Apps: promote stage → stage-apps (v111.146.2) by evereq · Pull Request #11626 · ever-co/ever-gauzy

evereq · 2026-11-02T01:09:27Z

Promotes stage (ee004e7cf9, tagged v111.146.2 by Release Stage) to stage-apps as a merge commit, so the 6 app prerelease workflows build at that version. The check-release-tag gate resolves the tag on HEAD^2.

Content: the 2026-11-01 release (#11625). It includes Ever Connect identity (#11567), billing fences (#11570 / #11604), the Ever Works inbox push (#11543), dependency bumps and CI fixes.

🤖 Generated with Claude Code

Summary by cubic

Promotes stage (tagged v111.146.2 by Release Stage) to stage-apps as a merge commit, so the 6 app prerelease workflows build at that version. The check-release-tag gate resolves the tag on HEAD^2.

Carries the 2026-11-01 release: Ever Connect identity (#11567), billing fences (#11570 / #11604), the Ever Works inbox push (#11543), plus dependency bumps and CI fixes.

^{Written for commit ee004e7. Summary will update on new commits.}

…e disallowed Where a route disallows past dates, minDate is today, but the menu still listed Yesterday, Last Week, Last Month and now Last Year. The picker library keeps such an entry in its list, and picking it gave a range starting today and ending in the past. The presets now start on minDate at the earliest, and the ones that end before its day are not offered. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…ogging-1769-4006 feat(core): opt-in DB_CREATE_IF_NOT_EXISTS and LOG_HTTP_REQUESTS

The template gate now also requires the web app to be served: App Platform must send the web app's paths to the webapp component, and the Caddyfile must keep a catch-all `handle { reverse_proxy webapp:... }` (a missing, redirected or misdirected fallback is reported). An env sample secret counts as empty only when nothing follows the `=`, or empty quotes optionally followed by a comment: compose reads `KEY= # note` as the value `# note`, which `${KEY:?}` accepts. SECURITY.md names WSS for WebSocket connections, and the README says that App Platform loses files stored in the API container on every redeploy. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…for ShellCheck The sed expression that strips dotenv's backtick quotes holds literal backticks in single quotes, which ShellCheck reads as an unexpanded command substitution (SC2016). Say so and disable that check for the one command. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…s refunded A line granted again after a revocation holds the revoked right next to its live one, and the partial-refund path lowered both: it rewrote the revoked row's quantity and appended a reduction event for it. The refund handler now skips rights that are already revoked, so only the rights still standing are lowered or withdrawn. Withdrawal replays are unchanged. The dual-ORM spec revokes and re-grants a line, delivers a partial refund through the real consumer, and asserts that only the live right is lowered, on TypeORM and MikroORM. Refs #11023 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…t spans it Two separate one-day recurring holidays on 28 February and 1 March no longer make 29 February a holiday in leap years; the leap day is added per holiday range before it joins the shared set. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…cuments When several documents carry the form's name, one with an http(s) link now comes before a newer one whose link is not, so the dialog downloads the form instead of reporting it unavailable. A form whose only link is not http(s) is still found, so the dialog keeps saying it cannot be downloaded. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…andidates and contacts Contact details hold the inverse side of their one-to-one with an employee, a candidate and an organization contact, so saving new details that name one re-points that record to them. A caller creating without ORG_CONTACT_EDIT is now refused (403) when the new details name any of the three. Refs #5468 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

The migration runs before the API starts. It now reads once per grant and writes the missing rows and the rows to switch on in bounded multi-row statements (at most 900 bind parameters each, as the permission reload does), instead of one statement per role. The spec counts the statements for 600 editor roles. Refs #5468 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…f-eea-gate-9872 feat(organization): screen capture off for new organizations, EEA/UK acknowledgement to turn it on

…es open The header's "Create lead / customer / client" quick actions and the sidebar's "+" links open a contacts page's add form. They now show to those who saw them before (ORG_CONTACT_EDIT or ALL_ORG_EDIT) and to holders of ORG_CONTACT_ADD who can also open the contacts pages (ORG_CONTACT_VIEW), so a create-only user is not sent to a page that turns them away. The rule lives in one helper, mayOpenContactAddForm, in @gauzy/ui-core/core. Refs #5468 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…k answers The buttons waited for every plugin's config check together, so one slow check held back the buttons whose checks had already answered. Each check now starts hidden and shows its button on its own answer; the order of the buttons is unchanged. Refs #42 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

- loadAvailableModules now ignores an answer once the selected project has changed, so modules requested for a project that a client cleared meanwhile are not offered, or saved, without a project. - The new Client label is tied to the selector's input. ga-contact-selector gets an optional labelForId input, passed to ng-select's labelForId; left unset, nothing changes for its other users. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

A form's selector re-applied ?projectId= on any reload that found it empty, so a project the form had cleared (by hand, or because a client excluded it) came back once the client was cleared again. The URL's project is now a form selector's starting value only: its first list, while nothing is selected. The global selector still follows the URL on every load. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

A locked picker widens every pick to one whole unit, but isCustomDate compared that with the presets. Where future dates are disallowed the current month preset ends today, so the whole month counted as custom and Previous stepped back 31 days (31 Aug to 30 Sep from October) instead of one month. The check moves to a pure isCustomDateRange helper that returns false for locked pickers. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…d-ux-7643-7683-6715-7141 feat(desktop): screenshot popup close button, remembered mini timer position, custom and start/stop sounds

…approval-10183-5481 Both sides add one export to packages/ui-core/common/src/index.ts; both are kept. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…-10183-5481 feat(time-off): take approved leave from the balance and fix the request-form download

feat(plugin-auth-oidc): sign in with any OpenID Connect provider

…tage Adds an opt-in Board view to a pipeline's Deals page, next to the table and the cards grid (both stay as they are and remain the default). Each stage is a column, in the stages' order; each card names the deal, its client, its probability chip and who created it. A user with EDIT_SALES_PIPELINES drags a card to another column to move the deal to that stage: the card moves at once, shows a spinner while the deal is saved through the existing PUT /deals/:id endpoint (stage and scope only, so a stale title or probability is never written back), and goes back with the error if the save fails. Users without the permission see the board read-only. The view follows a `view=board` query parameter so it can be linked to and survives a reload. The board reuses the tasks board's column and card styles and the deals table's probability chip; the chip's level logic moves into a shared helper used by both. Refs #1660 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

The template gate now works out where the Caddyfile sends each path the way Caddy does: `handle` blocks are mutually exclusive and sorted by matcher (a path matcher first, longest path first; then named matchers in order; then the one without a matcher), and a `reverse_proxy` outside any `handle` block runs only when none matched. Each API path must resolve to the API and each web app path to the web app. Before, a `handle /dashboard/* { reverse_proxy webapp:... }` passed as the catch-all, and a `handle /graphql { reverse_proxy webapp:... }`, which Caddy tries before `handle @api`, did not fail the /graphql check. The README lists /swg-json and /swg-yaml with the other API paths. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

… lock The refund path skipped revoked rights by the status it had read, so a revocation committing between that read and reduce() could still have its quantity lowered and a reduction event appended. reduce() now checks the status of the row it holds locked: a revoked right permits nothing, so every reduction of it already holds, and it is answered as it stands with no write and no event, as revoke() and a reduction to zero already do. The consumer's own status check is dropped, so the rule lives in one place. Refs #11023 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

