[comp] Production Deploy

apps/api/package.json

@@ -61,15 +61,15 @@
         "@aws-sdk/lib-storage": "3.1013.0",
         "@aws-sdk/s3-request-presigner": "3.1013.0",
         "@browserbasehq/sdk": "2.6.0",
-        "@browserbasehq/stagehand": "^3.2.1",
+        "@browserbasehq/stagehand": "^3.7.0",
         "@inference/tracing": "^0.0.21",
         "@maced/api-client": "^0.9.2",
         "@mendable/firecrawl-js": "^4.9.3",
         "@nestjs/common": "^11.0.1",
         "@nestjs/config": "^4.0.2",
         "@nestjs/core": "^11.0.1",
         "@nestjs/platform-express": "^11.1.5",
-        "@nestjs/swagger": "^11.2.0",
+        "@nestjs/swagger": "^11.4.5",
         "@nestjs/throttler": "^6.5.0",
         "@prisma/adapter-pg": "7.6.0",
         "@prisma/client": "7.6.0",
@@ -92,8 +92,8 @@
         "adm-zip": "^0.5.16",
         "ai": "^6.0.175",
         "archiver": "^7.0.1",
-        "axios": "^1.12.2",
-        "better-auth": "^1.4.22",
+        "axios": "^1.16.0",
+        "better-auth": "^1.6.13",
         "class-transformer": "^0.5.1",
         "class-validator": "^0.14.2",
         "docx": "^9.7.1",

apps/app/package.json

@@ -18,7 +18,7 @@
         "@aws-sdk/s3-request-presigner": "3.1013.0",
         "@azure/core-rest-pipeline": "^1.21.0",
         "@browserbasehq/sdk": "2.6.0",
-        "@browserbasehq/stagehand": "^3.0.5",
+        "@browserbasehq/stagehand": "^3.7.0",
         "@date-fns/tz": "^1.2.0",
         "@dnd-kit/core": "^6.3.1",
         "@dnd-kit/modifiers": "^9.0.0",
@@ -85,8 +85,8 @@
         "@xyflow/react": "^12.10.0",
         "ai": "^6.0.175",
         "ai-elements": "^1.6.1",
-        "axios": "^1.9.0",
-        "better-auth": "^1.4.22",
+        "axios": "^1.16.0",
+        "better-auth": "^1.6.13",
         "botid": "^1.5.5",
         "canvas-confetti": "^1.9.3",
         "class-variance-authority": "^0.7.1",
@@ -102,7 +102,7 @@
         "mammoth": "^1.11.0",
         "motion": "^12.35.0",
         "nanoid": "^5.1.6",
-        "next": "^16.2.0",
+        "next": "^16.2.6",
         "next-safe-action": "^8.0.3",
         "next-themes": "^0.4.4",
         "nuqs": "^2.4.3",
@@ -171,7 +171,7 @@
         "trigger.dev": "4.4.3",
         "typescript": "^5.8.3",
         "vite-tsconfig-paths": "^5.1.4",
-        "vitest": "^3.2.4"
+        "vitest": "^3.2.6"
     },
     "exports": {
         "./src/lib/encryption": "./src/lib/encryption.ts"

apps/app/src/app/(app)/[orgId]/people/org-chart/components/OrgChartContent.tsx

@@ -20,18 +20,26 @@ interface OrgChartData {
 interface OrgChartContentProps {
   chartData: OrgChartData | null;
   members: OrgChartMember[];
+  onChartChange: () => void | Promise<unknown>;
 }
 
-export function OrgChartContent({ chartData, members }: OrgChartContentProps) {
+export function OrgChartContent({
+  chartData,
+  members,
+  onChartChange,
+}: OrgChartContentProps) {
   if (!chartData) {
-    return <OrgChartEmptyState members={members} />;
+    return (
+      <OrgChartEmptyState members={members} onChartChange={onChartChange} />
+    );
   }
 
   if (chartData.type === 'uploaded' && chartData.signedImageUrl) {
     return (
       <OrgChartImageView
         imageUrl={chartData.signedImageUrl}
         chartName={chartData.name}
+        onChartChange={onChartChange}
       />
     );
   }
@@ -57,6 +65,7 @@ export function OrgChartContent({ chartData, members }: OrgChartContentProps) {
       initialEdges={chartData.edges}
       members={members}
       updatedAt={chartData.updatedAt ?? null}
+      onChartChange={onChartChange}
     />
   );
 }

