trycompai
diff --git a/‎.mcp.json‎
Lines changed: 8 additions & 0 deletions b/‎.mcp.json‎
Lines changed: 8 additions & 0 deletions
diff --git a/‎apps/api/prisma/client.js‎
Lines changed: 60 additions & 2 deletions b/‎apps/api/prisma/client.js‎
Lines changed: 60 additions & 2 deletions
diff --git a/‎apps/api/prisma/client.ts‎
Lines changed: 40 additions & 4 deletions b/‎apps/api/prisma/client.ts‎
Lines changed: 40 additions & 4 deletions
diff --git a/‎apps/api/prisma/index.js‎
Lines changed: 0 additions & 1 deletion b/‎apps/api/prisma/index.js‎
Lines changed: 0 additions & 1 deletion
diff --git a/‎apps/api/src/auth/permission.guard.ts‎
Lines changed: 7 additions & 6 deletions b/‎apps/api/src/auth/permission.guard.ts‎
Lines changed: 7 additions & 6 deletions
diff --git a/‎apps/api/src/policies/policies.controller.ts‎
Lines changed: 1 addition & 1 deletion b/‎apps/api/src/policies/policies.controller.ts‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎apps/api/src/risks/risks.service.ts‎
Lines changed: 25 additions & 3 deletions b/‎apps/api/src/risks/risks.service.ts‎
Lines changed: 25 additions & 3 deletions
diff --git a/‎apps/api/src/risks/strategy-descriptions.spec.ts‎
Lines changed: 124 additions & 0 deletions b/‎apps/api/src/risks/strategy-descriptions.spec.ts‎
Lines changed: 124 additions & 0 deletions
@@ -0,0 +1,8 @@
+{
+  "mcpServers": {
+    "trigger": {
+      "command": "bunx",
+      "args": ["trigger.dev@latest", "mcp"]
+    }
+  }
+}
@@ -2,8 +2,66 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.db = void 0;
 const client_1 = require("@prisma/client");
+const adapter_pg_1 = require("@prisma/adapter-pg");
 const globalForPrisma = global;
-exports.db = globalForPrisma.prisma || new client_1.PrismaClient();
+const LOCAL_HOSTNAMES = new Set(['localhost', '127.0.0.1', '::1']);
+function stripSslMode(connectionString) {
+    const url = new URL(connectionString);
+    url.searchParams.delete('sslmode');
+    return url.toString();
+}
+function isLocalhostUrl(connectionString) {
+    try {
+        const { hostname } = new URL(connectionString);
+        // Strip square brackets from IPv6 host form (e.g. [::1] → ::1)
+        const stripped = hostname.replace(/^\[/, '').replace(/\]$/, '');
+        return LOCAL_HOSTNAMES.has(stripped);
+    }
+    catch {
+        // Malformed URL — be conservative and treat as remote so we don't
+        // accidentally disable TLS verification.
+        return false;
+    }
+}
+function createPrismaClient() {
+    const rawUrl = process.env.DATABASE_URL;
+    const isLocalhost = isLocalhostUrl(rawUrl);
+    // Strategy:
+    // - Localhost: TLS off (typical dev Postgres has no cert).
+    // - Remote with NODE_EXTRA_CA_CERTS set: verified TLS using that bundle
+    //   (e.g. Docker with the RDS CA bundle baked in).
+    // - Remote in explicit opt-out mode (PRISMA_ALLOW_INSECURE_TLS=1):
+    //   unverified TLS — used by Trigger.dev / Vercel envs that connect via
+    //   a tunneled proxy whose cert can't be pinned. Must be set deliberately;
+    //   the previous default ("just turn off verification") silently exposed
+    //   prod connections to MITM. (Cubic finding #1 on PR #2671.)
+    // - Remote with neither: throw at boot — surface the misconfig instead of
+    //   silently downgrading.
+    const hasCABundle = !!process.env.NODE_EXTRA_CA_CERTS;
+    const allowInsecure = process.env.PRISMA_ALLOW_INSECURE_TLS === '1';
+    let ssl;
+    if (isLocalhost) {
+        ssl = undefined;
+    }
+    else if (hasCABundle) {
+        ssl = true;
+    }
+    else if (allowInsecure) {
+        ssl = { rejectUnauthorized: false };
+    }
+    else {
+        throw new Error('Refusing to connect to a non-local Postgres without TLS verification. Set NODE_EXTRA_CA_CERTS to a CA bundle, or set PRISMA_ALLOW_INSECURE_TLS=1 if you intentionally want unverified TLS.');
+    }
+    // Strip sslmode from the connection string to avoid conflicts with the explicit ssl option
+    const url = ssl !== undefined ? stripSslMode(rawUrl) : rawUrl;
+    const adapter = new adapter_pg_1.PrismaPg({ connectionString: url, ssl });
+    return new client_1.PrismaClient({
+        adapter,
+        transactionOptions: {
+            timeout: 60000,
+        },
+    });
+}
+exports.db = globalForPrisma.prisma || createPrismaClient();
 if (process.env.NODE_ENV !== 'production')
     globalForPrisma.prisma = exports.db;
-//# sourceMappingURL=client.js.map
 