The dialog subscribed to project changes only after initializeForm and the selected-project subscription had set the project, so neither loaded its modules. They loaded only because the project selector then re-applied the URL's project, which it no longer does over a form's own project. Editing a task from its project's page would then have offered no modules, and saving it unchanged would have dropped them. The project-change subscription now comes first in ngOnInit, so the task's project and the page's selected project load their modules themselves. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…board The project management dashboard gets a Recent activity panel, beside the Inbox placeholder (kept): what was created, changed or deleted in the organization, newest first, ten at a time with "Show more". Each row names the record (linking tasks and projects to their pages), what was done, by whom, the fields an update changed, and how long ago. It narrows to tasks or projects, refreshes on demand, and has loading, empty and error states. The rows come from the existing GET /activity-log through a new ui-core ActivityLogService (page number as `skip`, organization always sent, absent filters left out). What a user sees stays the API's decision: someone who may not change the selected employee sees only their own activity. Refs #4848 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

#3912) Settings > Roles & Permissions listed 368 toggles by label only; the grey line under each label once repeated the label itself and was removed in #9877, so no permission said what it lets a role do. - i18n: ORGANIZATIONS_PAGE.PERMISSIONS.DESCRIPTIONS.<permission value> for every permission the page lists, in all 14 language files (ach carries English, as the rest of ach.json does). Added as the first child of PERMISSIONS: additions only, no existing line changes. The commerce ones follow the descriptions the plugins already declare in their permission contributions, worded for users. - The page reads each label and description once per language through TranslateService.stream (not two pipes per row), shows the description as help text under the label (left out when a permission has none, so a raw key never shows), and the search now also matches the translated label and description; matching the code as words still works, so results only grow. - permission-texts.ts: pure helpers (keys by permission value, absent-text handling, search matching), with specs; permission-i18n.spec.ts now fails CI when a listed permission has no description in a language, a description is keyed by something that is no permission value, or it repeats the label. - Drops a leftover console.log from the search filter. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…at is stored The agent exit/logout restriction check on organization update took the country after the update from a top-level `country` in the request, which the organization does not store (it keeps its country on its contact). It now judges the location the way the screen capture check does: the stored region code, time zone and contact country, plus the values the write stores (region code, time zone, the country of a contact it carries or links by id). - New organization-location.ts holds the shared location helpers (moved from screenshot-capture-acknowledgement.ts) and organizationLocations(), used by both checks and by the "moved into the EEA/UK" step that lifts employee restrictions. - A contact the write links by id is read whenever it is not the current one, since the exit/logout rule depends on the location too. - Specs: a request with only an unstored country does not change any decision; linked and carried contacts count; the stored location counts too. Refs #9873 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…nt-11023 fix(entitlement): race-safe grant and activation on a late order.placed

The edit dialog closes on an Escape keyup that reaches the document, so pressing Escape to dismiss the banner hint also closed the dialog and threw away unsaved edits. Escape is now handled on keyup: while the hint is open it closes the hint and stops there; with the hint closed it reaches the dialog as before. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…6569) PUT /organization-team (and the GraphQL updateOrganizationTeam) rewrote every member the edit did not name as a manager with no role, so a custom team role given to a member was lost on each edit of the team. #6570 had fixed this in 2023; a later rewrite of updateOrganizationTeam brought it back. teamRoleAfterEdit (team-manager-membership.ts) now decides the role of a member already on the team: named as a manager -> the MANAGER role (unchanged); any other member keeps the role they hold, unless it is the MANAGER role or another of TEAM_MANAGER_ROLES (ADMIN, SUPER_ADMIN), which a manager left out loses as before. Nobody keeps manager authority the edit took away, nothing new can be granted (no DTO change), and a row is still written only when its role or (for a caller who sets it) its manager flag changes. Specs: the helper on its own, and the service edit keeping a custom role without a write, clearing only the flag, promoting and demoting as before, dropping an ADMIN/SUPER_ADMIN team role, and writing nothing for an unchanged team. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…order The template gate's Caddy reader now covers the other routing blocks and sorts routes exactly as Caddy's sortRoutes does: - handle_path blocks are sorted with the handle blocks (Caddy normalizes the name), and a prefix they strip is reported for API paths; route blocks follow, then reverse_proxy lines outside any block. - Order within each: two blocks with exactly one path each by length (without a trailing *); otherwise a block with a matcher before one without; otherwise as written, by a stable insertion sort. The previous rule (any path matcher before named matchers) was wrong: Caddy keeps a handle /graphql written after handle @api behind it. - A reverse_proxy nested in a block the reader does not model (handle_errors, a block inside a route block, a snippet) is ignored, so a scoped route such as `route /dashboard/* { ... }` is never taken for the catch-all; an unscoped `route { ... }` still is. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

fix(subscription): cspell ignores bookkept / Finishable in the billing service and its spec

…swered copy, write-only 412, sending resumes Findings of Greptile, Copilot and CodeRabbit on 20c49fa: - A copy the member answered comes back out of an archive made in Gauzy: the move to `resolved` is kept (without a resolution, so the member's answer stays). - A key with `inbox:write` but no `inbox:read` answers a 412 by sending once more on the version the 412 names (`details.current`), instead of a read it may not do. - The preferences page says `missing_scope` when the connection's key may not file inbox items. - INBOX_PUSH_SINCE moves whenever sending resumes (the mapping, its InboxItem setting or the inbox direction), not only on a direction change. - The preview reads the paired people once, not per page. - Inbox page: a link removed (another tab chosen) cancels its pending read, and a linked item is read once the list is served, so the list never lands over it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…box-push Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…14 cadence - every_trigger: the row-14 wait now requires the sign-in client's GET (the identity worker's read) as well as the POST sent with the accept, so the disconnect cannot stop the worker before the read is audited (Copilot). - outbound-calls: row 14's "How often" gives Gauzy's own schedule (a read 5 s after the request, the wait doubling up to every 5 minutes) through gauzy_rows, as row 8 does (cubic). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

The sign-in client is asked for when ever_id_login is enabled; a request that failed is sent again 30 s later, the wait doubling up to an hour (EverIdLoginHandler.ensureRequested); the read runs on the worker's next 15 s pass at least 5 s later (CodeRabbit). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…p on unarchive, backfill checkpoint, link guards Findings of Greptile, Copilot and CodeRabbit on b7c9d3e: - A copy the member answered, unarchived by Gauzy, keeps the member as the owner of its answer (a later Gauzy answer never goes over it). - The inbox backfill checks the lease right after a page is read, and saves the run's checkpoint after each page, stopping when the run ended. - The run plan names a missing inbox:write scope for an inbox that only sends; the inbox preview never counts this key's own filings as new items. - Inbox page: a link that waited for the list never replaces an item opened meanwhile (success or failure of its read); a link waiting during "load more" opens with that page. - i18n: "no other items". Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…hrough A 422 refusal is stored as final (enabled() keeps it and ensureRequested() skips a stored state); only no answer or another error is asked again by the worker, 30 s later, the wait doubling up to an hour (cubic). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…only inbox, Angular conventions Findings of cubic, Greptile and CodeRabbit on ab2f973: - A send-only inbox mapping whose key lacks both inbox scopes is told that it lacks inbox:write, the scope it needs. - The Ever Works inbox settings component keeps its template-only helpers protected and its ngOnInit to a named setup. - The write-only 412 spec also shows a member's answer reaching Gauzy through the PATCH answer (its own event is then not needed). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

fix(egress-audit): move the harness to @ever-co/connect-tools 1.0.0-rc.8

CodeRabbit (outside-diff, on a1b9595): when the organization is no longer mapped, the outbound queue refuses the row; the backfill now stops before it instead of moving its cursor past it, so the row is not skipped when the run resumes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…box-push Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…rite-only 412, zoned SQLite times, last toggle Findings of Greptile and Copilot on e1b08b3: - A key without inbox:read never resends Gauzy's answer blind after a 412: the rest of the change goes first, and its PATCH answer tells whether the member answered; the answer follows on the next try or stays out. - The Inbox feed marks SQLite's zone-less UTC datetimes as UTC, so the recovery sweep reads them the same in every process time zone. - INBOX_PUSH_SINCE follows the last InboxItem toggle of a request, the one saved. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

feat(ever-works): send the Gauzy Inbox's own items to Ever Works, per person and kind

