[waleedlatif1]

Brings dev up to current staging, including #9611, which lets dev's push-managed database bootstrap Projects (the previous sync's deploy stopped at the Project migration guard). The merge result is identical to staging.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Nov 3, 2026 5:13am UTC

[greptile-apps]

Confidence Score: 5/5

[High impact] The PR appears safe to merge; no actionable issues were found.

Summary

Syncs dev with staging and adds a development-only path for databases that predate Projects.

• Development database pushes can bootstrap Projects before enforcing membership.
• Timed-out workbench runs report progress, and reused workbenches check their CLI before running commands.
• Organization administrators can review access requests through Chat.
• Organization Sim links stay available as members leave and change.
• Organization members can leave through a confirmed, role-aware flow.
• Credential member screens support clearer member actions and departure paths.
• Organization account connections and settings have new navigation and actions.
• Workspace updates use a shared path across workspace settings and APIs.
• Chat shows a plan modal when a plan is needed to continue.
• Knowledge-base connectors can enroll members in shared access.
• Workspace permissions control who can change an MCP server destination or rename a table.
• The workflow-platform guides and cover image have updated content.
• Unused-export tracking and a user-profile query file receive cleanup updates.

No actionable issues were found. This review checked source and tests; it did not run the test suites.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Development schema push] --> B[Acquire migration fence]
  B --> C[Prepare Project bootstrap]
  C --> D{Bootstrap pending?}
  D -->|Yes| E[Push nullable Project column]
  E --> F[Run Project membership backfill]
  F --> G[Push final schema]
  D -->|No| G
  G --> H[Run shared reconcilers]

Loading

_{Reviews (1) · Last reviewed commit: "Merge remote-tracking branch 'origin/sta..." · Reviewed by Greptile}

[cubic-dev-ai]

15 issues found across 110 files

Confidence score: 3/5

• In membership.ts, last-workspace self-removal skips the SCIM guard because the caller omits the actor ID, allowing directory-managed members to remove their organization membership. Pass the actor identity on self-removals.
• In update.ts, a concurrent admin demotion can leave the billed account without an admin because the check happens outside the transaction. Revalidate the candidate inside the transaction.
• In session-cli.ts, a directory at a CLI artifact path is treated as a verification failure, so ensureSessionCli skips repair. Check the file type before wrapping the descriptor with os.fdopen.
• In credentials.ts, a committed leave can leave fresh credential caches showing the user still has access if the DELETE response is lost. Invalidate those caches from onSettled.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/sim/app/workspace/[workspaceId]/skills/[skillId]/components/skill-editors-card.tsx">

<violation number="1" location="apps/sim/app/workspace/[workspaceId]/skills/[skillId]/components/skill-editors-card.tsx:55">
P3: The disabled Remove action does not explain why workspace admins cannot be removed. Pass `skillEditorLockReason(editor.isWorkspaceAdmin)` as `disabledReason` so the shared row shows the inheritance explanation on hover.</violation>
</file>

<file name="apps/sim/stores/modals/chat-plan/store.ts">

<violation number="1" location="apps/sim/stores/modals/chat-plan/store.ts:15">
P2: This singleton can leave the paid-plan dialog open after navigating away from the workspace that triggered it, including on organization routes where no chat send occurred. Clear the transient modal state on route/workspace changes or scope it to the initiating workspace.</violation>
</file>

<file name="apps/sim/lib/sim-links/application/create-membership.integration.ts">

<violation number="1" location="apps/sim/lib/sim-links/application/create-membership.integration.ts:83">
P2: This test does not exercise the required `FOR SHARE` lifetime: it removes the member before `createSimLink` starts its insert transaction, so a membership recheck without the lock would still pass. Add synchronization inside the creation transaction, or observe that removal blocks until creation commits, to cover the concurrent-removal case.

(Based on your team's feedback about rechecking membership and holding the member row through commit.)</violation>
</file>

<file name="apps/sim/lib/billing/organizations/membership.ts">

<violation number="1" location="apps/sim/lib/billing/organizations/membership.ts:1393">
P2: The last-workspace self-removal path bypasses this SCIM guard because its caller omits `actorUserId`; pass the actor identity for self-removals so directory-managed members cannot delete their organization membership through workspace removal.</violation>
</file>

<file name="apps/sim/app/o/[organizationId]/components/organization-sidebar/components/organization-header/organization-header.tsx">

<violation number="1" location="apps/sim/app/o/[organizationId]/components/organization-sidebar/components/organization-header/organization-header.tsx:105">
P2: The close guard leaves `isMenuOpen` true, and `stopRenaming` never closes it. After Enter, Escape, or a successful blur, the organization menu remains open; close it when stopping the edit.</violation>