@@ -3,19 +3,55 @@ import { PrismaPg } from '@prisma/adapter-pg';
 
 const globalForPrisma = global as unknown as { prisma: PrismaClient };
 
+const LOCAL_HOSTNAMES = new Set(['localhost', '127.0.0.1', '::1']);
+
 function stripSslMode(connectionString: string): string {
   const url = new URL(connectionString);
   url.searchParams.delete('sslmode');
   return url.toString();
 }
 
+function isLocalhostUrl(connectionString: string): boolean {
+  try {
+    const { hostname } = new URL(connectionString);
+    // Strip square brackets from IPv6 host form (e.g. [::1] → ::1)
+    const stripped = hostname.replace(/^\[/, '').replace(/\]$/, '');
+    return LOCAL_HOSTNAMES.has(stripped);
+  } catch {
+    // Malformed URL — be conservative and treat as remote so we don't
+    // accidentally disable TLS verification.
+    return false;
+  }
+}
+
 function createPrismaClient(): PrismaClient {
   const rawUrl = process.env.DATABASE_URL!;
-  const isLocalhost = /localhost|127\.0\.0\.1|::1/.test(rawUrl);
-  // Use verified SSL when NODE_EXTRA_CA_CERTS is set (Docker with RDS CA bundle),
-  // otherwise fall back to unverified SSL (Trigger.dev, Vercel, other environments).
+  const isLocalhost = isLocalhostUrl(rawUrl);
+  // Strategy:
+  // - Localhost: TLS off (typical dev Postgres has no cert).
+  // - Remote with NODE_EXTRA_CA_CERTS set: verified TLS using that bundle
+  //   (e.g. Docker with the RDS CA bundle baked in).
+  // - Remote in explicit opt-out mode (PRISMA_ALLOW_INSECURE_TLS=1):
+  //   unverified TLS — used by Trigger.dev / Vercel envs that connect via
+  //   a tunneled proxy whose cert can't be pinned. Must be set deliberately;
+  //   the previous default ("just turn off verification") silently exposed
+  //   prod connections to MITM. (Cubic finding #1 on PR #2671.)
+  // - Remote with neither: throw at boot — surface the misconfig instead of
+  //   silently downgrading.
   const hasCABundle = !!process.env.NODE_EXTRA_CA_CERTS;
-  const ssl = isLocalhost ? undefined : hasCABundle ? true : { rejectUnauthorized: false };
+  const allowInsecure = process.env.PRISMA_ALLOW_INSECURE_TLS === '1';
+  let ssl: undefined | true | { rejectUnauthorized: false };
+  if (isLocalhost) {
+    ssl = undefined;
+  } else if (hasCABundle) {
+    ssl = true;
+  } else if (allowInsecure) {
+    ssl = { rejectUnauthorized: false };
+  } else {
+    throw new Error(
+      'Refusing to connect to a non-local Postgres without TLS verification. Set NODE_EXTRA_CA_CERTS to a CA bundle, or set PRISMA_ALLOW_INSECURE_TLS=1 if you intentionally want unverified TLS.',
+    );
+  }
   // Strip sslmode from the connection string to avoid conflicts with the explicit ssl option
   const url = ssl !== undefined ? stripSslMode(rawUrl) : rawUrl;
   const adapter = new PrismaPg({ connectionString: url, ssl });
 
