Release: staging → main

[izadoesdev]

Summary

150 commits from staging. Main highlights:

• Insights cockpit redesign (DAT-100, feat(insights): redesign insights as AI cockpit (DAT-100) #402) — new /insights org cockpit built on the existing query pipeline
• Agent overhaul — cost-aware streaming, thinking effort toggle, credit balance in header, inspectable tool steps, welcome state cleanup, slash command menu restored as prompt shortcuts
• Billing / autumn config — agent credits enforced via autumn, token+cost telemetry via tokenlens, web_search tool metered, 20% markup, seats removed (unlimited team members), uptime/status pages/alarms gating
• Tracker fixes — pixel plugin routed to /px.jpg, outgoing-links fixed, flush/unload reliability, strict route allowlist
• Security — CodeQL high-severity findings closed
• Uptime — heatmap day buckets aligned to user timezone

Test plan

• CI green on staging
• Smoke test /insights cockpit on production
• Verify agent credit balance + cost telemetry working
• Verify tracker pixel plugin hitting /px.jpg
• Spot-check billing autumn features (web_search metering, credit rates)

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 3f054617-1225-4fe4-a069-e4e69cd302de

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch staging

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
dashboard (staging)	Skipped		Apr 8, 2026 6:24pm
documentation (staging)	Skipped		Apr 8, 2026 6:24pm

[izadoesdev]

Automated First-Pass Review

What this PR does: Release PR merging 150 staging commits into main. Major features include the new /insights org cockpit with AI-generated narratives, an agent billing overhaul (cost-aware streaming, Autumn credit enforcement, web_search metering with 20% markup), tracker reliability fixes, and a significant frontend refactor that consolidates the insights UI into reusable components (InsightCard with compact/full variants, CockpitSignals, CockpitNarrative).

PR description: Thorough and well-structured. The squash-merge warning is especially helpful given the Release #383 conflict history.

---

Issues found

🟡 Narrative DB query ignores range parameter — The /org-narrative endpoint accepts a 7d/30d/90d range and tells the LLM to summarize "the last X," but the underlying query fetches top-5 insights by priority with no date filter. A "this week" narrative could surface month-old insights. See inline comment.

🟡 Cost probe lost its cross-reference comment — The agent-cost-probe.ts script had a comment linking it to autumn.config.ts. Removing it makes it easier for the two configs to drift out of sync. See inline comment.

🔵 Fire-and-forget billing tracking — Web search metering .catch()es silently. Fine for availability, but adding a tracing breadcrumb would help detect billing drift. See inline comment.

🔵 Unsafe type casts in cockpit page — insights-page-content.tsx uses several as unknown as ColumnDef<...> casts. Not urgent, but worth cleaning up to catch type regressions early.

Flags

⚡ High-impact: Billing & metering changes — Agent credit schema, web_search metering, Autumn enforcement. Verify production autumn.config.ts matches the updated rates here.

⚡ High-impact: Analytics ingestion path — The narrative endpoint runs LLM inference in the request path (cached, rate-limited, with deterministic fallback — all good). Just confirm the cache key correctly incorporates both organizationId and range.

---

Overall: Needs manual review

The architecture is solid — good use of caching, rate limiting, auth checks, and graceful LLM fallbacks. The frontend refactor is clean DRY work. The narrative date-range issue is the main thing worth fixing before merge. Everything else is minor. Reminder: merge commit, don't squash.

[izadoesdev]

🟡 Warning: DB query doesn't filter by range, so the narrative may be misleading.

generateNarrativeCached receives the range parameter (7d/30d/90d) and passes it to the LLM prompt ("summarize the last 7d"), but the actual DB query pulls the top 5 insights by priority for the org with no date filter. This means a "this week" narrative could surface stale insights from months ago.

Consider adding a createdAt filter to scope the query to the requested range:

const cutoff = dayjs().subtract(
  range === "7d" ? 7 : range === "30d" ? 30 : 90,
  "day"
).toDate();

// ...
.where(
  and(
    eq(analyticsInsights.organizationId, organizationId),
    gte(analyticsInsights.createdAt, cutoff)
  )
)

[izadoesdev]

🔵 Suggestion: Fire-and-forget billing could silently under-count usage.

If the Autumn billing service has a prolonged outage, web searches continue unmetered since .catch() only logs. This is probably the right tradeoff for availability, but consider adding a counter/metric for failed tracking calls so you can detect drift between actual usage and billed usage. Even a simple mergeWideEvent({ web_search_billing_track_failed: true }) would help.

[izadoesdev]

🟡 Warning: CURRENT_SCHEMA comment referencing autumn.config.ts was removed.

The old code had a helpful comment (// Matches creditSchema in apps/dashboard/autumn.config.ts) that tied this probe script to the production pricing config. With the 20% markup applied here, it'd be worth keeping a similar breadcrumb so future edits stay in sync. If someone updates autumn.config.ts later but forgets this file (or vice versa), the probe results will be wrong.

[greptile-apps]

Greptile Summary

This is a large staging→main release covering the new /insights org cockpit (narrative + signals panels, stat cards, focused-site picker), agent overhaul (slash-command menu, thinking-effort cycle button, unicode spinner), billing updates (20% credit markup, agent_web_search_calls metered via Autumn), and tracker/security fixes.