…inted The Check Spelling job on develop (9631807, #11543) flags these three words. File-level directives keep the exceptions local. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

fix(inbox,ever-works): cspell ignores datetimes / refetched / checkpointed

Release: develop → stage (2026-11-01: Ever Connect identity, billing fences, Ever Works inbox push, deps, CI fixes)

coderabbitai · 2026-11-02T01:09:39Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: ASSERTIVE
Plan: Advanced
Run ID: 9e7f6358-43b6-43b1-991b-bcc539dfbb61

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

evereq · 2026-11-02T01:09:51Z

Note on the review rule: this PR was merged right after it was opened, before the bots ran. Its content equals stage: git merge-tree of stage-apps + stage gives a tree identical to stage ee004e7cf9. Every change in it was reviewed in its own PR and in the stage cascade #11625 (CodeQL's 7 alerts answered there). Any bot comment that arrives here will be read and answered after the merge; this is tracked in the release handover.

greptile-apps · 2026-11-02T01:13:43Z

Confidence Score: 4/5

[Critical impact] The release reaches account deletion, billing, access rules, and shared app workflows.

The PR appears safe to merge, with two non-blocking account-deletion fixes recommended.

Findings

Restarts lose pending file cleanup ▶
Unicode email addresses never match ▶

Summary

Promotes the stage release to stage-apps for the app prerelease builds.

People can preview and confirm account deletion from an emailed link.
Ever Connect can link Ever ID identity to sign-in and data requests.
Operators can control self-registration and admin password resets.
Ever Works can mirror inbox updates with per-person preferences.
Subscription changes coordinate charges and keep live entitlements tied to order lines.
Time-off approvals and edits keep leave balances in step with requests.
Comment reads follow parent-record access, and contact creation cannot edit existing records.
Project dashboards show recent activity and let people narrow board cards.
Operators can provision a missing database and log requests with sensitive URL values hidden.
Release and deployment workflows add support for the promoted app builds and self-hosting.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Review account deletion] --> B[Confirm deletion]
    B --> C[Collect file keys]
    C --> D{Delete whole workspace?}
    D -- Yes --> E[Remove files before deleting rows]
    D -- No --> F[Keep file keys in memory]
    F --> G[Delete account and commit]
    G --> H[Remove files]
    G -. Restart loses pending cleanup .-> I[Files remain in storage]

_{Reviews (1) · Last reviewed commit: "Merge pull request #11625 from ever-co/d..." · Reviewed by Greptile}

Copilot

🟡 Changes recommended

Percent-encoded parameter names bypass URL redaction, leaving single-use authentication secrets exposed in Sentry navigation breadcrumbs.

1 open issue

Decode encoded parameter names before redacting secrets · New

What changed in this PR

Promotes stage at v111.146.2 to stage-apps for six app prerelease builds, carrying the November 1 release and supporting dependency, UI, desktop, and CI updates.

Changes:

Extend OIDC/Ever ID authentication, registration controls, account deletion, and permission boundaries.
Update billing, entitlement, inbox integrations, reporting, and shared UI behavior.
Improve desktop settings and notifications; refresh dependencies, build configuration, and E2E selectors.

This pull request requires changes. The unresolved critical issue in packages/ui-core/common/src/lib/utils/redact-url-secrets.ts:5 allows percent-encoded parameter names, such as %74oken, to bypass redaction and expose single-use secrets in Sentry navigation breadcrumbs. Decode parameter names before checking them in both ordinary and hash-routed queries.

