Fix/onboarding without trigger worker

[cyberhiker]

What does this PR do?

• Fixes #XXXX (GitHub issue number)
• Fixes COMP-XXXX (Linear issue number - should be visible at the bottom of the GitHub issue description)

Visual Demo (For contributors especially)

A visual demonstration is strongly recommended, for both the original and new change (video / image - any one).

Video Demo (if applicable):

• Show screen recordings of the issue or feature.
• Demonstrate how to reproduce the issue, the behavior before and after the change.

Image Demo (if applicable):

• Add side-by-side screenshots of the original and updated change.
• Highlight any significant change(s).

Mandatory Tasks (DO NOT REMOVE)

• I have self-reviewed the code (A decent size PR without self-review might be rejected).
• I have updated the developer docs in /docs if this PR makes changes that would require a documentation change. If N/A, write N/A here and check the checkbox.
• I confirm automated tests are in place that prove my fix is effective or that my feature works.

How should this be tested?

• Are there environment variables that should be set?
• What are the minimal test data to have?
• What is expected (happy path) to have (input and output)?
• Any other important info that could help to test that PR

Checklist

• I haven't read the contributing guide
• My code doesn't follow the style guidelines of this project
• I haven't commented my code, particularly in hard-to-understand areas
• I haven't checked if my changes generate no new warnings

---

Summary by cubic

Fixes onboarding on deployments without a Trigger.dev worker, adds the Google Workspace admin audit service and a group-aware access review, and includes a CMMC Level 2 framework, a global auth-context response interceptor, and local dev scripts.

Onboarding without a worker

• The two enrichment dispatches are now non-fatal and independent, so a missing worker no longer fails the whole action.
• When no worker accepts the jobs, triggerJobId stays null and AI enrichment is skipped; the organization is otherwise fully usable.

Google Workspace integration

• Adds admin-privilege-changes and admin-security-events checks over the Reports API audit log.
• Admin roles granted via groups are now expanded to their members; before, those grants matched no user and the access review missed them.
• Sync and checks share one user-scope filter (org unit, group, domain, include/exclude) instead of parallel implementations.
• Existing connections must reconnect for the new OAuth scopes; missing scopes degrade to findings naming the permission rather than failing the run.

^{Written for commit 9df829b. Summary will update on new commits.}

[claude]

Claude Code Review

This pull request is from a fork — automated review is disabled. A repository maintainer can comment @claude review to run a one-time review.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[cubic-dev-ai]

37 issues found across 39 files

Confidence score: 1/5

• apps/api/src/integration-platform/controllers/sync.controller.ts and packages/integration-platform/src/manifests/google-workspace/directory-client.ts can turn a selected-group scope or a 403/429 response into a broader or partial deletion set, deactivating valid same-domain employees. Preserve scope and propagate incomplete membership reads before applying deactivations.
• packages/integration-platform/src/manifests/google-workspace/role-assignments.ts ignores Google’s uppercase GROUP assignments and treats API failures as complete reviews, hiding group-assigned and custom admin access. Normalize the enum and return an explicit incomplete state on fetch failure.
• setup-comp.sh is currently unable to reliably provision or start development environments: BSD macOS sort rejects every Bun version, SECRET_KEY is not passed into the API environment, and the no-Trigger path still launches trigger dev. Use portable version checks, pass the API env file to fill_secret, and provide a true root no-Trigger command.
• packages/db/scripts/import-cmmc.ts bypasses the importer’s RBAC/audit boundary and drops document types from imported controls, creating both governance exposure and incomplete evidence mappings. Route through the authorized importer or enforce equivalent checks, and persist documentLinks transactionally.

Not reviewed (too large): frameworks/cmmc-level-2/cmmc-level-2.import.json (~5,269 lines) - if these are generated or fixture files, add them to ignored paths to exclude them from future reviews.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/api/src/integration-platform/controllers/sync.controller.ts">

<violation number="1" location="apps/api/src/integration-platform/controllers/sync.controller.ts:316">
P3: Removing the old `GOOGLE_WORKSPACE_SYNC_FILTER_MODES` validation leaves the `GOOGLE_WORKSPACE_SYNC_FILTER_MODES` constant and the `GoogleWorkspaceSyncFilterMode` type (lines 76-79) unused, and the new code no longer sanitizes `sync_user_filter_mode`. The subsequent warning now fires with misleading text whenever the stored mode isn't literally one of all/exclude/include (e.g. an empty or malformed value), saying 'with an empty list' even though the list isn't the cause. Delete the now-dead constant and make the warning message match the actual reason (`userFilterMode` invalid vs include-with-empty-list).</violation>

