billing so VM and GPU rates cannot continue while retained disks are reconciled. Generic host errors remain billable because transient control-plane failures do not prove that provider costs stopped. Guard cloud reconciliation writes with the instance id from the provider snapshot. A reconcile pass loaded before delete or reprovision can no longer restore stale runtime metadata or status after the lifecycle action changes the host record. Add focused billing-state tests and a database regression for the stale snapshot race.
Treat a top-level browser document navigation as a safe hub-affinity recovery boundary. When more than one healthy worker is available, route the navigation away from its currently pinned worker and update affinity on the response, while preserving stickiness for API requests, WebSockets, and in-app traffic. This lets a refresh recover from a worker that still passes readiness checks but hangs on real application routes, without requiring users to clear cookies or disrupting active collaboration connections.
Remove the source-level production API-to-SSH-address mapping from software deployment. Software now passes the named site profile through as the Rocket cluster name and lets Rocket resolve `clusters.<name>.ssh.remote` from its existing local configuration, while an explicit `--remote` remains authoritative. This keeps authentication/API details in CLI profiles and machine-specific SSH routing in Rocket configuration and `~/.ssh/config`.
Do not serialize SSH deployment targets, operator account identifiers, email addresses, or local hostnames into software deployment records. These records and their indexes are served from the public software bucket, so they should contain artifact, commit, profile, status, and timing data only. Continue passing explicit SSH targets to the private deploy subprocess while testing that neither the record nor index publishes them.
Make the project-secrets CLI help, bundled CoCalc skill, and always-on Codex runtime guidance state that secret changes refresh running project mounts without a project restart. Preserve the important distinction that applications which cache credentials may still need their own reload. Expand the user-facing project-secrets documentation with live, stopped, and retry-pending behavior. Reconcile the original design and security-audit notes with the implemented atomic refresh path, and clarify the master-key recovery check so it does not imply that ordinary secret changes require a restart. Cover the new CLI and runtime guidance with focused assertions.
Collaborative saves marked with saveLast now write a same-directory temporary file and atomically rename it over the destination. This keeps sync-fs from observing the truncate/write gap and leaves the original file intact if writing or committing the replacement fails. Self-write suppression state is recorded only after the replacement succeeds. Sync-fs no longer converts arbitrary loader errors into empty content. Failed or missing reads preserve the authoritative Patchflow-derived baseline and publish no filesystem patch; explicit watcher unlink events remain the only deletion signal. Add regression coverage for successful delta saves, interrupted full and delta saves, transient read failures, and missing files during watcher initialization.
Decouple provider request body bytes from model context-token accounting so base64 graphical inputs do not hit a text-derived limit. Enforce an independent 32 MiB shared-host safety cap, reject oversized content lengths before buffering, and return an actionable error. Calculate reservation headroom from the configured context window rather than HTTP payload bytes. Cover multimodal proxy forwarding and early oversized-request rejection.
Use the shared clipboard helper for pending course invite links instead of calling the browser clipboard API directly after an asynchronous request. When clipboard permission or user activation is unavailable, show the links in an accessible read-only field with clear manual-copy instructions and a retry action. Add focused coverage for denied clipboard access and a successful retry.
Move privileged tree copies, overlay mounts, and RootFS normalization behind openat2-anchored descriptors so runtime-user-controlled symlinks and renames cannot redirect root operations outside managed storage roots. Replace root execution of runtime-user-owned Rustic and BEES binaries with atomic root-owned copies extracted from the checksum-verified tools archive. Broker Rustic operations through immutable, schema-validated opendal:s3 profiles and anchored data directories, rejecting executable configuration and unmanaged repository backends. Also repair the SSH piper private key mode.
Give the site-license delegate account search a stable accessible name and use that role/name in its interaction test. This prevents the test from typing into the newly added CRM customer selector based on incidental combobox order.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 237e9d888e
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| if (existingMode != null) { | ||
| await this.chmod(tempPath, existingMode); | ||
| } | ||
| await this.rename(tempPath, path); |
There was a problem hiding this comment.
When saveLast is true and path is an in-sandbox symlink, the previous descriptor-based write followed the symlink and updated its target, but renaming the temporary file onto path replaces the symlink itself. Collaborative editor and notebook saves therefore leave the real target unchanged while silently converting the link into a regular file, which can cause subsequent jobs to read stale content; resolve the final target for the atomic replacement or retain the prior write semantics for symlinks.
Useful? React with 👍 / 👎.
Comment on lines
+248
to
+250
| Table({ | ||
| name: "commercial_quotes", | ||
| rules: { |
There was a problem hiding this comment.
Adding this durable seed-global billing table without adding commercial_quotes to TABLE_OWNERSHIP makes the manifest completeness test fail, and the default bay-drain preflight derives its table set from that manifest, so it silently omits stored quote PDFs from ownership/drain analysis. Classify it alongside the other commercial_* seed-global tables.