File	Description
`tsconfig.json`	Add OIDC plugin alias.
`tools/ever-platform/fixtures/import-bad/packages/plugins/ever-connect/src/connect-imports-zitadel-file.ts`	Add forbidden-import fixture.
`tools/egress-audit/patch-mock-clock.mjs`	Support rc.8 mock patching.
`tools/egress-audit/package.json`	Update audit dependencies.
`tools/egress-audit/egress-audit.config.json`	Expand audited trigger rows.
`packages/ui-core/static/styles/gauzy/_rich-text-editor.scss`	Style read-only rich text.
`packages/ui-core/static/styles/gauzy/_gauzy-overrides.scss`	Include rich-text styling.
`packages/ui-core/shared/src/lib/timesheet/gauzy-filters/gauzy-filters.component.html`	Add filter-action projection.
`packages/ui-core/shared/src/lib/time-off/settings-mutation/time-off-settings-mutation.component.html`	Expose balance requirement.
`packages/ui-core/shared/src/lib/tasks/task-status-select/task-status-select.module.ts`	Update status-selector imports.
`packages/ui-core/shared/src/lib/tasks/task-select/task/task.component.html`	Bind combobox accessibility attributes.
`packages/ui-core/shared/src/lib/tasks/add-task-dialog/add-task-dialog.module.ts`	Import contact selector and numbering pipe.
`packages/ui-core/shared/src/lib/table-components/project-organization/project-organization.component.html`	Show archived-project badge.
`packages/ui-core/shared/src/lib/selectors/team/team/team.component.ts`	Clear removed global team selection.
`packages/ui-core/shared/src/lib/selectors/date-range-picker/date-range-picker.component.html`	Disable unavailable previous ranges.
`packages/ui-core/shared/src/lib/selectors/date-range-picker/date-picker.interface.ts`	Add yearly range presets.
`packages/ui-core/shared/src/lib/report/index.ts`	Export report utilities.
`packages/ui-core/shared/src/lib/report/export/index.ts`	Expose report-export APIs.
`packages/ui-core/shared/src/lib/report/expenses-report-grid/expenses-report-grid.component.html`	Link employees to profile views.
`packages/ui-core/shared/src/lib/report/daily-grid/daily-grid.component.html`	Link employees to profile views.
`packages/ui-core/shared/src/lib/report/amounts-owed-grid/amounts-owed-grid.component.html`	Link employees to profile views.
`packages/ui-core/shared/src/lib/report/activities-report-grid/activities-report-grid.component.html`	Link employees to profile views.
`packages/ui-core/shared/src/lib/record-view/record-view.component.ts`	Recognize first-party placeholder avatars.
`packages/ui-core/shared/src/lib/project/project-mutation/project-mutation.component.ts`	Use API placeholder images.
`packages/ui-core/shared/src/lib/organizations/index.ts`	Export capture-acknowledgement dialog.
`packages/ui-core/shared/src/lib/favorite-toggle/favorite-toggle.component.ts`	Add button appearance input.
`packages/ui-core/shared/src/lib/favorite-toggle/favorite-toggle.component.html`	Apply button appearance.
`packages/ui-core/shared/src/lib/expenses/expenses-mutation/expenses-mutation.component.scss`	Style attached-receipt indicator.
`packages/ui-core/shared/src/lib/expenses/expenses-mutation/expenses-mutation.component.html`	Show receipt attachment status.
`packages/ui-core/shared/src/lib/expenses/expenses-mutation/attach-receipt/attach-receipt.component.ts`	Normalize existing receipt values.
`packages/ui-core/shared/src/lib/expenses/expenses-mutation/attach-receipt/attach-receipt.component.scss`	Style empty receipt hint.
`packages/ui-core/shared/src/lib/expenses/expenses-mutation/attach-receipt/attach-receipt.component.html`	Display empty receipt guidance.
`packages/ui-core/shared/src/lib/dialogs/dialogs.module.ts`	Import drag-and-drop support.
`packages/ui-core/shared/src/lib/contact-selector/contact-selector.component.html`	Bind contact input label ID.
`packages/ui-core/shared/src/lib/components/email-verification-notice/email-verification-notice.component.ts`	Remove unused CommonModule import.
`packages/ui-core/shared/src/lib/components/changelog-entry/changelog-entry.component.html`	Render release dates in UTC.
`packages/ui-core/project.json`	Model configuration through Nx dependencies.
`packages/ui-core/core/src/lib/utils/index.ts`	Export permission and capture utilities.
`packages/ui-core/core/src/lib/services/quick-actions/index.ts`	Export quick-action APIs.
`packages/ui-core/core/src/lib/services/index.ts`	Expose activity and quick-action services.
`packages/ui-core/core/src/lib/services/deals/deals.service.ts`	Add stage-only deal updates.
`packages/ui-core/core/src/lib/services/auth/index.ts`	Export registration configuration service.
`packages/ui-core/core/src/lib/services/activity-log/index.ts`	Export activity-log service.
`packages/ui-core/core/src/lib/directives/index.ts`	Export registration visibility directive.
`packages/ui-core/core/src/lib/auth/registration-enabled.guard.ts`	Guard closed registration routes.
`packages/ui-core/core/src/lib/auth/index.ts`	Export registration route guard.
`packages/ui-core/common/src/lib/utils/redact-url-secrets.ts`	Add telemetry URL redaction; critical encoded-name bypass remains unresolved.
`packages/ui-core/common/src/lib/utils/placeholder-image.ts`	Build API placeholder URLs.
`packages/ui-core/common/src/lib/constants/app.constants.ts`	Replace third-party placeholder constant.
`packages/ui-core/common/src/index.ts`	Export shared utility APIs.
`packages/ui-config/src/lib/environments/model.ts`	Add OIDC sign-in URL setting.
`packages/ui-auth/src/lib/components/social-links/social-links.component.html`	Support provider label parameters.
`packages/ui-auth/src/lib/components/login/login.component.html`	Gate registration; link account deletion.
`packages/ui-auth/src/lib/components/login-workspace/login-workspace.component.html`	Gate registration link.
`packages/ui-auth/src/lib/components/login-magic/login-magic.component.html`	Gate registration link.
`packages/ui-auth/src/lib/components/forgot-password/forgot-password.component.html`	Gate registration link.
`packages/plugins/subscription/src/lib/subscription/subscription.entity.ts`	Track reserved target plans.
`packages/plugins/subscription/src/lib/subscription-streamed-events.ts`	Add settlement/change event names.
`packages/plugins/subscription/src/lib/subscription-streamed-events.spec.ts`	Update event catalogue expectations.
`packages/plugins/subscription/src/lib/subscription-item/subscription-item.service.spec.ts`	Extend catalogue test doubles.
`packages/plugins/registry/src/lib/application/plugin-tenant/queries/handlers/get-plugin-tenant-users.handler.ts`	Replace raw-row placeholder avatars.
`packages/plugins/registry/src/lib/application/plugin-subscription/commands/upgrade-plugin-subscription.command.ts`	Carry route plugin identity.
`packages/plugins/registry/src/lib/application/plugin-subscription/commands/downgrade-plugin-subscription.command.ts`	Carry route plugin identity.
`packages/plugins/public-layout-ui/src/lib/public-layout.routes.ts`	Guard public workspace creation.
`packages/plugins/public-layout-ui/jest.config.ts`	Load shared Angular test defaults.
`packages/plugins/posthog/src/lib/posthog.service.ts`	Correct exception capture arguments.
`packages/plugins/posthog-ui/src/lib/services/posthog-manager.service.ts`	Use guarded recording entrypoint.
`packages/plugins/order/src/index.ts`	Export order-state reader.
`packages/plugins/job-proposal-ui/src/lib/proposal/components/proposal/proposal.component.ts`	Open author profile views.
`packages/plugins/job-proposal-ui/src/lib/proposal/components/proposal/proposal.component.html`	Configure card author navigation.
`packages/plugins/integration-zapier/src/lib/zapier.types.ts`	Define webhook/public OAuth contracts.