<violation number="2" location="apps/api/src/integration-platform/controllers/sync.controller.ts:492">
P1: When `target_groups` is configured, this line makes selected group members a domain-only deactivation scope. The deactivation loop then treats every same-domain member outside the selected group as deleted because they are absent from `scopedUsers`; gate offboarding by the configured scope instead of domain alone.</violation>
</file>

<file name="packages/integration-platform/src/manifests/google-workspace/__tests__/admin-audit.test.ts">

<violation number="1" location="packages/integration-platform/src/manifests/google-workspace/__tests__/admin-audit.test.ts:58">
P3: The mock `fetch` in `runCheck` returns all provided activities regardless of the `startTime` that `fetchAdminActivities` sends, so none of these tests validate the core audit-window behavior. A regression where the check drops or miscomputes the lookback `startTime` would pass unnoticed, since even the 'honours a configured lookback window' test only asserts the `evidence.lookbackDays` value derived from parsing, not the window actually requested from the API. Have the mock capture the `startTime` param and assert it, or add a test that verifies the requested window.</violation>
</file>

<file name="frameworks/cmmc-level-2/generator/add_content.py">

<violation number="1" location="frameworks/cmmc-level-2/generator/add_content.py:5">
P2: On any checkout without the author's private scratchpad, the documented regeneration command fails with `FileNotFoundError` before adding policy content. Resolve paths relative to the repository or accept explicit input/output paths, and write the payload consumed by the import workflow.</violation>
</file>

<file name="packages/integration-platform/src/manifests/google-workspace/directory-client.ts">

<violation number="1" location="packages/integration-platform/src/manifests/google-workspace/directory-client.ts:123">
P1: When one selected group returns 403 or 429, this catch converts the failure into a partial membership set. The employee sync can then treat members of that unreadable group as deleted and deactivate them, especially when another selected group shares the domain. Propagate the resolution failure and abort the sync, or preserve known membership, instead of returning a partial set.</violation>
</file>

<file name="packages/integration-platform/src/manifests/google-workspace/admin-audit-events.ts">

<violation number="1" location="packages/integration-platform/src/manifests/google-workspace/admin-audit-events.ts:160">
P1: When a tenant has more than 20,000 activities in the lookback window, `fetchAdminActivities` returns partial data and both checks can report a clean pass despite not reviewing the full history. Propagate truncation to the checks and fail or mark the result incomplete instead of allowing truncated results to pass.</violation>
</file>

<file name="apps/api/src/auth/auth-context-response.interceptor.ts">

<violation number="1" location="apps/api/src/auth/auth-context-response.interceptor.ts:74">
P2: When an authenticated response has a domain-level `authType`, this guard mistakes it for the auth-context field and omits the caller context. Mark fixed-contract endpoints with `@SkipAuthContextResponse()` or move the context field to a non-colliding shape.</violation>

<violation number="2" location="apps/api/src/auth/auth-context-response.interceptor.ts:81">
P2: This global APP_INTERCEPTOR appends `authenticatedUser` (id + email) to every session-authenticated JSON response, yet the `@SkipAuthContextResponse()` opt-out it ships with is not applied to a single endpoint. The decorator's own docs say to use it on trust-portal and externally consumed payloads 'where leaking an internal user id/email would be a disclosure', but no endpoint opts out while the interceptor is enabled for all 94 controllers. Any such endpoint now echoes the user's email in its body for the first time. Audit which endpoints are externally consumed and apply `@SkipAuthContextResponse()` to them before enabling this globally.</violation>
</file>

<file name="apps/app/src/app/(app)/onboarding/lib/dispatch-onboarding-jobs.ts">

<violation number="1" location="apps/app/src/app/(app)/onboarding/lib/dispatch-onboarding-jobs.ts:47">
P2: When Trigger.dev has a transient API or network failure, this catch drops the job instead of arranging a retry. Because `completeOnboarding` ignores `failed` and stores no `triggerJobId`, the completed-organization redirect leaves no recovery path for AI enrichment or fleet-label creation. Persist a retryable outbox/failure or schedule retries while keeping onboarding successful.</violation>
</file>