@@ -18,4 +18,3 @@ exports.db = void 0;
 __exportStar(require("@prisma/client"), exports);
 var client_1 = require("./client");
 Object.defineProperty(exports, "db", { enumerable: true, get: function () { return client_1.db; } });
-//# sourceMappingURL=index.js.map
@@ -187,12 +187,13 @@ export class PermissionGuard implements CanActivate {
     // the schema rejects every request with `[body] Invalid input`, the
     // catch in canActivate turns that into a generic "Unable to verify
     // permissions" 403, and EVERY cookie-authenticated request returns 403.
-    // Reproduced repo-side via `bun run zod-repro.mjs`. Discovered on
-    // ENG-221 and the same fix applies here.
-    const result = await auth.api.hasPermission({
-      headers,
-      body: { permissions, permission: undefined },
-    });
+    //
+    // Spell the body out via a separate variable so TypeScript's excess-
+    // property check (only applied to fresh object literals) doesn't
+    // reject the extra `permission` key — the runtime accepts the wider
+    // shape per the union schema.
+    const body = { permissions, permission: undefined };
+    const result = await auth.api.hasPermission({ headers, body });
 
     return result.success === true;
   }
 
@@ -1319,7 +1319,7 @@ Keep responses helpful and focused on the policy editing task.`;
     ];
 
     const result = streamText({
-      model: openai('gpt-5.1'),
+      model: openai('gpt-5.5'),
       system: systemPrompt,
       messages: convertToModelMessages(messages),
     });
 
@@ -8,6 +8,7 @@ import { db, Prisma } from '@db';
 import { CreateRiskDto } from './dto/create-risk.dto';
 import { GetRisksQueryDto } from './dto/get-risks-query.dto';
 import { UpdateRiskDto } from './dto/update-risk.dto';
+import { resolveStrategyDescriptionUpdate } from './strategy-descriptions';
 
 export interface PaginatedRisksResult {
   data: Prisma.RiskGetPayload<{
@@ -94,6 +95,10 @@ export class RisksService {
                 },
               },
             },
+            // Linked task statuses are needed by the table to compute the
+            // current (interpolated) severity score so the badge reflects
+            // treatment progress, not just inherent risk.
+            tasks: { select: { id: true, status: true } },
           },
         }),
         db.risk.count({ where }),
@@ -128,6 +133,14 @@ export class RisksService {
               user: true,
             },
           },
+          tasks: {
+            select: {
+              id: true,
+              title: true,
+              status: true,
+              controls: { select: { id: true, name: true } },
+            },
+          },
         },
       });
 
@@ -182,8 +195,8 @@ export class RisksService {
     updateRiskDto: UpdateRiskDto,
   ) {
     try {
-      // First check if the risk exists in the organization
-      await this.findById(id, organizationId);
+      // Need the existing row to resolve strategy/description swaps below.
+      const existing = await this.findById(id, organizationId);
 
       if (updateRiskDto.assigneeId) {
         await this.validateAssigneeNotPlatformAdmin(
@@ -192,9 +205,18 @@ export class RisksService {
         );
       }
 
+      // Keep per-strategy descriptions independent in the strategyDescriptions
+      // JSON map: a Mitigate plan, an Accept rationale, and a Transfer
+      // rationale all live alongside each other, swapped in/out of the active
+      // `treatmentStrategyDescription` field as the user changes strategy.
+      const resolvedStrategyFields = resolveStrategyDescriptionUpdate(
+        existing,
+        updateRiskDto,
+      );
+
       const updatedRisk = await db.risk.update({
         where: { id },
-        data: updateRiskDto,
+        data: { ...updateRiskDto, ...resolvedStrategyFields },
       });
 
       this.logger.log(`Updated risk: ${updatedRisk.title} (${id})`);
 