`packages/plugins/integration-zapier/src/lib/zapier.service.settings.spec.ts`	Expect webhook settings output.
`packages/plugins/integration-zapier/src/lib/zapier.config.ts`	Define webhook storage limit.
`packages/plugins/integration-zapier/src/lib/dto/index.ts`	Export settings update DTO.
`packages/plugins/integration-sim/src/lib/handlers/sim-timer-stopped.handler.ts`	Redact private tasks in timer events.
`packages/plugins/integration-sim/src/lib/handlers/sim-timer-started.handler.ts`	Redact private tasks in timer events.
`packages/plugins/integration-sim/src/lib/handlers/sim-task-event.handler.ts`	Filter disallowed task synchronization.
`packages/plugins/integration-plane/src/lib/plane-integration.service.ts`	Clarify loopback proxy behavior.
`packages/plugins/integration-plane/package.json`	Update Plane dependencies.
`packages/plugins/integration-github/src/lib/github/commands/handlers/task.update-or-create.handler.ts`	Enforce third-party task sync scope.
`packages/plugins/integration-github-ui/src/index.ts`	Export project-sync UI APIs.
`packages/plugins/integration-ever-works/src/lib/sync/ever-works-sync.context.ts`	Track originating inbox recipient.
`packages/plugins/integration-ever-works/src/lib/sync/entities/ever-works-sync.entities.ts`	Add Gauzy inbox link type.
`packages/plugins/integration-ever-works/src/lib/mapping/dto/ever-works-mapping.dto.ts`	Validate optional inbox backfill.
`packages/plugins/integration-ever-works-ui/src/lib/components/preview/ever-works-preview.component.ts`	Show truncated preview counts.
`packages/plugins/integration-activepieces/src/lib/dto/index.ts`	Export MCP creation DTO.
`packages/plugins/inbox/src/lib/inbox-item.mapper.ts`	Centralize inbox JSON mapping.
`packages/plugins/inbox/src/index.ts`	Export inbox feed API.
`packages/plugins/inbox-ui/src/i18n/en.json`	Add linked-item error text.
`packages/plugins/ever-stats/package.json`	Upgrade Connect SDK dependencies.
`packages/plugins/ever-connect/src/lib/readme-table.spec.ts`	Check newly used contract rows.
`packages/plugins/ever-connect/src/lib/ever-connect-store.db.spec.ts`	Scope original migration table checks.
`packages/plugins/ever-connect/src/lib/ever-connect-lease.ts`	Share process lease ownership.
`packages/plugins/ever-connect/src/lib/ever-connect-config.provider.ts`	Bind Ever ID configuration port.
`packages/plugins/ever-connect/src/lib/ever-connect-audit.service.ts`	Extend identity audit vocabulary.
`packages/plugins/ever-connect/src/lib/entities/ever-connect-connection.entity.ts`	Track pending public URL checks.
`packages/plugins/ever-connect/src/index.ts`	Export person-data participant port.
`packages/plugins/ever-connect/project.json`	Declare Zitadel project dependency.
`packages/plugins/entitlement/src/lib/events/index.ts`	Export order-settlement support.
`packages/plugins/entitlement/src/lib/events/entitlement-order-line-policy.adapter.spec.ts`	Update granted-entitlement lookup mock.
`packages/plugins/entitlement/src/lib/events/entitlement-grant.consumer.spec.ts`	Update cancellation lookup mock.
`packages/plugins/entitlement/src/lib/entitlement/entitlement.service.grant-references.spec.ts`	Supply presence-check dependency.
`packages/plugins/entitlement/src/lib/database/migrations/index.ts`	Register live-grant uniqueness migration.
`packages/plugins/docs-ui/src/lib/pages/settings/docs-settings-page.component.ts`	Remove unused CommonModule import.
`packages/plugins/docs-ui/src/lib/dialogs/category-dialog.component.ts`	Remove unused CommonModule import.
`packages/plugins/docs-ui/src/lib/dialogs/bulk-categories-dialog.component.ts`	Adopt native template iteration.
`packages/plugins/docs-ui/src/lib/components/table/cells/updated-cell.component.ts`	Adopt native conditional rendering.
`packages/plugins/docs-ui/src/lib/components/table/cells/name-cell-thumbnail.spec.ts`	Update control-flow assertion.
`packages/plugins/docs-ui/src/lib/components/links/document-attach-dialog.component.ts`	Remove unused CommonModule import.
`packages/plugins/docs-ui/src/lib/components/filter-bar/facet-multiselect.component.ts`	Adopt native conditional rendering.
`packages/plugins/docs-ui/src/lib/components/cards/docs-cards-thumbnail.spec.ts`	Update control-flow assertion.
`packages/plugins/docs-ui/src/i18n/en.json`	Add attachment and preview labels.
`packages/plugins/auth-zitadel/src/lib/services/zitadel-signin.service.ts`	Resolve identity hints; publish sign-ins.
`packages/plugins/auth-zitadel/src/lib/events/zitadel-account.events.ts`	Add linked-account sign-in event.
`packages/plugins/auth-zitadel/src/index.ts`	Export account port and subject hashing.
`packages/plugins/auth-oidc/tsconfig.spec.json`	Configure OIDC test compilation.
`packages/plugins/auth-oidc/tsconfig.lib.json`	Configure OIDC library compilation.
`packages/plugins/auth-oidc/tsconfig.json`	Define OIDC project references.
`packages/plugins/auth-oidc/src/lib/auth-oidc.tokens.ts`	Define settings injection token.
`packages/plugins/auth-oidc/src/index.ts`	Expose OIDC plugin API.
`packages/plugins/auth-oidc/jest.config.ts`	Configure OIDC plugin tests.
`packages/plugins/auth-oidc/eslint.config.cjs`	Inherit workspace lint configuration.
`packages/plugins/ai-chat-react-ui/src/lib/settings/index.ts`	Export provider callback initializer.
`packages/plugins/ai-chat-react-ui/src/lib/ai-chat-react-ui.plugin.ts`	Register OpenRouter callback handling.
`packages/mcp-server/package.json`	Upgrade minimatch dependency.
`packages/desktop-window/src/index.ts`	Export window-position utilities.
`packages/desktop-ui-lib/src/lib/time-tracker/web-portal/index.ts`	Export web-portal APIs.
`packages/desktop-ui-lib/src/lib/time-tracker/time-tracker.component.scss`	Style footer separators.
`packages/desktop-ui-lib/src/lib/time-tracker/sounds/index.ts`	Export timer sound APIs.
`packages/desktop-ui-lib/src/lib/time-tracker/selection-prefill/index.ts`	Export selection-prefill APIs.
`packages/desktop-ui-lib/src/lib/time-tracker/organization-selector/organization-switch.service.spec.ts`	Test timer-start state visibility.
`packages/desktop-ui-lib/src/lib/time-tracker/connectivity/index.ts`	Export connectivity notification APIs.
`packages/desktop-ui-lib/src/lib/setup/setup.component.html`	Use dedicated server-host control.
`packages/desktop-ui-lib/src/lib/settings/settings.component.scss`	Style screenshot sound settings.
`packages/desktop-ui-lib/src/lib/settings/server-host/index.ts`	Export server-host APIs.
`packages/desktop-ui-lib/src/lib/settings/screenshot-sound/index.ts`	Export screenshot sound setting service.
`packages/desktop-ui-lib/src/lib/screen-capture/screen-capture.component.scss`	Position notification close control.
`packages/desktop-ui-lib/src/lib/screen-capture/screen-capture.component.html`	Add accessible notification close button.
`packages/desktop-lib/src/lib/sound-settings/sound-settings.ts`	Read opt-in timer sound settings.
`packages/desktop-lib/src/lib/sound-settings/sound-settings.ipc.ts`	Register sound-settings IPC handlers.
`packages/desktop-lib/src/lib/sound-settings/index.ts`	Export sound-settings APIs.
`packages/desktop-lib/src/lib/screenshot-sound/index.ts`	Export screenshot sound APIs.
`packages/desktop-lib/src/lib/offline/utils/index.ts`	Export update-payload utility.
`packages/desktop-lib/src/lib/offline/desktop-offline-mode-handler.ts`	Use shared probe interval.
`packages/desktop-lib/src/lib/offline/dao/tag.dao.ts`	Skip empty tag updates.
`packages/desktop-lib/src/lib/offline/dao/client.dao.ts`	Skip empty client updates.
`packages/desktop-lib/src/lib/offline/connectivity-timing.ts`	Define connectivity detection budget.
`packages/desktop-lib/src/lib/network/index.ts`	Export network discovery APIs.
`packages/desktop-lib/src/lib/network/desktop-network-ipc.ts`	Expose local network addresses.
