Promote dev to main (upstream v2.25.1 + code-scanning fixes)

[JOY (JOY)]

What kind of change does this PR introduce?

Release promotion (dev → main) for the prod deploy. It carries exactly the reviewed diff of #69, with no new commits. That is the upstream Postiz v2.25.1 sync (135 commits) plus the fork-side follow-ups:

• the DOS billing gating ported onto upstream's redesigned billing page
• MCP upload tool hints pointed at this deployment's public API and docs, YouTube Workspace message branded
• the React Compiler ESLint fixes
• the CodeQL js/double-escaping fix in stripHtmlValidation

Once merged, build-containers.yml publishes ghcr.io/dos/crove-post:latest. Nothing else changes for the running prod stack until docker compose -f scripts/docker-compose.prod.yaml up -d is run on crove-server.

Why was this change needed?

Production deploys from main (:latest image). #69 is merged and green on dev, so this promotes it.

Technical Details & Scope

See #69 for the full write-up, covering upstream highlights, conflict resolutions and follow-up commits. The things that matter for this deploy:

PROD DB prerequisite: run before compose up. These are two new nullable columns plus an index, all additive. The new code reads them, so prod must have them before the new image serves traffic. They go through the DOS-Me ledger, as with the v2.25.0 table.

ALTER TABLE "Integration" ADD COLUMN IF NOT EXISTS "customName" TEXT;
ALTER TABLE "Post" ADD COLUMN IF NOT EXISTS "batchId" TEXT;
CREATE INDEX IF NOT EXISTS "Post_batchId_idx" ON "Post"("batchId");

Temporal / email: emails now run as one sendSingleEmailWorkflow per email, on the rate-limited email and email-bulk task queues. The orchestrator must poll both queues, so do not add them to EXCLUDE_QUEUE. The old sendEmailWorkflow stays registered so the running instance can drain.

Other workflow changes: autopost and missing-post now continue-as-new behind patched(), and streak moved to streakWorkflowV2. All of these are versioned upstream changes, so in-flight runs replay safely.

Unchanged: the DOS shared billing flows (dos.me checkout, portal and cancel), DOS ID SSO, the branding engine, and the MCP tool aliases.

Verification & Testing

• On dev at aa4172ca (the merge: upstream v2.25.1 (135 commits - billing redesign, settings tabs, creation modal, email queues) #69 merge commit), all of these pass: Build, Branding Guard, ESLint, Code Quality Analysis (CodeQL). Build & Publish Crove Containers (:beta) was still running when this PR was opened.
• On merge: upstream v2.25.1 (135 commits - billing redesign, settings tabs, creation modal, email queues) #69, CI was green on its final head 6114dc54, including the ESLint and CodeQL code-scanning gates.
• Local checks on merge: upstream v2.25.1 (135 commits - billing redesign, settings tabs, creation modal, email queues) #69:
  • pnpm run build
  • frontend, backend and orchestrator typecheck
  • vitest 14/14
  • bootstrap jest suite 58/58 against Postgres + Redis
  • branding guard
  • a CodeQL CLI run, base vs head

QA

1. Before merging or deploying, confirm the three DDL statements above have landed on the prod DB through the DOS-Me ledger. In psql: \d "Integration" lists customName, and \d "Post" lists batchId and Post_batchId_idx.
2. Merge this PR. Confirm the Build & Publish Crove Containers run on main succeeds and pushes ghcr.io/dos/crove-post:latest.
3. On crove-server, run docker compose -f scripts/docker-compose.prod.yaml up -d. The crove-post container restarts on the new image, and its logs show no Prisma "column does not exist" errors.
4. Log in at https://post.crove.com through DOS ID as the owner of a DOS Plus org and open /billing. Expect Free / Plus $9 / Pro $19 in one row, no Monthly/Yearly toggle, and no "Billing history" table. "Update Payment Method / Invoices History" opens the dos.me portal.
5. Trigger a password reset for a test account. The email arrives within a minute. In the Temporal UI, new notification emails show up as send_email_<uuid> workflows on the email / email-bulk queues.
6. Open /launches. Rename a channel from its menu, filter the calendar by two channels, then switch the customer. The custom name shows, and the channel filter resets for the new customer.
7. Open /plugs. Expect a redirect to /settings?tab=plugs.

Checklist:

• My code follows the project's code style and architectural conventions.
• Local build passes (pnpm run build).
• Branding guard validation passes (pnpm dlx tsx scripts/branding-guard.ts).
• Tests and typecheck have been verified without errors.
• Documentation has been updated (if applicable).
• No secrets or sensitive credentials are included in this PR.
• I have filled in the QA / Verification section above with real steps to verify this change.

🤖 Generated with Claude Code

https://claude.ai/code/session_01XFwPKMsHCF5VarWHQAsHtJ

---

Generated by Claude Code

[claude]

⚠️ Code review skipped — your organization has no extra usage available to pay for this review.

If your organization's extra usage balance is empty, an organization admin can add extra usage credits at claude.ai/admin-settings/usage. If its monthly spend limit was reached, an admin can raise it on the same page. If neither applies, contact Anthropic support.

Once extra usage is available, someone with write access to this repository can comment @claude review on this pull request to trigger a review.

[gemini-code-assist]

Code Review

This pull request introduces several enhancements and bug fixes across the application, focusing on billing history, integration management, mobile responsiveness, and Temporal workflow optimizations. Key updates include a new billing history component, bottom sheets for mobile settings, custom channel renaming, and a new media list tool. However, several critical issues were identified in the review: a casing mismatch in the billing controller that prevents cancellation emails, potential runtime TypeErrors due to unsafe property access on potentially empty arrays or undefined URLs, a context loss issue in the drag-and-drop provider, and a potential server-side rendering crash when accessing window.matchMedia directly.