<file name="packages/integration-platform/src/manifests/google-workspace/checks/admin-security-events.ts">

<violation number="1" location="packages/integration-platform/src/manifests/google-workspace/checks/admin-security-events.ts:72">
P2: When an audited setting is changed to a stronger value, this loop still creates a failure because it never evaluates `NEW_VALUE`. Distinguish weakening values from hardening values before calling `ctx.fail()`.</violation>

<violation number="2" location="packages/integration-platform/src/manifests/google-workspace/checks/admin-security-events.ts:72">
P2: `REVOKE_ADMIN_PRIVILEGE` produces a duplicate finding in this settings check and in `admin-privilege-changes`. Exclude privilege events here or split the shared map so this check remains limited to security-setting events.</violation>

<violation number="3" location="packages/integration-platform/src/manifests/google-workspace/checks/admin-security-events.ts:85">
P2: When two same-named audit events share a timestamp, this ID collides and marking one finding as an exception applies to both. Include the activity `uniqueQualifier` and an event-specific discriminator in `resourceId`.</violation>
</file>

<file name="apps/api/src/app.module.ts">

<violation number="1" location="apps/api/src/app.module.ts:153">
P2: Platform-admin endpoints will not receive the auth context fields because `PlatformAdminGuard` does not populate `request.authType`. Either populate the same auth context used by the interceptor or explicitly exclude these routes from the uniform-response contract.</violation>
</file>

<file name="packages/db/scripts/import-cmmc.ts">

<violation number="1" location="packages/db/scripts/import-cmmc.ts:20">
P1: This executable bypasses the framework importer’s RBAC boundary, allowing any process that can run it with database credentials to create platform framework data without an API permission check or audit context. Route the operation through an authenticated RBAC-protected API or add an explicitly authorized administrative execution boundary.</violation>

<violation number="2" location="packages/db/scripts/import-cmmc.ts:50">
P2: Payloads from an unsupported export format are accepted here and may be written with incompatible semantics instead of being rejected. Reject versions other than `"1"` before validating or importing the payload.</violation>

<violation number="3" location="packages/db/scripts/import-cmmc.ts:134">
P1: When the payload contains document types, this script silently drops them, so imported controls lose their required evidence-document mappings. Create and persist `documentLinks` inside the transaction just like the API importer.</violation>
</file>

<file name="start-comp.sh">

<violation number="1" location="start-comp.sh:13">
P2: When a developer uses Linux or Intel macOS and Postgres is not already running, the hardcoded `/opt/homebrew`/`postgresql@17` path prevents this launcher from starting the documented local stack. Resolve Homebrew dynamically or provide a platform-independent database path and an explicit platform check.</violation>

<violation number="2" location="start-comp.sh:25">
P2: When another checkout runs the same development command, `./start-comp.sh stop` terminates that checkout too because `pkill -f` is system-wide. Record the launched PIDs or process group and stop only processes started by this script.</violation>

<violation number="3" location="start-comp.sh:35">
P2: When the Homebrew cluster has not been initialized with the repository’s `comp` database and credentials, `pg_isready` reports success but the API cannot connect, and the launcher continues. Use the repository’s database service or verify and initialize the configured database before declaring Postgres ready.</violation>

<violation number="4" location="start-comp.sh:46">
P2: When the default environment is used, starting MinIO does not route uploads to it because this script never configures the S3 endpoint or credentials for the child servers. Set the local S3 configuration before launching or remove the MinIO readiness claim until the apps are configured to use it.</violation>

<violation number="5" location="start-comp.sh:47">
P2: When MinIO responds with 503 or another HTTP error, these probes still report it as ready because `curl` lacks `--fail`, so the script skips startup and hides the upload failure. Use `curl -fsS` for every health probe.</violation>

<violation number="6" location="start-comp.sh:64">
P2: When an unrelated process already owns one of these ports, the launcher reports the Comp service as already running and skips it, so the frontends can use the wrong server. Validate the listener identity or the service health endpoint before accepting an occupied port.</violation>
</file>

<file name="packages/integration-platform/src/manifests/google-workspace/role-assignments.ts">