`packages/desktop-lib/src/lib/interfaces/i-read-write-file.ts`	Reflect unavailable file reads.
`packages/desktop-lib/src/lib/config/read-write-file.ts`	Correct read return type.
`packages/desktop-lib/src/lib/config/index.ts`	Export UI runtime configuration.
`packages/desktop-lib/src/index.ts`	Expose network and sound APIs.
`packages/desktop-core/src/lib/store/concretes/application-setting-store.service.ts`	Add sound setting defaults.
`packages/core/src/lib/time-tracking/timesheet/timesheet.controller.ts`	Declare approval/manager route permissions.
`packages/core/src/lib/time-tracking/time-log/time-log.resolver.ts`	Return weekly spending and currency.
`packages/core/src/lib/time-tracking/time-log/schema/time-log.api.gql`	Document weekly spending fields.
`packages/core/src/lib/time-off-request/time-off-request.module.ts`	Import leave balance support.
`packages/core/src/lib/time-off-policy/time-off-policy.resolver.ts`	Extend policy input contract.
`packages/core/src/lib/time-off-policy/time-off-policy.entity.ts`	Store sufficient-balance requirement.
`packages/core/src/lib/time-off-policy/schema/time-off-policy.type.gql`	Expose balance policy setting.
`packages/core/src/lib/time-off-balance/repository/mikro-orm-time-off-balance-deduction.repository.ts`	Add deduction repository type.
`packages/core/src/lib/tenant/tenant.subscriber.ts`	Replace third-party tenant placeholders.
`packages/core/src/lib/tenant/tenant.controller.ts`	Document closed workspace creation.
`packages/core/src/lib/tenant/commands/tenant-feature-organization.create.command.ts`	Add missing-only feature option.
`packages/core/src/lib/tenant/commands/handlers/tenant-feature-organization.create.handler.ts`	Forward feature creation options.
`packages/core/src/lib/shared/guards/organization-permission.guard.ts`	Check query-target tenant ownership.
`packages/core/src/lib/role/commands/tenant-role-bulk-create.command.ts`	Add missing-only role option.
`packages/core/src/lib/role-permission/default-role-permissions.ts`	Grant contact add/delete permissions.
`packages/core/src/lib/request-approval/request-approval.module.ts`	Import leave balance support.
`packages/core/src/lib/request-approval/commands/handlers/request-approval.status.handler.ts`	Document balance settlement behavior.
`packages/core/src/lib/placeholder-image/placeholder-image.module.ts`	Register placeholder controller.
`packages/core/src/lib/placeholder-image/index.ts`	Export placeholder APIs.
`packages/core/src/lib/organization/organization.bulk.spec.ts`	Supply new creation dependency.
`packages/core/src/lib/organization/dto/organization-setting.dto.ts`	Include screenshot capture setting.
`packages/core/src/lib/organization/dto/index.ts`	Export capture acknowledgement DTO.
`packages/core/src/lib/organization/default-organizations.ts`	Add default organization tagline.
`packages/core/src/lib/organization-team/schema/organization-team.api.gql`	Declare team archive mutations.
`packages/core/src/lib/organization-team/organization-team.entity.ts`	Disable comment assignment persistence.
`packages/core/src/lib/organization-sprint/organization-sprint.service.ts`	Preserve former employee memberships.
`packages/core/src/lib/organization-sprint/organization-sprint.resolver.ts`	Filter former members from responses.
`packages/core/src/lib/organization-sprint/organization-sprint.controller.ts`	Filter former members from responses.
`packages/core/src/lib/organization-project/schema/organization-project.api.gql`	Declare project archive mutations.
`packages/core/src/lib/organization-project/organization-project.service.member-unsubscribe.spec.ts`	Mock working-member lookup.
`packages/core/src/lib/organization-project/organization-project.service.manager-flag.spec.ts`	Mock working-member lookup.
`packages/core/src/lib/organization-project-module/organization-project-module.service.ts`	Preserve former employee memberships.
`packages/core/src/lib/organization-project-module/organization-project-module.resolver.ts`	Filter former members from responses.
`packages/core/src/lib/organization-project-module/organization-project-module.controller.ts`	Filter former members from responses.
`packages/core/src/lib/organization-department/organization-department.resolver.ts`	Filter former members from responses.
`packages/core/src/lib/organization-department/organization-department.controller.ts`	Filter former members from responses.
`packages/core/src/lib/organization-contact/organization-contact.permissions.ts`	Derive create-only contact access.
`packages/core/src/lib/organization-contact/organization-contact.module.ts`	Register contact comment policy.
`packages/core/src/lib/organization-contact/commands/organization-contact-create.command.ts`	Carry create-only restrictions.
`packages/core/src/lib/logger/index.ts`	Export request/email logging APIs.
`packages/core/src/lib/logger/http-request-logger/index.ts`	Export HTTP logging components.
`packages/core/src/lib/invite/schema/invite.type.gql`	Document public capture restrictions.
`packages/core/src/lib/invite/invite.service.find-all-pagination.spec.ts`	Supply team lookup mock.
`packages/core/src/lib/export-import/skip-export.decorator.ts`	Clarify core export exclusions.
`packages/core/src/lib/expense/expense.resolver.ts`	Clarify employee-scoped statistics access.
`packages/core/src/lib/employee/employee.entity.ts`	Disable comment assignment persistence.
`packages/core/src/lib/employee-statistics/employee-statistics.controller.membership.spec.ts`	Isolate organization membership tests.
`packages/core/src/lib/email-send/email.service.email-verification.spec.ts`	Check click-tracking suppression headers.
`packages/core/src/lib/database/provision/index.ts`	Export database provisioning APIs.
`packages/core/src/lib/core/util/organization-sensitive-relations.config.ts`	Protect acknowledgement user relation.
`packages/core/src/lib/core/seeds/data/default-email-templates/account-deletion-request/en/subject.hbs`	Add deletion confirmation subject.
`packages/core/src/lib/core/seeds/data/default-email-templates/account-deletion-completed/en/subject.hbs`	Add deletion completion subject.
`packages/core/src/lib/core/file-storage/providers/wasabi-s3.provider.ts`	Add strict file deletion entrypoint.
`packages/core/src/lib/core/file-storage/providers/provider.ts`	Define strict deletion contract.
`packages/core/src/lib/core/file-storage/providers/digitalocean-s3.provider.ts`	Add strict file deletion entrypoint.
`packages/core/src/lib/core/errors/api-error-codes.ts`	Define capture acknowledgement error.
`packages/core/src/lib/core/entities/internal.ts`	Export deletion and deduction entities.
`packages/core/src/lib/core/entities/index.ts`	Register deletion and deduction entities.
`packages/core/src/lib/comment/parent-access/record-type-spelling.ts`	Compare equivalent record-type spellings.
`packages/core/src/lib/comment/parent-access/index.ts`	Export parent-access APIs.
`packages/core/src/lib/comment/parent-access/comment-parent-access-policy.decorator.ts`	Mark discoverable comment policies.
`packages/core/src/lib/comment/comment.service.owner-scope.spec.ts`	Supply parent-access dependency.
`packages/core/src/lib/comment/comment.service.mentions.spec.ts`	Supply parent-access dependency.
`packages/core/src/lib/comment/comment.service.http-status.spec.ts`	Supply parent-access dependency.
`packages/core/src/lib/comment/comment.service.author.spec.ts`	Supply parent-access dependency.
`packages/core/src/lib/comment/comment.controller.ts`	Use authorized comment reader.
`packages/core/src/lib/bootstrap/index.ts`	Run opt-in database provisioning.
`packages/core/src/lib/bootstrap/bootstrap.module.ts`	Register optional HTTP logging.