[gemini-code-assist]

The setToCancel method in StripeService returns an object with cancelAt (camelCase), but here the code checks result.cancel_at (snake_case). This mismatch causes the condition to always evaluate to false, preventing the cancellation email notification from being sent.

Suggested change

	if (result.cancel_at) {
	if (result.cancelAt) {

[JOY (JOY)]

Leaving this as is. StripeService.setToCancel returns { id, cancel_at } in snake_case on all three paths: un-cancel, immediate cancel after a failed payment, and cancel at period end (stripe.service.ts). So result.cancel_at is the right key and the email is sent whenever a cancel is set. Switching to cancelAt would stop the email.

---

Generated by Claude Code

[gemini-code-assist]

If the drag handlers in HTML5Backend are prototype methods (which is standard for class methods in JS/TS), calling handler(event) directly as a plain function will invoke it with this set to undefined. This will cause a runtime TypeError when the handler tries to access internal properties of the backend. To preserve the correct context, use handler.call(backend, event) instead.

Suggested change

	backend[name] = (event: DragEvent) => {
	if (!isInsideEditor(event)) {
	handler(event);
	}
	};
	backend[name] = (event: DragEvent) => {
	if (!isInsideEditor(event)) {
	handler.call(backend, event);
	}
	};

[JOY (JOY)]

Leaving this as is. In the react-dnd-html5-backend version installed here, HTML5BackendImpl assigns these handlers as instance arrow functions in its constructor (this.handleTopDragStart = (e)=>{…}, dist/HTML5BackendImpl.js:323). They are not prototype methods, so this is already bound lexically and calling handler(event) keeps the backend context. The backend itself registers them the same way, via addEventListener('dragstart', this.handleTopDragStart).

---

Generated by Claude Code

[gemini-code-assist]

Accessing window.matchMedia directly during server-side rendering (SSR) will throw a ReferenceError: window is not defined and crash the page. Ensure window is defined before accessing it.

Suggested change

	export const mediaLibrarySize = () =>
	window.matchMedia('(max-width: 1025px)').matches
	? '100%'
	: 'calc(100% - 80px)';
	export const mediaLibrarySize = () =>
	typeof window !== 'undefined' && window.matchMedia('(max-width: 1025px)').matches
	? '100%'
	: 'calc(100% - 80px)';

[JOY (JOY)]

Leaving this as is. mediaLibrarySize() is never called during render. Every caller runs it inside a click handler or an effect that opens the media modal, and all of them are in 'use client' components:

• showModal / openMedia callbacks in media.component.tsx and developer.component.tsx
• the show-modal emitter listener registered in a useEffect

So it only runs in the browser and never during SSR.

---

Generated by Claude Code

[gemini-code-assist]

If both release.releaseURL and post.releaseURL are null or undefined, calling .split(',') on them will throw a TypeError. Ensure the URL is defined before splitting it.

      const targetURL = release.releaseURL || post.releaseURL;
      if (targetURL) {
        tab.location.href = targetURL.split(',')[0];
      } else {
        tab.close();
        toaster.show(
          t('post_has_no_public_link', 'This post has no public link'),
          'warning'
        );
      }

[JOY (JOY)]

Leaving this as is. The open-post icon that calls openPost only renders when post.releaseURL?.startsWith('http') (calendar.tsx, around line 1329). So post.releaseURL is always a non-empty string when this runs, and (release.releaseURL || post.releaseURL) can't be null or undefined. The cases with no release URL return earlier with the "no public link", "reconnect" and "pending" toasts.

---

Generated by Claude Code

[gemini-code-assist]

Accessing f.users[0].disabled directly is unsafe if the users array is empty, which will throw a TypeError. Use optional chaining to safely access the property.

Suggested change

	.filter((f) => !f.users[0].disabled)
	.filter((f) => !f.users?.[0]?.disabled)

[JOY (JOY)]

Leaving this as is, and it was already answered on #69. getOrgsByUserId only returns orgs where users: { some: { userId } } matches, and its include filters users to that same userId. So every returned org has that row at users[0]. This filter also predates the sync.

---

Generated by Claude Code

[gemini-code-assist]

Accessing sibling.posts[0].publishDate directly is unsafe if sibling.posts is empty, which will throw a TypeError. Use optional chaining or a guard to safely access the property.

          if (sibling.posts?.[0]) {
            setChannelDate(
              sibling.integration,
              dayjs.utc(sibling.posts[0].publishDate).local()
            );
          }

[JOY (JOY)]

Leaving this as is. siblings is built in PostsService from the batch groups, and those groups are filtered with batchPosts.length && … before being mapped through groupForEditor. So every sibling has at least one post, and sibling.posts[0] is always defined.

---

Generated by Claude Code

[gemini-code-assist]

If event is a File[] array rather than a ClipboardEvent, event.clipboardData will be undefined, and calling getData on it will throw a TypeError. Use optional chaining to safely access clipboardData.

Suggested change

	const html = event.clipboardData.getData('text/html');
	const html = event?.clipboardData?.getData?.('text/html');

[JOY (JOY)]

Leaving this as is. When paste gets a File[], event.clipboardData is undefined, so clipboardItems = event.clipboardData?.items is undefined and the handler returns false a few lines above. The getData('text/html') call is only reached when clipboardData exists.

---

Generated by Claude Code