<violation number="1" location="packages/integration-platform/src/manifests/google-workspace/role-assignments.ts:29">
P1: Google returns the role-assignment enum as `GROUP`, but `isGroupAssignment` only recognizes lowercase `group`, so group-assigned admin roles remain invisible to every user. Normalize the API value or compare against the provider’s uppercase enum.</violation>

<violation number="2" location="packages/integration-platform/src/manifests/google-workspace/role-assignments.ts:78">
P1: When the role-assignment API fails, this fallback makes the access review look complete while dropping custom and group-assigned admin roles. Propagate the failure or return an explicit incomplete state that `employeeAccessCheck` records as a check failure rather than treating partial assignments as authoritative.</violation>
</file>

<file name="setup-comp.sh">

<violation number="1" location="setup-comp.sh:14">
P2: The default repo path is hardcoded to the author's personal machine directory `/Users/chris/Code/comp`. Any other developer running `./setup-comp.sh` without an argument fails with "Repo not found" because that path does not exist on their machine, and the author's home path is needlessly embedded in the script. Default to the current directory (or the repo root) instead.</violation>

<violation number="2" location="setup-comp.sh:35">
P1: On macOS, BSD `sort` has no `-V` option, so this pipeline errors and rejects every Bun version. Use a portable numeric version comparison instead of `sort -V`.</violation>

<violation number="3" location="setup-comp.sh:64">
P3: `concurrently` and `turbo` are already root devDependencies (`^9.2.4` and `^2.10.5`), so the setup script's `bun add -d concurrently` and global `bun add -g turbo` are redundant and mutate the repo's package.json/bun.lock (and install a global turbo) purely as setup side effects. Drop these commands and let `bun install` handle them.</violation>

<violation number="4" location="setup-comp.sh:104">
P2: The secret examples scanned by `fill_secret` include inline comments, but this regex requires the assignment to end immediately after the empty value. `fill_secret` therefore silently leaves `BETTER_AUTH_SECRET` empty; allow trailing whitespace and comments in the match.</violation>

<violation number="5" location="setup-comp.sh:113">
P1: The script creates `apps/api/.env` but never passes it to `fill_secret`, leaving its required `SECRET_KEY` empty. The API then throws `SECRET_KEY environment variable is required` at startup; include the API env file in this loop.</violation>

<violation number="6" location="setup-comp.sh:137">
P2: The instructions tell users to configure `GOOGLE_ID` and `GOOGLE_SECRET`, but the env templates and auth configuration use `AUTH_GOOGLE_ID` and `AUTH_GOOGLE_SECRET`. Following this step leaves Google OAuth unset; print the exact variable names.</violation>

<violation number="7" location="setup-comp.sh:154">
P1: The migration command runs from the repository root, but root `package.json` has no `db:migrate` script, so onboarding stops with `Script not found`. Run the migration script from `packages/db` or add a root script.</violation>

<violation number="8" location="setup-comp.sh:155">
P1: This claims local startup does not require Trigger, but `bun run dev` still launches `trigger dev` for both the app and API. Use a root no-trigger development path, because the current concurrent commands can terminate the app when the Trigger process is unavailable.</violation>
</file>

<file name="frameworks/cmmc-level-2/generator/build.py">

<violation number="1" location="frameworks/cmmc-level-2/generator/build.py:2">
P1: The generator hardcodes the author's private scratchpad path (`/private/tmp/claude-501/...chris-Code-comp...`) for `sys.path.insert` and the payload output. On any other machine `python3 generator/build.py` fails to import `practices`, and the payload is written outside the repo instead of the committed `cmmc-level-2.import.json`, so the README's documented regeneration command cannot run and cannot update the import payload. Derive paths from the script location (e.g. `Path(__file__).parent`) and write to `frameworks/cmmc-level-2/cmmc-level-2.import.json`.</violation>

<violation number="2" location="frameworks/cmmc-level-2/generator/build.py:142">
P1: The documented build command cannot run in a clean checkout because this output directory does not exist, so `json.dump` raises `FileNotFoundError`; it also writes the result outside the repository. Use a repository-relative or CLI-configured output path, and keep it consistent with `add_content.py` and `cmmc-level-2.import.json`.</violation>
</file>

<file name="packages/integration-platform/src/manifests/google-workspace/checks/admin-privilege-changes.ts">