@@ -0,0 +1,124 @@
+import { describe, expect, it, jest } from '@jest/globals';
+
+// Mock @db before importing the helper so we don't pull in the real Prisma
+// client (which requires DATABASE_URL at module load).
+jest.mock('@db', () => ({
+  RiskTreatmentType: {
+    accept: 'accept',
+    avoid: 'avoid',
+    mitigate: 'mitigate',
+    transfer: 'transfer',
+  },
+}));
+
+import { RiskTreatmentType } from '@db';
+import { resolveStrategyDescriptionUpdate } from './strategy-descriptions';
+
+const baseExisting = {
+  treatmentStrategy: RiskTreatmentType.mitigate,
+  treatmentStrategyDescription: 'Current mitigate plan',
+  strategyDescriptions: {} as unknown,
+};
+
+describe('resolveStrategyDescriptionUpdate', () => {
+  it('returns empty when neither strategy nor description is changing', () => {
+    expect(resolveStrategyDescriptionUpdate(baseExisting, {})).toEqual({});
+    expect(
+      resolveStrategyDescriptionUpdate(baseExisting, { assigneeId: 'mbr_1' } as never),
+    ).toEqual({});
+  });
+
+  it('on strategy change: saves current description into the OLD slot', () => {
+    const result = resolveStrategyDescriptionUpdate(baseExisting, {
+      treatmentStrategy: RiskTreatmentType.accept,
+    });
+    expect(result.treatmentStrategy).toBe(RiskTreatmentType.accept);
+    expect(result.strategyDescriptions).toEqual({
+      mitigate: 'Current mitigate plan',
+    });
+    // Active text becomes empty (no Accept rationale saved yet)
+    expect(result.treatmentStrategyDescription).toBeNull();
+  });
+
+  it('on strategy change: loads NEW strategy slot into active text when present', () => {
+    const result = resolveStrategyDescriptionUpdate(
+      {
+        ...baseExisting,
+        strategyDescriptions: {
+          accept: 'We accept this risk because of cost-benefit analysis.',
+        },
+      },
+      { treatmentStrategy: RiskTreatmentType.accept },
+    );
+    expect(result.treatmentStrategyDescription).toBe(
+      'We accept this risk because of cost-benefit analysis.',
+    );
+    // Mitigate plan still preserved in the map
+    expect(result.strategyDescriptions).toEqual({
+      mitigate: 'Current mitigate plan',
+      accept: 'We accept this risk because of cost-benefit analysis.',
+    });
+  });
+
+  it('on description change without strategy change: mirrors into active strategy slot', () => {
+    const result = resolveStrategyDescriptionUpdate(baseExisting, {
+      treatmentStrategyDescription: 'Updated mitigate plan',
+    });
+    expect(result.treatmentStrategy).toBeUndefined();
+    expect(result.treatmentStrategyDescription).toBe('Updated mitigate plan');
+    expect(result.strategyDescriptions).toEqual({
+      mitigate: 'Updated mitigate plan',
+    });
+  });
+
+  it('on both change: explicit description wins as the new active text', () => {
+    const result = resolveStrategyDescriptionUpdate(
+      {
+        ...baseExisting,
+        strategyDescriptions: {
+          accept: 'Old accept rationale',
+        },
+      },
+      {
+        treatmentStrategy: RiskTreatmentType.accept,
+        treatmentStrategyDescription: 'Brand-new accept rationale',
+      },
+    );
+    expect(result.treatmentStrategy).toBe(RiskTreatmentType.accept);
+    expect(result.treatmentStrategyDescription).toBe('Brand-new accept rationale');
+    expect(result.strategyDescriptions).toEqual({
+      mitigate: 'Current mitigate plan',
+      accept: 'Brand-new accept rationale',
+    });
+  });
+
+  it('clears the slot when description is set to empty', () => {
+    const result = resolveStrategyDescriptionUpdate(
+      {
+        ...baseExisting,
+        strategyDescriptions: { mitigate: 'old text' },
+      },
+      { treatmentStrategyDescription: '' },
+    );
+    expect(result.strategyDescriptions).toEqual({});
+  });
+
+  it('handles malformed strategyDescriptions gracefully', () => {
+    const result = resolveStrategyDescriptionUpdate(
+      { ...baseExisting, strategyDescriptions: 'not an object' as unknown },
+      { treatmentStrategy: RiskTreatmentType.accept },
+    );
+    // Falls back to empty map; saves current Mitigate text
+    expect(result.strategyDescriptions).toEqual({
+      mitigate: 'Current mitigate plan',
+    });
+  });
+
+  it('does not save an empty old description into the slot', () => {
+    const result = resolveStrategyDescriptionUpdate(
+      { ...baseExisting, treatmentStrategyDescription: '' },
+      { treatmentStrategy: RiskTreatmentType.accept },
+    );
+    expect(result.strategyDescriptions).toEqual({});
+  });
+});