• P1 — generateNarrativeCached ignores range in the DB query: the WHERE clause only filters by organizationId; no createdAt ≥ cutoff guard is applied. All three range selections (7d / 30d / 90d) feed the LLM the same all-time top-5 signals and only differ in the time-label injected into the prompt, producing misleading "this week" vs "this quarter" narratives from identical data.

Confidence Score: 4/5

Safe to merge after fixing the narrative date-range filter; all other changes are clean.

One P1 correctness bug in generateNarrativeCached — the range selector silently has no effect on which insights the LLM summarises, producing misleading output for the 30d and 90d views. All other changes (billing, agent UX, cockpit components) are well-structured with no additional blockers.

apps/api/src/routes/insights.ts — generateNarrativeCached DB query missing range-based createdAt filter.

Vulnerabilities

No security concerns identified. The new /org-narrative endpoint validates org membership before serving data, applies per-user rate limiting, and caches results server-side. Web-search billing tracking uses fire-and-forget with no sensitive data leakage.

Important Files Changed

Filename	Overview
apps/api/src/routes/insights.ts	New /org-narrative endpoint with rate-limiting and caching; P1 bug: generateNarrativeCached DB query never filters by the range parameter, so narratives for all three ranges are built from the same all-time top-priority data.
apps/api/src/ai/tools/web-search.ts	Adds Autumn metered tracking for agent_web_search_calls after successful searches; fire-and-forget pattern with error logging is appropriate.
apps/dashboard/autumn.config.ts	Credit costs updated to 20% markup; agent_web_search_calls metered feature added at 5 credits per call; cost-probe script updated to match.
apps/dashboard/app/(main)/insights/_components/cockpit-narrative.tsx	New component rendering the org-level AI narrative; P2 issue: aria-label is hardcoded "Weekly summary" regardless of selected range.
apps/dashboard/app/(main)/insights/_components/cockpit-signals.tsx	New signals panel extracted from the old page content; filter/sort/dismiss/pagination logic is clean and well-separated from the parent layout.
apps/dashboard/app/(main)/insights/_components/insights-page-content.tsx	Major redesign into a cockpit layout with stat cards, mini-charts, and focused-site selector; P2: queries useMemo dep only on granularity (always "daily"), not the full dateRange.
apps/dashboard/app/(main)/websites/[id]/agent/_components/agent-input.tsx	Replaces thinking dropdown with a single-click cycle button; adds slash-command menu wired to keyboard navigation; layout unchanged.
apps/dashboard/lib/insight-api.ts	Adds fetchInsightsOrgNarrative fetch helper and OrgNarrativeResponse discriminated union; correct use of credentials: "include" and AbortSignal.timeout.

Sequence Diagram

sequenceDiagram
    participant UI as Dashboard (CockpitNarrative)
    participant Hook as useOrgNarrative
    participant API as GET /v1/insights/org-narrative
    participant RL as Rate Limiter
    participant Cache as Redis Cache
    participant DB as PostgreSQL (analyticsInsights)
    participant LLM as LLM (generateText)

    UI->>Hook: range changes (7d/30d/90d)
    Hook->>API: fetch ?organizationId=X&range=7d
    API->>API: verify org membership
    API->>RL: rateLimit(org:user, 30/hr)
    RL-->>API: allowed
    API->>Cache: get insights-narrative:X:7d
    alt Cache HIT
        Cache-->>API: cached narrative
    else Cache MISS
        API->>DB: SELECT top-5 by priority WHERE orgId=X
        Note over DB: Missing gte(createdAt, cutoff)
        DB-->>API: same all-time top-5 regardless of range
        API->>LLM: prompt with time label + insights
        LLM-->>API: narrative text
        API->>Cache: set TTL 1h
    end
    API-->>Hook: success narrative generatedAt
    Hook-->>UI: render narrative

Loading

_{Reviews (1): Last reviewed commit: "chore: merge main into staging" | Re-trigger Greptile}

[greptile-apps]

Range parameter not applied to DB query

generateNarrativeCached accepts range and injects it into the LLM prompt's time context ("over the last 7d/30d/90d"), but the Drizzle query has no gte(analyticsInsights.createdAt, cutoff) filter — it always fetches the top-5 by priority from all-time data. Every range selection returns the same underlying insights, producing narratives that say "this quarter" vs "this week" about the exact same signals. Every other date-scoped query in this file (e.g. the main feed at line 862, the recency check at line 233) adds a cutoff guard; this one is missing it.

// before the `.limit(...)` call, compute and apply a cutoff:
const days = range === "7d" ? 7 : range === "30d" ? 30 : 90;
const cutoff = dayjs().subtract(days, "day").toDate();
.where(
  and(
    eq(analyticsInsights.organizationId, organizationId),
    gte(analyticsInsights.createdAt, cutoff),
  )
)

[greptile-apps]

aria-label hardcoded to "Weekly summary"

The section's accessible label is "Weekly summary" regardless of the selected range — users on a 30d or 90d view will hear "Weekly summary" from screen readers. Use the same rangeLabel helper already defined in this file.

[greptile-apps]

queries memo only tracks granularity, not the full date range

The queries array is memoized on dateRange.granularity alone — but granularity is always "daily" regardless of the selected range. Adding dateRange to the deps avoids the subtle mismatch.