<violation number="1" location="packages/integration-platform/src/manifests/google-workspace/checks/admin-privilege-changes.ts:33">
P2: When Google returns a renamed, localized, or otherwise unlisted role name, `touchesSuperAdmin` reports the change at medium severity instead of high. Resolve the role through Google’s role-management API and use its authoritative super-admin metadata rather than a hardcoded role-name gate.</violation>
</file>

<file name="frameworks/cmmc-level-2/import-cmmc.ts">

<violation number="1" location="frameworks/cmmc-level-2/import-cmmc.ts:10">
P2: This 178-line file is an exact duplicate of `packages/db/scripts/import-cmmc.ts` (verified byte-identical). The README only documents the `packages/db` copy as the runnable script, so this copy is dead code that must be kept in sync whenever the API import service changes. Delete one copy and reference the single script from the README.</violation>
</file>

<file name="packages/integration-platform/src/manifests/google-workspace/variables.ts">

<violation number="1" location="packages/integration-platform/src/manifests/google-workspace/variables.ts:147">
P1: The new `targetGroupsVariable`/`targetDomainsVariable` `fetchOptions` pass the `VariableFetchContext` (whose `fetch` only accepts a path and never forwards query params) into `listGroups`/`listDomains`, which depend on `options.params`. The required `customer` param is dropped, so Google's Groups.list request fails and the catch returns an empty picker. Pass a context whose fetch supports params (or have the picker build the URL with params itself) before wiring these variables.</violation>
</file>

<sub>Tip: instead of fixing issues one by one fix them all with cubic

Re-trigger cubic</sub>

[cubic-dev-ai]

P1: When target_groups is configured, this line makes selected group members a domain-only deactivation scope. The deactivation loop then treats every same-domain member outside the selected group as deleted because they are absent from scopedUsers; gate offboarding by the configured scope instead of domain alone.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/api/src/integration-platform/controllers/sync.controller.ts, line 492:

<comment>When `target_groups` is configured, this line makes selected group members a domain-only deactivation scope. The deactivation loop then treats every same-domain member outside the selected group as deleted because they are absent from `scopedUsers`; gate offboarding by the configured scope instead of domain alone.</comment>

<file context>
@@ -493,7 +489,7 @@ export class SyncController {
 
     const deactivationGwDomains = new Set(
-      ouFilteredUsers.map((u) => u.primaryEmail.split('@')[1]?.toLowerCase()),
+      scopedUsers.map((u) => u.primaryEmail.split('@')[1]?.toLowerCase()),
     );
     const deactivationSuspendedEmails =
</file context>

[cubic-dev-ai]

P1: When one selected group returns 403 or 429, this catch converts the failure into a partial membership set. The employee sync can then treat members of that unreadable group as deleted and deactivate them, especially when another selected group shares the domain. Propagate the resolution failure and abort the sync, or preserve known membership, instead of returning a partial set.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At packages/integration-platform/src/manifests/google-workspace/directory-client.ts, line 123:

<comment>When one selected group returns 403 or 429, this catch converts the failure into a partial membership set. The employee sync can then treat members of that unreadable group as deleted and deactivate them, especially when another selected group shares the domain. Propagate the resolution failure and abort the sync, or preserve known membership, instead of returning a partial set.</comment>

<file context>
@@ -0,0 +1,166 @@
+      for (const id of await fetchGroupMemberUserIds({ client, groupId })) {
+        memberIds.add(id);
+      }
+    } catch {
+      // Surface loudly: a group that cannot be read would otherwise silently
+      // shrink the synced population.
</file context>

[cubic-dev-ai]

P1: When a tenant has more than 20,000 activities in the lookback window, fetchAdminActivities returns partial data and both checks can report a clean pass despite not reviewing the full history. Propagate truncation to the checks and fail or mark the result incomplete instead of allowing truncated results to pass.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At packages/integration-platform/src/manifests/google-workspace/admin-audit-events.ts, line 160:

<comment>When a tenant has more than 20,000 activities in the lookback window, `fetchAdminActivities` returns partial data and both checks can report a clean pass despite not reviewing the full history. Propagate truncation to the checks and fail or mark the result incomplete instead of allowing truncated results to pass.</comment>

