Changelog

Money-path: SERVER_URL checkout redirects, USD adaptive-pricing off, idempotent payment_failed, wired past_due, downgrade keeps tokens (zen-tests model), cancel-at-period-end + reactivate, portal return_url fallback. Billing-events audit + unified Billing History page. Admin validation with clear messages. UI redesign on design tokens. Real-Stripe test suite (13).

Rebuild with the changelog @ts-expect-error restored. Ships test Stripe publishable key for tester QA.

Billing: Stripe split into an operational runtime key and a catalog admin key (least-privilege). Subscription plans auto-provision their Stripe Product and monthly/yearly Prices from the admin on save. Webhook handlers read both old and new (2026 API) event shapes. Adds a Google sign-up button on the register form and points the landing Get Started button to /register.

Fix Asana 403 on listing projects: request teams:read (needed to read projects under teams in an org) and stories:read (task comments). Requires enabling both scopes in the Asana app developer console (OAuth > Permission Scopes); existing Asana connections must reconnect.

Resolves the remaining medium and low findings from the project audit: token-purchase webhook idempotency and ordering, no duplicate token balances, correct proration on downgrade, inline subscription cancellation, tighter access control on notifications/media/tenants/ticket collections, bot container restart picks up fresh tokens, hardened set-cookie/cron/asana/clickup routes, and a batch of frontend correctness fixes (open-redirect, upload awaiting, double-submit, broken link, object-URL leaks).

Closes the critical and high findings from the project audit: lock the user roles field to app admins (was a public admin-registration hole), authenticate the billing transactions endpoint, case-insensitive invite email matching, require tenant-admin on provider/token routes, stop workspace-select from wiping provider tokens, and move the Statistics redirect out of render.

Require at least two alphanumeric characters in an organization name, so a mostly-special-character name with a single stray digit is rejected while normal names still pass.

Tenant role model

• User = bot sysadmin (Dashboard/bot control, Employees, Groups, History, Statistics); Admin = owner (+ Bot Customization, Manage People, Billing).
• Fixed: a regular member could assign admin roles / edit org settings & provider tokens. Roles, tenant settings and secret tokens are now admin-only (server + UI).

Auth

• Redesigned split-screen login/register with password policy + strength meter, show/hide, placeholders; inline wrong-password/lockout errors; register submit gated on valid form.

Validation

• Organization name must contain at least one letter/number.

Infra

• date-fns dependency, pnpm allowBuilds, dockerode native externals, bot image auto-pull, ClickUp proxy path fix, stripe pinned to 10.x.

Added live demo

Added invite emails, and encryption to all restricted info in database (all private tokens)

• Fixed issue with importing employees due to missing tenant cookie.
• UI Improvments.

Task managers support

• Added support for task managers, other than Clickup.
• Added Asana task manager provider (beta)

Enhacned Support system

• Added base templates for all ticket types
• Added better filtration on ticket list page
• Removed selection ticket type from creation page
• Added button to create each type of ticket

• Added parentTitle to variables
• Support for conditional syntax for notification template for more advanced customization

• Group notification customization

• Added transaction field for Task history

• Small additions to Billing API endpoints
• Extended API docs with all custom endpoints

• Fixed changelog automatic creation & added proper version in VersionTag

First release with changelogs

• Added changelogs
• Removed some deprecated fields from database
• Removed dead code from billing
• Billing portal
• Billing batches fixes ( not logged properly etc)
• Small UI/code fixes