`packages/core/src/lib/auth/auth-switches/index.ts`	Export registration/reset policy APIs.
`packages/core/src/lib/account-deletion/repository/type-orm-account-deletion-request.repository.ts`	Add TypeORM deletion-request repository.
`packages/core/src/lib/account-deletion/repository/mikro-orm-account-deletion-request.repository.ts`	Add MikroORM deletion-request repository.
`packages/core/src/lib/account-deletion/repository/index.ts`	Export deletion repositories.
`packages/core/src/lib/account-deletion/dto/index.ts`	Export account deletion DTOs.
`packages/core/src/lib/account-deletion/dto/account-deletion-token.dto.ts`	Validate emailed deletion tokens.
`packages/core/package.json`	Upgrade legal dependency.
`packages/contracts/src/lib/role-permission.model.ts`	Define contact add/delete permissions.
`packages/contracts/src/lib/report.model.ts`	Add weekly spending contract.
`packages/contracts/src/lib/email-template.model.ts`	Define deletion email templates.
`packages/contracts/src/lib/daily-plan.model.ts`	Carry caller-local current day.
`packages/contracts/src/lib/auth.model.ts`	Define public registration configuration.
`packages/config/src/lib/environments/ienvironment.ts`	Require authentication switch configuration.
`packages/config/src/lib/environments/environment.ts`	Resolve authentication switches.
`packages/config/src/index.ts`	Export authentication switch helpers.
`packages/auth/src/lib/public-api.spec.ts`	Check shared email/OIDC exports.
`packages/auth/src/lib/oidc/oidc.module.ts`	Register email sign-in service.
`packages/auth/src/lib/oidc/index.ts`	Export email sign-in contracts.
`packages/auth/src/lib/facebook/facebook.strategy.ts`	Centralize confirmed-email mapping.
`jest.preset.js`	Update OIDC suite comment.
`docker-compose.demo.yml`	Expose opt-in email-code logging.
`apps/server/src/index.ts`	Register network address IPC.
`apps/server-api/src/index.ts`	Register network address IPC.
`apps/gauzy/src/app/pages/teams/teams.module.ts`	Import toggle component support.
`apps/gauzy/src/app/pages/teams/teams-mutation/teams-mutation.component.ts`	Use API placeholder images.
`apps/gauzy/src/app/pages/tasks/components/task/task.component.ts`	Clear identity when duplicating tasks.
`apps/gauzy/src/app/pages/tasks/components/task-view/task-view-header.component.scss`	Style links; remove large-title override.
`apps/gauzy/src/app/pages/settings/roles-permissions/permission-sections.ts`	Display contact add/delete permissions.
`apps/gauzy/src/app/pages/settings/danger-zone/danger-zone.component.html`	Explain deletion options and email flow.
`apps/gauzy/src/app/pages/reports/weekly-time-reports/weekly-time-reports/weekly-time-reports.component.ts`	Detect available spending amounts.
`apps/gauzy/src/app/pages/reports/time-reports/time-reports.module.ts`	Import report button support.
`apps/gauzy/src/app/pages/reports/time-limit-report/time-limit-report/time-limit-report.component.html`	Link employees to profile views.
`apps/gauzy/src/app/pages/reports/manual-time/manual-time/manual-time.component.html`	Link employees to profile views.
`apps/gauzy/src/app/pages/projects/components/project-view/project-view-page.component.scss`	Style archived-project metadata.
`apps/gauzy/src/app/pages/projects/components/project-view/project-board/board-minimap.component.html`	Render pointer-operated board minimap.
`apps/gauzy/src/app/pages/projects/components/project-quick-look/project-quick-look.component.scss`	Expand wide record fields.
`apps/gauzy/src/app/pages/pipelines/table-components/pipeline-deal-probability/pipeline-deal-probability.component.ts`	Share probability badge presentation.
`apps/gauzy/src/app/pages/pipelines/pipeline-deals/pipeline-deals.component.scss`	Space board toggle controls.
`apps/gauzy/src/app/pages/payments/payments.component.html`	Add payment view action.
`apps/gauzy/src/app/pages/employees/activity/time-activities/time-activities/time-activities.component.html`	Add filtered CSV export action.
`apps/gauzy/src/app/pages/employees/activity/time-activities/time-activities.module.ts`	Import export button/icon support.
`apps/gauzy/src/app/pages/dashboard/team/team-member/team-member.component.ts`	Add hover-card keyboard state.
`apps/gauzy/src/app/pages/dashboard/team/index.ts`	Export dashboard person/project components.
`apps/gauzy/src/app/pages/dashboard/project-management/project-management.component.html`	Add dashboard layout classes.
`apps/gauzy/src/app/pages/contacts/contacts.component.ts`	Expose contact action permissions.
`apps/gauzy/src/app/pages/contacts/contact-view/contact-view.module.ts`	Import contact notes component.
`apps/gauzy/src/app/pages/contacts/contact-mutation/contact-mutation.component.ts`	Filter projects for create-only contacts.
`apps/gauzy-e2e/tests/support/pages/SettingsButton.po.ts`	Correct dropdown-order comment.
`apps/gauzy-e2e/tests/support/pages/Logout.po.ts`	Wait for and dispatch logout.
`apps/gauzy-e2e/tests/bdd/steps/settings-button.steps.ts`	Correct layout dropdown index.
`apps/gauzy-e2e/tests/bdd/steps/my-tasks-tracked-in-timesheets.steps.ts`	Clarify timesheet assertion comment.
`apps/gauzy-e2e/tests/bdd/steps/manage-organization.steps.ts`	Select the scenario’s organization.
`apps/gauzy-e2e/tests/bdd/steps/manage-candidates-invites.steps.ts`	Scope invite grid; confirm deletion.
`apps/gauzy-e2e/tests/bdd/steps/delete-organization.steps.ts`	Type organization deletion confirmation.
`apps/gauzy-e2e/tests/bdd/steps/appointments.steps.ts`	Use verified appointment navigation.
`apps/gauzy-e2e/src/support/Base/pageobjects/TimeTrackingPageObject.ts`	Scope timer project selector.
`apps/gauzy-e2e/src/support/Base/pageobjects/TimeOffPageObject.ts`	Disambiguate policy Add button.
`apps/gauzy-e2e/src/support/Base/pageobjects/RemoveUserPageObject.ts`	Scope removal confirmation selector.
`apps/gauzy-e2e/src/support/Base/pageobjects/OnboardingPageObject.ts`	Update onboarding control selectors.
`apps/gauzy-e2e/src/support/Base/pageobjects/ManageOrganizationPageObject.ts`	Add organization name filter selector.
`apps/gauzy-e2e/src/support/Base/pageobjects/LogoutPageObject.ts`	Target redesigned logout link.
`apps/gauzy-e2e/src/support/Base/pageobjects/InviteUserPageObject.ts`	Target redesigned invite dialog.
`apps/gauzy-e2e/src/support/Base/pageobjects/ExpensesPageObject.ts`	Scope employee dropdown options.
`apps/gauzy-e2e/src/support/Base/pageobjects/AddTasksPageObject.ts`	Scope task-dialog project selector.
`apps/gauzy-e2e/src/support/Base/pagedata/ManageUserInvitesPageData.ts`	Define scenario invitation role.
`apps/api/package.json`	Declare OIDC plugin dependency.
`apps/agent/src/main/window-manager.ts`	Handle closed/replaced capture notifications.
`apps/agent/src/main/screenshot-interval.ts`	Extend organization capture settings type.
`apps/agent/src/main/init/ipcMain.ts`	Register screenshot sound handlers.
`apps/agent/src/main/events/tray-notify.ts`	Respect effective capture permission.
`apps/agent/src/main/api.ts`	Load employee organization settings.
`.scripts/env.ts`	Define OIDC frontend environment variable.
`.scripts/configure.ts`	Generate OIDC runtime configuration.
`.gitignore`	Ignore filled Caddy secrets.
`.github/workflows/deploy-do-app-platform-prod.yml`	Enable admin email password reset.
`.github/ISSUE_TEMPLATE/config.yml`	Add private vulnerability reporting link.
`.env.docker`	Document authentication/logging switches.
`.dockerignore`	Exclude Caddy secrets from builds.
`.deploy/webapp/replacements.sed`	Replace OIDC deployment placeholder.
`.deploy/cloudflare/inbox-email-worker/src/worker.mjs`	Reject redirects using Workers-compatible mode.
`.cspell.json`	Add release vocabulary.

