[comp] Production Deploy by github-actions[bot] · Pull Request #2912 · trycompai/comp

github-actions · 2026-05-22T14:14:35Z

This is an automated pull request to release the candidate branch into production, which will trigger a deployment.
It was created by the [Production PR] action.

Summary by cubic

Adds a manual-steps fallback for cloud security auto-remediation so users always get clear instructions when a fix can’t be applied. Also fixes trust portal branding persistence (color and favicon), allows clearing brand color, and removes the exemption label in Background Checks.

New Features
- Cloud tests: when a plan is invalid, has no steps, or AWS rejects a step, return guided steps and a reason instead of a raw error; single-fix dialog now renders these steps; batch flows mark the item failed with the reason.
- Attempt one repair pass on invalid refined steps before falling back to guided steps.
- Broaden validation/error coverage and diffs: more “validation error” patterns matched; expanded actionable prefixes to improve will-change previews.
- Tests added for manual classification and precedence rules in the trigger task.
Bug Fixes
- Persist brand color and favicon across remounts via TrustPortalBrandingSettings; normalize hex (#RRGGBB, uppercase); allow clearing the color to reset default; refresh via next/navigation.
- UpdateTrustFavicon updates preview, supports remove, and refreshes on success.
- Remove “Logs a compliance exception” label from the Background Check “Mark as exempt” card.
- Brand settings UI adopts Field/FieldLabel from @trycompai/design-system and Controller from react-hook-form.

^{Written for commit 35af953. Summary will update on new commits. Review in cubic}

fix(trust): keep portal branding after save

vercel · 2026-05-22T14:14:43Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
app (staging)	Ready	Preview, Comment	May 22, 2026 3:42pm
comp-framework-editor (staging)	Building	Preview	May 22, 2026 3:42pm

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
portal (staging)	Skipped		May 22, 2026 3:42pm

cubic-dev-ai

1 issue found across 8 files

Confidence score: 3/5

There is a concrete user-facing regression in apps/app/src/app/(app)/[orgId]/trust/portal-settings/components/BrandSettings.tsx: rejecting empty values prevents persisting null, so users can no longer clear the brand color.
Given the issue’s medium severity (6/10) and high confidence (8/10), this introduces meaningful behavior risk in settings management, so this is not quite in low-risk merge territory.
Pay close attention to apps/app/src/app/(app)/[orgId]/trust/portal-settings/components/BrandSettings.tsx - save validation currently blocks empty input needed to clear brand color.

_{Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic}

…olor fix(app): allow clearing brand color and remove background check label

…coverage Adds the building blocks for the manual-steps fallback shipped in the next two commits, plus broadens the pattern matcher and actionable- prefix list so more findings exercise the existing auto-repair paths instead of bailing out: 1. New `AiRemediationService.generateManualSteps(...)`: takes the finding, the failed plan, and the concrete failure reason, and returns real customer-facing manual instructions via Sonnet (kept on the cheap model since this only fires on failure paths and is plain natural language). Hard fallback to the adapter remediation text if the AI call itself throws, so the customer never sees a raw error. 2. `looksLikeValidationError` now matches `MissingParameter`, "must contain the parameter", "missing parameter", "parameter is required", "must specify" — covers the EC2-style error wording that the previous regex missed. 3. `ACTIONABLE_PREFIXES` adds `Authorize`, `Revoke`, `Allow`, `Deny`, `Disable`, `Detach`, `Add`, `Remove`, `Register`, `Deregister`, `Tag`, `Untag`. Security-group / IAM-style fix plans now produce meaningful `willChange` diffs instead of `{}` `{}`. 4. Exports `FindingContext` so it can be reused by the orchestration service (next commit) when invoking the new fallback path. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Customers were seeing raw "Fix could not be applied — <cryptic error>" when the AI's refined plan failed pre-execution validation or AWS rejected a step the executor couldn't auto-repair. The fix swaps every throw inside executeRemediation for a graceful fallback that returns real, AI-generated manual instructions in the existing `canAutoFix:false` response shape — so the frontend renders them with the guided-steps UI it already supports. Concrete changes inside the AWS executeRemediation flow: - Hoist `findingCtx` once at the top of the function so the refineFixPlan call, the per-step repair callback, and the new fallback path all see the same context. - Read-step validation failures → fall back to manual instead of throwing. (Read steps rarely fail; skipping repair here keeps the flow simple.) - "Refined plan has no fix steps" → fall back to manual instead of throwing. There's nothing to repair. - Refined-plan fix-step validation failures → NEW: attempt one AI repair pass on the offending steps (`repairInvalidSteps` parses the step indices from the validator errors and calls `refineStepFromError` per step), then re-validate. If still invalid, fall back to manual. Closes the gap where the executor's own AI step-repair never got a chance because the plan never reached execution. - Executor returned an unrecoverable error → fall back to manual, except for permission errors which still flow through the existing catch block (parseAwsPermissionError already has a polished fixScript payload — don't shadow it). GCP and Azure remediation services have the same throw-on-validation patterns and would benefit from the same treatment; left for a follow-up PR per the original scope. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