<file context>
@@ -0,0 +1,167 @@
+    pageToken = response.nextPageToken;
+    pages += 1;
+
+    if (pageToken && pages >= MAX_PAGES) {
+      ctx.warn(`Stopped paging admin activity after ${MAX_PAGES} pages; results may be truncated`);
+      break;
</file context>

[cubic-dev-ai]

P1: This executable bypasses the framework importer’s RBAC boundary, allowing any process that can run it with database credentials to create platform framework data without an API permission check or audit context. Route the operation through an authenticated RBAC-protected API or add an explicitly authorized administrative execution boundary.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At packages/db/scripts/import-cmmc.ts, line 20:

<comment>This executable bypasses the framework importer’s RBAC boundary, allowing any process that can run it with database credentials to create platform framework data without an API permission check or audit context. Route the operation through an authenticated RBAC-protected API or add an explicitly authorized administrative execution boundary.</comment>

<file context>
@@ -0,0 +1,178 @@
+const dto = JSON.parse(fs.readFileSync(payloadPath, 'utf-8'));
+
+const adapter = new PrismaPg({ connectionString: process.env.DATABASE_URL! });
+const prisma = new PrismaClient({ adapter });
+
+function normalizeTipTapDoc(content: unknown): Record<string, unknown> {
</file context>

[cubic-dev-ai]

P1: When the payload contains document types, this script silently drops them, so imported controls lose their required evidence-document mappings. Create and persist documentLinks inside the transaction just like the API importer.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At packages/db/scripts/import-cmmc.ts, line 134:

<comment>When the payload contains document types, this script silently drops them, so imported controls lose their required evidence-document mappings. Create and persist `documentLinks` inside the transaction just like the API importer.</comment>

<file context>
@@ -0,0 +1,178 @@
+        );
+      }
+
+      const policyLinks = (dto.controlTemplates ?? []).flatMap((ct: any, ci: number) =>
+        (ct.policyTemplateIndices ?? []).map((pi: number) => ({
+          frameworkId: fw.id,
</file context>

[cubic-dev-ai]

P2: This global APP_INTERCEPTOR appends authenticatedUser (id + email) to every session-authenticated JSON response, yet the @SkipAuthContextResponse() opt-out it ships with is not applied to a single endpoint. The decorator's own docs say to use it on trust-portal and externally consumed payloads 'where leaking an internal user id/email would be a disclosure', but no endpoint opts out while the interceptor is enabled for all 94 controllers. Any such endpoint now echoes the user's email in its body for the first time. Audit which endpoints are externally consumed and apply @SkipAuthContextResponse() to them before enabling this globally.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/api/src/auth/auth-context-response.interceptor.ts, line 81:

<comment>This global APP_INTERCEPTOR appends `authenticatedUser` (id + email) to every session-authenticated JSON response, yet the `@SkipAuthContextResponse()` opt-out it ships with is not applied to a single endpoint. The decorator's own docs say to use it on trust-portal and externally consumed payloads 'where leaking an internal user id/email would be a disclosure', but no endpoint opts out while the interceptor is enabled for all 94 controllers. Any such endpoint now echoes the user's email in its body for the first time. Audit which endpoints are externally consumed and apply `@SkipAuthContextResponse()` to them before enabling this globally.</comment>

<file context>
@@ -0,0 +1,109 @@
+        const fields: AuthContextResponseFields = { authType: request.authType };
+
+        if (request.userId && request.userEmail) {
+          fields.authenticatedUser = {
+            id: request.userId,
+            email: request.userEmail,
</file context>

[cubic-dev-ai]

P2: The default repo path is hardcoded to the author's personal machine directory /Users/chris/Code/comp. Any other developer running ./setup-comp.sh without an argument fails with "Repo not found" because that path does not exist on their machine, and the author's home path is needlessly embedded in the script. Default to the current directory (or the repo root) instead.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At setup-comp.sh, line 14:

<comment>The default repo path is hardcoded to the author's personal machine directory `/Users/chris/Code/comp`. Any other developer running `./setup-comp.sh` without an argument fails with "Repo not found" because that path does not exist on their machine, and the author's home path is needlessly embedded in the script. Default to the current directory (or the repo root) instead.</comment>

<file context>
@@ -0,0 +1,165 @@
+
+set -euo pipefail
+
+REPO="${1:-/Users/chris/Code/comp}"
+
+bold() { printf '\033[1m%s\033[0m\n' "$*"; }
</file context>