AGENTS.md reference: AGENTS.md:L79-L83
Useful? React with 👍 / 👎.
This comment has been minimized.
This comment has been minimized.
Keep host-bootstrap deploys immutable and profile-scoped by default. Operators must now name either the staging or latest mutable channel when intentionally updating an alias, preventing a staging deployment from silently changing the production-facing bootstrap pointer.
Register commercial_quotes as seed-global durable commercial state alongside orders, invoices, and payments. This keeps the ownership manifest exhaustive and makes its schema reference checks recognize the table's seed authority.
Treat an initially missing path as a valid watcher state without inferring deletion. Existing Patchflow history remains authoritative and unchanged, while a brand-new structured document still receives its expected initial empty revision. Force the structured diff only for the no-history missing-file case so SyncDB initialization retains its established version semantics. Other read failures continue to abort reconciliation without changing the stored baseline.
Define a CLI-first, seed-global CRM outreach system that creates proactive Zendesk tickets while preserving CRM drafts, approvals, suppressions, durable provider operations, and reply-linked follow-up. Specify admin-configurable global, per-domain, per-contact, and per-batch limits with database-backed enforcement, provider backoff, diagnostics, and emergency delivery controls.
Extend the outreach plan to ingest My Read Receipts observations as bounded, comment-correlated CRM engagement events without treating tracking pixels as proof of human reading or retaining fingerprinting metadata. Create one durable no-response CRM task after each successful commercial outreach, with a configurable due interval, shared overdue views, deterministic reply and suppression handling, and human-reviewed Zendesk follow-up. Clarify the Google Workspace and Zendesk setup for the shared partnerships support address.
Define a shared manual follow-up cadence with configurable initial delay, maximum attempts, and final review timing. Use view observations only to prioritize due work and suggest either follow-up or delivery verification; never let tracking pixels change deadlines or trigger messages. Add CRM-aware preview and send operations, constrained suggested actions, same-task rescheduling, final human no-response disposition, diagnostics, and acceptance coverage. Repair duplicated wording in the existing plan.
Add seed-global CRM outreach tables for templates, batches, immutable recipient deliveries, suppressions, provider operations, Zendesk inbox events, engagement evidence, and worker state. Define shared state contracts and expose conservative, bounded site settings for delivery, rate limits, follow-up cadence, provider routing, webhook validation, and My Read Receipts integration.
Add the seed-authoritative outreach API, reviewed template and batch workflow, contact suppressions, immutable delivery snapshots, rate-limited provider worker, durable provider operations, and target-aware timeout reconciliation. Connect proactive Zendesk tickets, signed webhook ingestion, requester reply synchronization, strict MyReadReceipt observations, explicit opt-out confirmation, and durable no-response tasks. Extend shared CRM tasks with a reviewed reschedule transition and expose the complete workflow through the admin CLI and packaged admin documentation. Include operational metrics, provider diagnostics, safe feature gates, and focused coverage for capability mapping, webhook signatures, provider error classification, and receipt parsing.
Add the admin outreach workspace with queue metrics, comprehensive filters, review-first mutations, fresh-auth commits, suppressions, follow-up work, provider attempt history, engagement evidence, and on-demand redacted Zendesk threads. Extend the seed-routed read API and CLI show command so provider and engagement evidence are equally available to agents. Integrate outreach into Customer 360, add reusable opportunity and labeled account selectors, and cover the queue, kill switch, preview/commit contract, modal-local errors, and CLI evidence envelope.
Resolve reviewed contacts with an EXISTS subquery instead of a DISTINCT join. This preserves email matching without duplicate people and allows PostgreSQL to order active matches without rejecting the query.
Generate an ephemeral UUID for delivery previews because preflight compares the preview identifier against persisted UUID columns. The preview remains non-persistent while exercising the same SQL safety checks as a committed delivery.
Correct the outreach operations runbook so every effectful example explicitly previews before committing with the returned optimistic version and idempotency key. Document that approval and queueing require separate previews, and replace the nonexistent sent state with the actual delivery lifecycle states. Add a distinct admin-only guide for the browser Outreach workspace covering preparation, composition, exact-message review, approval and queueing, suppressions, follow-up policy, delivery semantics, and system handoffs. Register the guide in the packaged docs index and cross-link it with the general CRM UI guide and agent-oriented outreach runbook.
Add dedicated typed bay-ops methods for Zendesk outreach event ingestion and recipient opt-out application. These methods carry only the validated machine payload, preserve seed-bay authority, and avoid fabricating a human admin actor or weakening the existing admin/audit checks on the general CRM RPC. Revalidate and bound webhook envelopes at the seed persistence boundary, reject malformed opt-out tokens, and propagate inter-bay failures to callers. Add focused routing tests covering dedicated method selection, rejection before forwarding, error propagation, and seed-side event sanitization.