<violation number="2" location="apps/sim/app/o/[organizationId]/components/organization-sidebar/components/organization-header/organization-header.tsx:158">
P2: The controlled dropdown drops its close request while the rename input is mounted, but never replays it after blur or save. Clicking outside during rename therefore leaves the organization menu open, including for unchanged or successfully saved names. Record the pending close request and apply it after blur/save while keeping the menu open for failed saves.</violation>
</file>

<file name="apps/sim/app/workspace/[workspaceId]/components/credential-detail/components/credential-members-section.tsx">

<violation number="1" location="apps/sim/app/workspace/[workspaceId]/components/credential-detail/components/credential-members-section.tsx:103">
P2: While the session query is pending, this treats an admin's own row as another member and renders `Remove` instead of `Leave`. Gate both action branches on a resolved viewer ID; otherwise clicking during that window revokes the admin's membership without the leave confirmation.</violation>
</file>

<file name="apps/sim/lib/settings/sections.ts">

<violation number="1" location="apps/sim/lib/settings/sections.ts:58">
P2: This section is advertised by `settings list` and `settings open` even when Sim links are disabled for the organization. Gate discovery/open on the Sim links rollout flag (and membership) before exposing this section, rather than relying only on the later adapter operations to reject access.</violation>

<violation number="2" location="apps/sim/lib/settings/sections.ts:110">
P2: `settings open` cannot direct the user to the workspace name and logo page because this entry omits `uiSection`, so it returns neither `setupUrl` nor `userSetup`. Set `uiSection: 'general'` so the existing adapter and canonical settings route are exposed together.</violation>
</file>

<file name="apps/sim/lib/execution/remote-sandbox/session-cli.ts">

<violation number="1" location="apps/sim/lib/execution/remote-sandbox/session-cli.ts:23">
P2: A directory at either CLI artifact path is reported as verification failure instead of stale, because `os.fdopen` raises before the non-regular-file check; `ensureSessionCli` then skips repair. Inspect the descriptor with `fstat` before calling `fdopen` so directories exit 10 like other non-regular artifacts.</violation>
</file>

<file name="apps/sim/hooks/queries/credentials.ts">

<violation number="1" location="apps/sim/hooks/queries/credentials.ts:327">
P2: A committed leave can appear to fail when the DELETE response is lost, but `onSuccess` then leaves fresh credential caches showing the user still has access. Invalidate these caches from `onSettled` instead.</violation>
</file>

<file name="apps/sim/lib/mothership/tools/server/settings-operations.ts">

<violation number="1" location="apps/sim/lib/mothership/tools/server/settings-operations.ts:380">
P2: `bulk_add_members` rebuilds the v2 schema from `.shape`, dropping its cross-field validation; `describe` therefore advertises combinations that the operation rejects. Reuse the complete schema and extend it with `groupId`.</violation>
</file>

<file name="apps/sim/lib/workspaces/update.ts">

<violation number="1" location="apps/sim/lib/workspaces/update.ts:58">
P2: `previous` is not read atomically with the update, so concurrent same-field edits produce incorrect audit “from” values. Read and update under one row lock/transaction, or use a version predicate and derive the audit source from the locked row.</violation>

<violation number="2" location="apps/sim/lib/workspaces/update.ts:83">
P2: The billed-account admin check is outside the transaction, so a concurrent demotion can commit before the payer transfer and leave a non-admin billed account. Revalidate the candidate under the transaction’s mutation locks and abort when the permission changed before committing the transfer.</violation>
</file>

<file name="apps/sim/app/workspace/[workspaceId]/settings/components/organization-accounts/organization-accounts.tsx">

<violation number="1" location="apps/sim/app/workspace/[workspaceId]/settings/components/organization-accounts/organization-accounts.tsx:108">
P3: A refetch failure with a cached empty result is shown as a successful empty state, leaving the user no retry control. Gate this empty state on `!accounts.isError` so the error branch remains reachable.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic</sub>

[cubic-dev-ai]

P2: This singleton can leave the paid-plan dialog open after navigating away from the workspace that triggered it, including on organization routes where no chat send occurred. Clear the transient modal state on route/workspace changes or scope it to the initiating workspace.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At apps/sim/stores/modals/chat-plan/store.ts, line 15:

<comment>This singleton can leave the paid-plan dialog open after navigating away from the workspace that triggered it, including on organization routes where no chat send occurred. Clear the transient modal state on route/workspace changes or scope it to the initiating workspace.</comment>

<file context>
@@ -0,0 +1,24 @@
+ * the send started (the composer, a queued message, a handoff from another surface), and the
+ * workspace shell renders the one modal.
+ */
+export const useChatPlanModalStore = create<ChatPlanModalState>()(
+  devtools(
+    (set) => ({
</file context>

[cubic-dev-ai]

P2: This test does not exercise the required FOR SHARE lifetime: it removes the member before createSimLink starts its insert transaction, so a membership recheck without the lock would still pass. Add synchronization inside the creation transaction, or observe that removal blocks until creation commits, to cover the concurrent-removal case.