apps/app/src/app/(app)/[orgId]/people/org-chart/components/OrgChartEditor.tsx

@@ -18,7 +18,6 @@ import {
 } from '@xyflow/react';
 import '@xyflow/react/dist/style.css';
 import { formatDistanceToNow } from 'date-fns';
-import { useRouter } from 'next/navigation';
 import { useCallback, useMemo, useRef, useState } from 'react';
 import { toast } from 'sonner';
 import type { OrgChartMember } from '../types';
@@ -30,16 +29,17 @@ interface OrgChartEditorProps {
   initialEdges: Edge[];
   members: OrgChartMember[];
   updatedAt: string | null;
+  onChartChange: () => void | Promise<unknown>;
 }
 
 export function OrgChartEditor({
   initialNodes,
   initialEdges,
   members,
   updatedAt,
+  onChartChange,
 }: OrgChartEditorProps) {
   const api = useApi();
-  const router = useRouter();
   const reactFlowWrapper = useRef<HTMLDivElement>(null);
   const [reactFlowInstance, setReactFlowInstance] = useState<ReactFlowInstance | null>(null);
 
@@ -161,7 +161,12 @@ export function OrgChartEditor({
         setLastSavedAt(new Date().toISOString());
       }
       toast.success('Org chart saved');
-      router.refresh();
+
+      try {
+        await onChartChange();
+      } catch {
+        // Save already succeeded; a refresh failure shouldn't surface as a save error.
+      }
     } catch {
       toast.error('Failed to save org chart');
     } finally {

apps/app/src/app/(app)/[orgId]/people/org-chart/components/OrgChartEmptyState.tsx

@@ -9,9 +9,13 @@ import type { OrgChartMember } from '../types';
 
 interface OrgChartEmptyStateProps {
   members: OrgChartMember[];
+  onChartChange: () => void | Promise<unknown>;
 }
 
-export function OrgChartEmptyState({ members }: OrgChartEmptyStateProps) {
+export function OrgChartEmptyState({
+  members,
+  onChartChange,
+}: OrgChartEmptyStateProps) {
   const [mode, setMode] = useState<'empty' | 'create' | 'upload'>('empty');
 
   if (mode === 'create') {
@@ -21,12 +25,18 @@ export function OrgChartEmptyState({ members }: OrgChartEmptyStateProps) {
         initialEdges={[]}
         members={members}
         updatedAt={null}
+        onChartChange={onChartChange}
       />
     );
   }
 
   if (mode === 'upload') {
-    return <UploadOrgChartDialog onClose={() => setMode('empty')} />;
+    return (
+      <UploadOrgChartDialog
+        onClose={() => setMode('empty')}
+        onUploaded={onChartChange}
+      />
+    );
   }
 
   return (

apps/app/src/app/(app)/[orgId]/people/org-chart/components/OrgChartImageView.tsx

@@ -5,20 +5,20 @@ import { Button } from '@trycompai/design-system';
 import { TrashCan, Upload } from '@trycompai/design-system/icons';
 import { useApi } from '@/hooks/use-api';
 import { toast } from 'sonner';
-import { useRouter } from 'next/navigation';
 import { UploadOrgChartDialog } from './UploadOrgChartDialog';
 
 interface OrgChartImageViewProps {
   imageUrl: string;
   chartName: string;
+  onChartChange: () => void | Promise<unknown>;
 }
 
 export function OrgChartImageView({
   imageUrl,
   chartName,
+  onChartChange,
 }: OrgChartImageViewProps) {
   const api = useApi();
-  const router = useRouter();
   const [isDeleting, setIsDeleting] = useState(false);
   const [showReplace, setShowReplace] = useState(false);
 
@@ -33,7 +33,12 @@ export function OrgChartImageView({
       }
 
       toast.success('Org chart deleted');
-      router.refresh();
+
+      try {
+        await onChartChange();
+      } catch {
+        // Delete already succeeded; a refresh failure shouldn't surface as a delete error.
+      }
     } catch {
       toast.error('Failed to delete org chart');
     } finally {
@@ -42,7 +47,12 @@ export function OrgChartImageView({
   };
 
   if (showReplace) {
-    return <UploadOrgChartDialog onClose={() => setShowReplace(false)} />;
+    return (
+      <UploadOrgChartDialog
+        onClose={() => setShowReplace(false)}
+        onUploaded={onChartChange}
+      />
+    );
   }
 
   return (

apps/app/src/app/(app)/[orgId]/people/org-chart/components/OrgChartTabContent.tsx

@@ -10,7 +10,7 @@ interface OrgChartTabContentProps {
 }
 
 export function OrgChartTabContent({ organizationId }: OrgChartTabContentProps) {
-  const { orgChart } = useOrgChart();
+  const { orgChart, mutate } = useOrgChart();
   const { members } = useTeamMembers({ organizationId });
 
   const chartMembers: OrgChartMember[] = members
@@ -25,5 +25,11 @@ export function OrgChartTabContent({ organizationId }: OrgChartTabContentProps)
       jobTitle: m.jobTitle ?? null,
     }));
 