Show the exact frozen recipient, routing, and message snapshots before final approval or queueing. Keep the customer context when entering outreach, expose outreach creation from every customer record, and preserve the outreach card even before the first delivery exists. Split human UI guidance from the agent runbook and associate searchable CRM selectors with their visible form labels. Make the read-observation explanation keyboard reachable and cover the updated navigation and selector behavior.
Canonicalize My Read Receipts event keys as versioned SHA-256 digests that bind the provider, Zendesk ticket, opening comment, normalized observation timestamp, and adapter-specific authenticated source identity. Preserve those coordinates in provenance and reject malformed receipt comment identifiers. Expand adapter coverage to lock the canonical digest contract and verify deterministic replay plus separation across tickets, comments, timestamps, configured fields, and integration authors.
Keep outreach history and diagnostics readable when seed-authoritative mutations are disabled while visibly disabling every draft, approval, suppression, retry, and task entry point. Surface provider pacing, per-domain rolling usage, and bounded-result truncation so administrators do not mistake a capped browser snapshot for the complete operational queue.
Record explicit fresh-auth decisions for the complete public outreach mutation surface, including transition and mutate exports that are not selected by the registry's name heuristic. This keeps draft identity changes, approvals, queueing, suppressions, provider reconciliation, and public follow-ups inside the repository-wide dangerous-RPC audit.
Split inactive-project and banned-collaborator discovery into independent indexed candidate sources. This avoids expanding every project's collaborator JSON after the first pagination boundary and lets the existing lifecycle B-tree and users GIN indexes serve their respective paths. Preserve PostgreSQL microsecond precision in the candidate cursor so a boundary row is not revisited after node-postgres converts timestamps to millisecond Date objects. Add focused coverage for the indexed query shape and precise cursor propagation.
Split effectful sends from safe Zendesk reconciliation so provider reads continue independently of the delivery kill switch and send quotas. Recover expired effectful leases as indeterminate, safely requeue stale reconciliation reads and webhook claims, use bounded repeated absence observations before retrying ticket creation, and select work with domain eligibility inside the claim query. Revalidate reviewed follow-ups against replies, task state, suppressions, follow-up limits, and provider retry limits at queue and claim time. Cancel queued comments on suppression, make success finalization idempotent, retry definite transient failures durably, and enforce one pending comment operation per delivery in PostgreSQL.
Resolve outreach deliveries and batch recipients to readable CRM organization, contact, opportunity, task, and account names without presenting internal UUIDs as primary UI. Show shared follow-up ownership and state, a bounded append-only CRM activity rail, and Customer 360 suppression status with direct navigation to the filtered suppression workspace. Preserve mutation feature gates and make partial or truncated context explicit.
Require reviewed primary recipient identities, unambiguous organization context, template merge values, bounded rendered content, and complete provider routing before approval. Keep durable queueing independent of the delivery kill switch and expand diagnostics for stale work, dead letters, follow-up drift, engagement projection drift, and incomplete configuration.
Implement the organization-first individual draft contract as a safe composed workflow. The first call previews batch creation; committing that reviewed mutation creates only the batch and returns a separate recipient preview, so the second write is never implicit. Add the stable nested batch command surface for add, remove, preview, approve, queue, pause, resume, and cancel. Batch add accepts one reviewed recipient or a bounded JSON/JSONL file. Imports are capped at 500 and the site's remaining batch capacity, preview every row by default, use deterministic row keys, and make their explicitly non-atomic sequential commit behavior visible. Add individual delivery retry, reconcile, and cancel commands through the existing delivery mutation API. Expand CLI help and tests to cover command registration, exact RPC payloads, organization defaults, import bounds and ordering, and the no-implicit-recipient-commit invariant.
Link site-funded reservation IDs to durable ACP session records across project-host SQLite and seed-bay PostgreSQL. Reconcile terminal sessions after a usage-delivery grace period, preserve a conservative rollout fallback for older hosts, and release sessionless orphan reservations only after a longer stale-heartbeat threshold when no healthy session exists. Expose the reservation ID in admin CLI JSON and extend the seed-bay maintenance loop and focused tests around admission, usage accounting, and healthy-session protection.
Check committed idempotency keys before state-dependent validation so retries remain safe after templates, batches, deliveries, suppressions, or follow-up work advance. Validate mutable state under the mutation transaction and hash stable user intent rather than derived template revisions, routing snapshots, or follow-up due timestamps.
Use PostgreSQL's built-in deterministic md5 text hash for reconciliation operation payload identity instead of pgcrypto digest(). The hash is an internal change detector, not a security primitive, and this keeps worker startup compatible with Lite and installations that do not enable pgcrypto.
Use the actual batch recipient subcommand and the canonical adoption_pilot enum value in the bundled admin outreach runbook so agents can execute the documented review workflow verbatim.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Need help on this PR? Tag
@codesmith-botwith what you need. Autofix is disabled.