(Based on your team's feedback about rechecking membership and holding the member row through commit.)

View Feedback

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At apps/sim/lib/sim-links/application/create-membership.integration.ts, line 83:

<comment>This test does not exercise the required `FOR SHARE` lifetime: it removes the member before `createSimLink` starts its insert transaction, so a membership recheck without the lock would still pass. Add synchronization inside the creation transaction, or observe that removal blocks until creation commits, to cover the concurrent-removal case.

(Based on your team's feedback about rechecking membership and holding the member row through commit.) </comment>

<file context>
@@ -0,0 +1,101 @@
+  await authorized.promise
+  expect(
+    (
+      await removeUserFromOrganization({
+        organizationId,
+        userId: creatorId,
</file context>

[cubic-dev-ai]

P2: The last-workspace self-removal path bypasses this SCIM guard because its caller omits actorUserId; pass the actor identity for self-removals so directory-managed members cannot delete their organization membership through workspace removal.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At apps/sim/lib/billing/organizations/membership.ts, line 1393:

<comment>The last-workspace self-removal path bypasses this SCIM guard because its caller omits `actorUserId`; pass the actor identity for self-removals so directory-managed members cannot delete their organization membership through workspace removal.</comment>

<file context>
@@ -1384,8 +1388,11 @@ export async function removeUserFromOrganization(
-        if (actorUserId)
+        if (actorUserId) {
           await requireMemberManagementAuthority(tx, organizationId, actorUserId, userId)
+          if (actorUserId === userId)
+            await assertSelfLeaveNotScimManaged({ organizationId, userId, executor: tx })
+        }
</file context>

[cubic-dev-ai]

P2: The close guard leaves isMenuOpen true, and stopRenaming never closes it. After Enter, Escape, or a successful blur, the organization menu remains open; close it when stopping the edit.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At apps/sim/app/o/[organizationId]/components/organization-sidebar/components/organization-header/organization-header.tsx, line 105:

<comment>The close guard leaves `isMenuOpen` true, and `stopRenaming` never closes it. After Enter, Escape, or a successful blur, the organization menu remains open; close it when stopping the edit.</comment>

<file context>
@@ -85,13 +102,37 @@ export function OrganizationHeader({
   }
 
   const { memberCount } = organization
+  const stopRenaming = () => {
+    setDraftName(null)
+    renameOrganization.reset()
</file context>

Suggested change

	const stopRenaming = () => {
	setDraftName(null)
	renameOrganization.reset()
	}
	const stopRenaming = () => {
	setDraftName(null)
	setIsMenuOpen(false)
	renameOrganization.reset()
	}

[cubic-dev-ai]

P2: While the session query is pending, this treats an admin's own row as another member and renders Remove instead of Leave. Gate both action branches on a resolved viewer ID; otherwise clicking during that window revokes the admin's membership without the leave confirmation.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At apps/sim/app/workspace/[workspaceId]/components/credential-detail/components/credential-members-section.tsx, line 103:

<comment>While the session query is pending, this treats an admin's own row as another member and renders `Remove` instead of `Leave`. Gate both action branches on a resolved viewer ID; otherwise clicking during that window revokes the admin's membership without the leave confirmation.</comment>

<file context>
@@ -64,22 +99,56 @@ export function CredentialMembersSection({ credentialId, isAdmin }: CredentialMe
               member.roleSource !== 'workspace-admin' &&
               explicitAdminCount <= 1
+            const actionDisabled = roleLocked || lockReason !== null
+            const action: MemberRowAction | null =
+              member.userId === viewerId
+                ? {
</file context>

Suggested change

	const action: MemberRowAction | null =
	member.userId === viewerId
	? {
	label: 'Leave',
	disabled: actionDisabled,
	disabledReason:
	lockReason ??
	(roleLocked ? 'Make someone else an admin before leaving' : null),
	onSelect: () => setIsLeaveConfirmOpen(true),
	}
	: isAdmin
	? {
	label: 'Remove',
	disabled: actionDisabled,
	onSelect: () => handleRemoveMember(member.userId),
	}
	: null
	const action: MemberRowAction | null =
	viewerId !== undefined && member.userId === viewerId
	? {
	label: 'Leave',
	disabled: actionDisabled,
	disabledReason:
	lockReason ??
	(roleLocked ? 'Make someone else an admin before leaving' : null),
	onSelect: () => setIsLeaveConfirmOpen(true),
	}
	: viewerId !== undefined && isAdmin
	? {
	label: 'Remove',
	disabled: actionDisabled,
	onSelect: () => handleRemoveMember(member.userId),
	}
	: null