_{Review effort: Balanced}

…6-11-05 fix: the bot findings on the promotion PRs #11626, #11630, #11631

The router decodes a parameter's name, so `?%74oken=...` reaches the account deletion page as `token`, but redactUrlSecrets matched the name as written and left the single-use secret in Sentry breadcrumbs and analytics. Names are now compared percent-decoded (case aside), in the query and in the fragment, and a `?token=` written inside another parameter's value is still read as a parameter. Sentry's Replay guard uses the same reading through the new hasUrlSecrets instead of its own regex. Answers Copilot on ever-co#11626. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

… letters findUsersByEmail compared SQL LOWER with an address JavaScript had lowercased. SQLite's LOWER (and Postgres's under the C collation) leaves a letter such as `É` as it is, so `Élodie@example.com` never matched `élodie@example.com`: the email flow sent no link and the signed-in flow had no plan. Such an address is now narrowed in SQL with each non-ASCII letter as a one-letter LIKE wildcard and matched in code the way the address was lowercased, as deleteRowsAddressedTo already does. ASCII addresses keep the plain SQL equality. Answers Greptile on ever-co#11626. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

evereq and others added 30 commits October 31, 2026 05:37

Merge pull request #11584 from ever-co/feat/core-db-create-and-http-l…

27bf7cc

…ogging-1769-4006 feat(core): opt-in DB_CREATE_IF_NOT_EXISTS and LOG_HTTP_REQUESTS

Merge pull request #11578 from ever-co/feat/screen-capture-default-of…

97bb4e1

…f-eea-gate-9872 feat(organization): screen capture off for new organizations, EEA/UK acknowledgement to turn it on

Merge pull request #11586 from ever-co/feat/desktop-timer-window-soun…

7a16e8b

…d-ux-7643-7683-6715-7141 feat(desktop): screenshot popup close button, remembered mini timer position, custom and start/stop sounds

Merge integration/issue-triage-2026-10-31 into feat/time-off-balance-…

2b0a8bb

…approval-10183-5481 Both sides add one export to packages/ui-core/common/src/index.ts; both are kept. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Merge pull request #11582 from ever-co/feat/time-off-balance-approval…

2300479

…-10183-5481 feat(time-off): take approved leave from the balance and fix the request-form download

Merge pull request #11589 from ever-co/feat/auth-oidc-plugin-42

4409ee2

feat(plugin-auth-oidc): sign in with any OpenID Connect provider

Merge pull request #11577 from ever-co/fix/entitlement-late-order-gra…

5ddb62b

…nt-11023 fix(entitlement): race-safe grant and activation on a late order.placed

evereq and others added 16 commits November 1, 2026 18:22

Merge pull request #11619 from ever-co/fix/subscription-cspell-bookkept

72f155c

fix(subscription): cspell ignores bookkept / Finishable in the billing service and its spec

Merge remote-tracking branch 'origin/develop' into feat/ever-works-in…

b7c9d3e

…box-push Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Merge pull request #11620 from ever-co/fix/egress-audit-connect-rc8

cebf2b5

fix(egress-audit): move the harness to @ever-co/connect-tools 1.0.0-rc.8

Merge remote-tracking branch 'origin/develop' into feat/ever-works-in…

e1b08b3

…box-push Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Merge pull request #11543 from ever-co/feat/ever-works-inbox-push

9631807

feat(ever-works): send the Gauzy Inbox's own items to Ever Works, per person and kind

fix(inbox,ever-works): cspell ignores datetimes / refetched / checkpo…

261af40

…inted The Check Spelling job on develop (9631807, #11543) flags these three words. File-level directives keep the exceptions local. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Merge pull request #11623 from ever-co/fix/inbox-ew-cspell

7da5a66

fix(inbox,ever-works): cspell ignores datetimes / refetched / checkpointed

Merge pull request #11625 from ever-co/develop

ee004e7

Release: develop → stage (2026-11-01: Ever Connect identity, billing fences, Ever Works inbox push, deps, CI fixes)

Copilot AI balanced review requested due to automatic review settings November 2, 2026 01:09

evereq merged commit 5e94dea into stage-apps Nov 2, 2026
17 of 20 checks passed

Copilot started reviewing on behalf of evereq November 2, 2026 01:09

View session

greptile-apps Bot reviewed Nov 2, 2026

View reviewed changes

Comment thread packages/core/src/lib/account-deletion/account-deletion.service.ts Resolved

Comment thread packages/core/src/lib/account-deletion/account-deletion.service.ts Resolved

Copilot AI reviewed Nov 2, 2026

View reviewed changes

Comment thread packages/ui-core/common/src/lib/utils/redact-url-secrets.ts Resolved

evereq mentioned this pull request Nov 5, 2026

fix: the bot findings on the promotion PRs #11626, #11630, #11631 #11654

Merged

evereq added a commit that referenced this pull request Nov 5, 2026

Merge pull request #11654 from ever-co/fix/promotion-bot-findings-202…

882290f

…6-11-05 fix: the bot findings on the promotion PRs #11626, #11630, #11631

evereq mentioned this pull request Nov 5, 2026

fix: develop health - MikroORM manual times, GraphQL budget ids, stage unit/e2e reds, schema snapshot, compose auth env #11657

Merged

evereq mentioned this pull request Nov 13, 2026

Apps: promote stage → stage-apps (v111.212.5) #11932

Merged

Navigation Menu

Repository navigation

Apps: promote stage → stage-apps (v111.146.2) - #11626

Apps: promote stage → stage-apps (v111.146.2)#11626
evereq merged 737 commits into
stage-appsfrom
stage

evereq commented Nov 2, 2026 •

edited by cubic-dev-ai Bot

Loading

Uh oh!

Uh oh!

coderabbitai Bot commented Nov 2, 2026

Review skipped

Uh oh!

evereq commented Nov 2, 2026

Uh oh!

greptile-apps Bot commented Nov 2, 2026 •

edited

Loading

Diagram

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

evereq commented Nov 2, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by cubic

Uh oh!

Uh oh!

coderabbitai Bot commented Nov 2, 2026

Review skipped

Uh oh!

evereq commented Nov 2, 2026

Uh oh!

greptile-apps Bot commented Nov 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 4/5

Findings

Summary

Diagram

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

evereq commented Nov 2, 2026 •

edited by cubic-dev-ai Bot

Loading

greptile-apps Bot commented Nov 2, 2026 •

edited

Loading