Suggested change

	REPO="${1:-/Users/chris/Code/comp}"
	REPO="${1:-$(pwd)}" # or: ${1:-$PWD}

[cubic-dev-ai]

P3: Removing the old GOOGLE_WORKSPACE_SYNC_FILTER_MODES validation leaves the GOOGLE_WORKSPACE_SYNC_FILTER_MODES constant and the GoogleWorkspaceSyncFilterMode type (lines 76-79) unused, and the new code no longer sanitizes sync_user_filter_mode. The subsequent warning now fires with misleading text whenever the stored mode isn't literally one of all/exclude/include (e.g. an empty or malformed value), saying 'with an empty list' even though the list isn't the cause. Delete the now-dead constant and make the warning message match the actual reason (userFilterMode invalid vs include-with-empty-list).

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/api/src/integration-platform/controllers/sync.controller.ts, line 316:

<comment>Removing the old `GOOGLE_WORKSPACE_SYNC_FILTER_MODES` validation leaves the `GOOGLE_WORKSPACE_SYNC_FILTER_MODES` constant and the `GoogleWorkspaceSyncFilterMode` type (lines 76-79) unused, and the new code no longer sanitizes `sync_user_filter_mode`. The subsequent warning now fires with misleading text whenever the stored mode isn't literally one of all/exclude/include (e.g. an empty or malformed value), saying 'with an empty list' even though the list isn't the cause. Delete the now-dead constant and make the warning message match the actual reason (`userFilterMode` invalid vs include-with-empty-list).</comment>

<file context>
@@ -285,57 +292,46 @@ export class SyncController {
+    const scopedUsers = users.filter((user) =>
+      isGoogleWorkspaceUserInScope(user, filterConfig),
     );
+    const effectiveSyncFilterMode = resolveEffectiveSyncFilterMode(filterConfig);
+    const excludedTerms = filterConfig.excludedTerms;
 
</file context>

[cubic-dev-ai]

P3: The mock fetch in runCheck returns all provided activities regardless of the startTime that fetchAdminActivities sends, so none of these tests validate the core audit-window behavior. A regression where the check drops or miscomputes the lookback startTime would pass unnoticed, since even the 'honours a configured lookback window' test only asserts the evidence.lookbackDays value derived from parsing, not the window actually requested from the API. Have the mock capture the startTime param and assert it, or add a test that verifies the requested window.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At packages/integration-platform/src/manifests/google-workspace/__tests__/admin-audit.test.ts, line 58:

<comment>The mock `fetch` in `runCheck` returns all provided activities regardless of the `startTime` that `fetchAdminActivities` sends, so none of these tests validate the core audit-window behavior. A regression where the check drops or miscomputes the lookback `startTime` would pass unnoticed, since even the 'honours a configured lookback window' test only asserts the `evidence.lookbackDays` value derived from parsing, not the window actually requested from the API. Have the mock capture the `startTime` param and assert it, or add a test that verifies the requested window.</comment>

<file context>
@@ -0,0 +1,231 @@
+    },
+    fetch: (async <T,>(): Promise<T> => {
+      if (fetchError) throw fetchError;
+      return { items: activities } as unknown as T;
+    }) as CheckContext['fetch'],
+  } as CheckContext;
</file context>

[cubic-dev-ai]

P3: concurrently and turbo are already root devDependencies (^9.2.4 and ^2.10.5), so the setup script's bun add -d concurrently and global bun add -g turbo are redundant and mutate the repo's package.json/bun.lock (and install a global turbo) purely as setup side effects. Drop these commands and let bun install handle them.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At setup-comp.sh, line 64:

<comment>`concurrently` and `turbo` are already root devDependencies (`^9.2.4` and `^2.10.5`), so the setup script's `bun add -d concurrently` and global `bun add -g turbo` are redundant and mutate the repo's package.json/bun.lock (and install a global turbo) purely as setup side effects. Drop these commands and let `bun install` handle them.</comment>

<file context>
@@ -0,0 +1,165 @@
+bun install
+ok "bun install"
+
+bun add -d concurrently >/dev/null 2>&1 && ok "concurrently" || warn "concurrently install skipped"
+
+if ! command -v turbo >/dev/null 2>&1; then
</file context>