[cubic-dev-ai]

P2: previous is not read atomically with the update, so concurrent same-field edits produce incorrect audit “from” values. Read and update under one row lock/transaction, or use a version predicate and derive the audit source from the locked row.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At apps/sim/lib/workspaces/update.ts, line 58:

<comment>`previous` is not read atomically with the update, so concurrent same-field edits produce incorrect audit “from” values. Read and update under one row lock/transaction, or use a version predicate and derive the audit source from the locked row.</comment>

<file context>
@@ -0,0 +1,128 @@
+    throw new OrchestrationError('validation', 'No updates provided')
+  }
+
+  const [previous] = await db
+    .select()
+    .from(workspace)
</file context>

[cubic-dev-ai]

P2: The billed-account admin check is outside the transaction, so a concurrent demotion can commit before the payer transfer and leave a non-admin billed account. Revalidate the candidate under the transaction’s mutation locks and abort when the permission changed before committing the transfer.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At apps/sim/lib/workspaces/update.ts, line 83:

<comment>The billed-account admin check is outside the transaction, so a concurrent demotion can commit before the payer transfer and leave a non-admin billed account. Revalidate the candidate under the transaction’s mutation locks and abort when the permission changed before committing the transfer.</comment>

<file context>
@@ -0,0 +1,128 @@
+        'Personal workspaces are always billed to their owner and cannot change billed account.'
+      )
+    }
+    const candidatePermission = await getEffectiveWorkspacePermission(billedAccountUserId, previous)
+    if (candidatePermission !== 'admin') {
+      throw new OrchestrationError('validation', 'Billed account must be a workspace admin')
</file context>

[cubic-dev-ai]

P2: The controlled dropdown drops its close request while the rename input is mounted, but never replays it after blur or save. Clicking outside during rename therefore leaves the organization menu open, including for unchanged or successfully saved names. Record the pending close request and apply it after blur/save while keeping the menu open for failed saves.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At apps/sim/app/o/[organizationId]/components/organization-sidebar/components/organization-header/organization-header.tsx, line 158:

<comment>The controlled dropdown drops its close request while the rename input is mounted, but never replays it after blur or save. Clicking outside during rename therefore leaves the organization menu open, including for unchanged or successfully saved names. Record the pending close request and apply it after blur/save while keeping the menu open for failed saves.</comment>

<file context>
@@ -110,25 +151,34 @@ export function OrganizationHeader({
+        open={isMenuOpen}
+        onOpenChange={(open) => {
+          // The input's blur saves the draft; closing now would unmount it and hide a failure.
+          if (!open && draftName !== null) return
+          setIsMenuOpen(open)
+        }}
</file context>

[cubic-dev-ai]

P3: The disabled Remove action does not explain why workspace admins cannot be removed. Pass skillEditorLockReason(editor.isWorkspaceAdmin) as disabledReason so the shared row shows the inheritance explanation on hover.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At apps/sim/app/workspace/[workspaceId]/skills/[skillId]/components/skill-editors-card.tsx, line 55:

<comment>The disabled Remove action does not explain why workspace admins cannot be removed. Pass `skillEditorLockReason(editor.isWorkspaceAdmin)` as `disabledReason` so the shared row shows the inheritance explanation on hover.</comment>

<file context>
@@ -47,10 +47,17 @@ export function SkillEditorsCard({ editors, canEdit }: SkillEditorsCardProps) {
+                canEdit
+                  ? {
+                      label: 'Remove',
+                      disabled: editor.isWorkspaceAdmin,
+                      onSelect: () => editors.removeEditor(editor.userId),
+                    }
</file context>

Suggested change

	disabled: editor.isWorkspaceAdmin,
	disabled: editor.isWorkspaceAdmin,
	disabledReason: skillEditorLockReason(editor.isWorkspaceAdmin),

[cubic-dev-ai]

P3: A refetch failure with a cached empty result is shown as a successful empty state, leaving the user no retry control. Gate this empty state on !accounts.isError so the error branch remains reachable.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At apps/sim/app/workspace/[workspaceId]/settings/components/organization-accounts/organization-accounts.tsx, line 108:

<comment>A refetch failure with a cached empty result is shown as a successful empty state, leaving the user no retry control. Gate this empty state on `!accounts.isError` so the error branch remains reachable.</comment>

<file context>
@@ -0,0 +1,199 @@
+          />
+        ) : accounts.isPending ? (
+          <SettingsEmptyState>Loading connected accounts…</SettingsEmptyState>
+        ) : list.length === 0 ? (
+          <SettingsEmptyState>No accounts connected for an organization</SettingsEmptyState>
+        ) : (
</file context>

Suggested change

	) : list.length === 0 ? (
	) : list.length === 0 && !accounts.isError ? (