-  return <OrgChartContent chartData={orgChart} members={chartMembers} />;
+  return (
+    <OrgChartContent
+      chartData={orgChart}
+      members={chartMembers}
+      onChartChange={mutate}
+    />
+  );
 }

apps/app/src/app/(app)/[orgId]/people/org-chart/components/UploadOrgChartDialog.tsx

@@ -6,15 +6,17 @@ import { Button } from '@trycompai/design-system';
 import { Upload, Close } from '@trycompai/design-system/icons';
 import { useApi } from '@/hooks/use-api';
 import { toast } from 'sonner';
-import { useRouter } from 'next/navigation';
 
 interface UploadOrgChartDialogProps {
   onClose: () => void;
+  onUploaded: () => void | Promise<unknown>;
 }
 
-export function UploadOrgChartDialog({ onClose }: UploadOrgChartDialogProps) {
+export function UploadOrgChartDialog({
+  onClose,
+  onUploaded,
+}: UploadOrgChartDialogProps) {
   const api = useApi();
-  const router = useRouter();
   const [isUploading, setIsUploading] = useState(false);
   const [selectedFile, setSelectedFile] = useState<File | null>(null);
 
@@ -60,8 +62,13 @@ export function UploadOrgChartDialog({ onClose }: UploadOrgChartDialogProps) {
       }
 
       toast.success('Org chart uploaded');
-      router.refresh();
       onClose();
+
+      try {
+        await onUploaded();
+      } catch {
+        // Upload already succeeded; a refresh failure shouldn't surface as an upload error.
+      }
     } catch {
       toast.error('Failed to upload org chart');
     } finally {

apps/app/src/app/(app)/[orgId]/tasks/[taskId]/automation/[automationId]/actions/task-automation-actions.ts

@@ -55,7 +55,15 @@ async function callEnterpriseApi<T>(
 ): Promise<T> {
   const { enterpriseApiUrl, enterpriseApiKey } = getEnterpriseConfig();
 
-  const url = new URL(endpoint, enterpriseApiUrl);
+  const baseUrl = new URL(enterpriseApiUrl);
+  const url = new URL(endpoint, baseUrl);
+
+  // SSRF guard: `endpoint` and params can carry user-derived values, so pin the
+  // request to the configured enterprise API origin — never allow it to be
+  // redirected to another host.
+  if (url.origin !== baseUrl.origin) {
+    throw new EnterpriseApiError('Invalid enterprise API endpoint', 400);
+  }
 
   if (options.params) {
     Object.entries(options.params).forEach(([key, value]) => {
@@ -243,8 +251,10 @@ export async function analyzeAutomationWorkflow(scriptContent: string) {
 
 export const getAutomationRunStatus = async (runId: string) => {
   try {
-    const result = await callEnterpriseApi(`/api/tasks-automations/runs/${runId}`, {
-    });
+    const result = await callEnterpriseApi(
+      `/api/tasks-automations/runs/${encodeURIComponent(runId)}`,
+      {},
+    );
 
     return {
       success: true,

apps/app/src/lib/permissions.ts

@@ -230,15 +230,18 @@ export function resolveBuiltInPermissions(roleString: string | null | undefined)
     if (BUILT_IN_ROLE_NAMES.includes(roleName)) {
       const role = allRoles[roleName as RoleName];
       if (role) {
-        mergePermissions(combined, role.statements as Record<string, string[]>);
+        mergePermissions(combined, role.statements as Record<string, readonly string[]>);
       }
     }
   }
 
   return { permissions: combined, customRoleNames };
 }
 
-export function mergePermissions(target: UserPermissions, source: Record<string, string[]>): void {
+export function mergePermissions(
+  target: UserPermissions,
+  source: Record<string, readonly string[]>,
+): void {
   for (const [resource, actions] of Object.entries(source)) {
     if (!target[resource]) {
       target[resource] = [];

apps/framework-editor/package.json

@@ -13,10 +13,10 @@
         "@trycompai/company": "workspace:*",
         "@trycompai/db": "workspace:*",
         "@trycompai/ui": "workspace:*",
-        "better-auth": "^1.4.22",
+        "better-auth": "^1.6.13",
         "framer-motion": "^12.23.9",
         "lucide-react": "^1.7.0",
-        "next": "^16.2.0",
+        "next": "^16.2.6",
         "next-themes": "^0.4.4",
         "nuqs": "^2.4.3",
         "react": "^19.0.0",
@@ -41,7 +41,7 @@
         "prisma": "7.6.0",
         "tailwindcss": "^4.1.8",
         "typescript": "^5.8.3",
-        "vitest": "^3.2.4"
+        "vitest": "^3.2.6"
     },
     "private": true,
     "scripts": {