The API change in the previous commit returns `{ guidedOnly: true, guidedSteps, error }` when auto-fix gives up. This commit threads that response shape through the trigger-task progress metadata and the Remediation dialog so customers actually see the manual steps instead of a raw error. - `classifyExecuteResult` recognizes the new shape and emits a `{ type: 'manual', reason, guidedSteps }` classification. Defensive parsing strips non-string entries and ignores `guidedOnly` without real steps. Permission errors keep their existing precedence. - `remediateSingle` trigger task carries a new `phase: 'manual'` plus `guidedSteps` in its progress payload. - `RemediationDialog` reacts to the new phase by switching its preview state into the existing guided-only rendering (same UI used for plans where the AI declared `canAutoFix: false` upfront). - The two batch-fix paths (single-account + integrations) treat the manual classification as `failed` with the AI-generated reason — the batch UI doesn't render per-finding guided steps, but the user-facing message is now meaningful instead of cryptic. The per-finding manual steps remain available via the single-fix dialog. 8 new tests on `execute-result.test.ts` (10 total) cover the manual classification, the precedence rules, and the defensive parsing. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…allback fix(cloud-tests): graceful manual-step fallback so auto-remediate never shows raw errors

tofikwest · 2026-05-22T15:46:03Z

@cubic-dev-ai review it

cubic-dev-ai · 2026-05-22T15:46:12Z

@cubic-dev-ai review it

@tofikwest I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 22 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Re-trigger cubic}

claudfuen · 2026-05-22T15:55:57Z

🎉 This PR is included in version 3.63.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

github-actions Bot and others added 3 commits May 22, 2026 02:47

chore: merge release v3.62.2 back to main [skip ci]

5857b64

fix(trust): persist portal branding settings

2b21d1c

Merge pull request #2911 from trycompai/tofik/fix-trust-portal-branding

a201fab

fix(trust): keep portal branding after save

github-actions Bot added prod-deploy automated-pr labels May 22, 2026

vercel Bot deployed to staging – comp-framework-editor May 22, 2026 14:15 View deployment

vercel Bot deployed to staging – app May 22, 2026 14:17 View deployment

cubic-dev-ai Bot reviewed May 22, 2026

View reviewed changes

Comment thread apps/app/src/app/(app)/[orgId]/trust/portal-settings/components/BrandSettings.tsx Outdated

tofikwest and others added 3 commits May 22, 2026 10:44

fix(trust): allow clearing brand color

e89b189

fix(people): remove background check exception label

ddb4b72

Merge pull request #2914 from trycompai/tofik/fix-clear-trust-brand-c…

b82b3c9

…olor fix(app): allow clearing brand color and remove background check label

vercel Bot temporarily deployed to staging – portal May 22, 2026 15:15 Inactive

vercel Bot deployed to staging – comp-framework-editor May 22, 2026 15:16 View deployment

vercel Bot deployed to staging – app May 22, 2026 15:19 View deployment

tofikwest and others added 5 commits May 22, 2026 11:28

Merge branch 'main' into tofik/auto-remediate-manual-fallback

f6c7d94

Merge pull request #2915 from trycompai/tofik/auto-remediate-manual-f…

35af953

…allback fix(cloud-tests): graceful manual-step fallback so auto-remediate never shows raw errors

vercel Bot temporarily deployed to staging – portal May 22, 2026 15:39 Inactive

vercel Bot deployed to staging – app May 22, 2026 15:42 View deployment

cubic-dev-ai Bot reviewed May 22, 2026

View reviewed changes

tofikwest merged commit 90eb738 into release May 22, 2026
13 of 14 checks passed

claudfuen added the released label May 22, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[comp] Production Deploy#2912

[comp] Production Deploy#2912
tofikwest merged 11 commits into
releasefrom
main

github-actions Bot commented May 22, 2026 •

edited by cubic-dev-ai Bot

Loading

Uh oh!

vercel Bot commented May 22, 2026 •

edited

Loading

Uh oh!

cubic-dev-ai Bot left a comment •

edited

Loading

Uh oh!

Uh oh!

tofikwest commented May 22, 2026

Uh oh!

cubic-dev-ai Bot commented May 22, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Uh oh!

Uh oh!

claudfuen commented May 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

github-actions Bot commented May 22, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by cubic

Uh oh!

vercel Bot commented May 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

tofikwest commented May 22, 2026

Uh oh!

cubic-dev-ai Bot commented May 22, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

claudfuen commented May 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions Bot commented May 22, 2026 •

edited by cubic-dev-ai Bot

Loading

vercel Bot commented May 22, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading