feat(connect): replace Intercom with Decimal in For You support

@zen-agentchecks n/achecks…zen/decimal-for-you-support-ssmfqw → main15 files · +212 −176review: @sarahsimionescuupdated 3w ago

GitHub

▸Description· 1 comment · 1 noise

Description

The For You / Connect surface served the customer-support chat from Intercom (Fin), while the Platform / developer dashboard used Decimal. This PR moves For You onto its own Decimal workspace so both consumer and developer surfaces speak to the same support tool — different workspace, same plumbing.

What changed

src/clients/decimal/script.tsx and src/clients/decimal/boot.tsx now accept a surface prop ("platform" | "connect", default "platform"). Each surface reads its own widget ID, public config token, and signs JWTs with its own server-side secret. No behavior change for the existing Platform mounts in (org) and (project) layouts — they continue to call <DecimalScript /> / <DecimalBoot /> with the default surface.
New tRPC procedure decimal.getConnectWidgetToken mirrors the existing getWidgetToken but signs with DECIMAL_CONNECT_JWT_SECRET. Workspaces stay isolated — a leaked Connect secret can't sign Platform tokens and vice versa.
src/app/(connect)/[org]/~/connect/support/layout.tsx now mounts <DecimalScript surface="connect" /><DecimalBoot surface="connect" /> instead of the Intercom provider/boot pair. Scope is unchanged: only the /connect/support route loads the widget.
Dead code removed: src/clients/intercom/, the NEXT_PUBLIC_INTERCOM_APP_ID env var, the react-use-intercom dependency, and the Intercom hosts from the production CSP in next.config.js.

New environment variables (must be set in Doppler before this PR is useful in staging/prod)

Variable	Scope	Purpose
`DECIMAL_CONNECT_JWT_SECRET`	server	HS256 secret for signing Connect user-identity JWTs
`NEXT_PUBLIC_DECIMAL_CONNECT_WIDGET_ID`	client	Connect Decimal workspace widget ID
`NEXT_PUBLIC_DECIMAL_CONNECT_CONFIG_TOKEN`	client	Connect Decimal workspace public config token

Values are intentionally not committed — they live only in Doppler. All three are declared .optional() in src/env.ts, so deploys without them set will simply render no widget on the support page (fail-closed) instead of failing to boot.

Removed environment variable

NEXT_PUBLIC_INTERCOM_APP_ID (was required) is no longer read anywhere in the app and is removed from src/env.ts. Action required: un-set it in Doppler after this PR ships to keep the secret store tidy.

How did I test this PR

pnpm typecheck — clean (tsgo --noEmit exits 0)
pnpm lint on changed files (oxlint src/clients/decimal/ src/server/api/routers/decimal/ src/app/(connect)/[org]/~/connect/support/ src/env.ts) — 0 errors. The 5 errors pnpm lint reports across the repo are pre-existing on main (verified by stashing the branch and re-running).
Confirmed no remaining widget-related Intercom references in src/ (only toolkit-name strings for the Mercury Intercom integration remain — unrelated).
Confirmed Platform Decimal call sites in (org)/[org]/layout.tsx and (project)/[org]/[project]/layout.tsx are unchanged and continue to use the default surface="platform".

No browser E2E / video demo: DecimalScript / DecimalBoot are gated by ENABLED_ENVS = {"staging", "production"} (script.tsx:6, boot.tsx:9), so the widget renders nothing in dev or preview regardless of which env vars are set. Visual verification has to happen on the Vercel preview staging deploy after the three new Connect env vars are set in Doppler — please pull the preview, navigate to /{org}/~/connect/support, and confirm the Decimal launcher appears.

@zen-agent4w ago

Post-PR status update

Build checks (`/build-checks`)

pnpm typecheck — PASS (tsgo --noEmit exit 0)
pnpm lint — fails with 5 errors identical to those on origin/main (verified by stashing this branch and re-running). All in files this PR doesn't touch (create-auth-config-dialog.tsx, manage-auth-config-sheet.tsx, menu-nav.tsx, session-preview-panel.tsx, etc.). Pre-existing — not blocking.
Scoped oxlint src/clients/decimal/ src/server/api/routers/decimal/ src/app/(connect)/[org]/~/connect/support/ src/env.ts — 0 errors.

Codex review (`/codex-review-loop`) — 2 iterations

Iter 1: P2 — "the shared Decimal script URL is deduped by next/script across surfaces, so the second-mounted surface inherits the first's SDK config". Fixed in 934ef075 by replacing next/script with manual DOM script management (useEffect injects/removes the tag, shutdowns + clears window.Decimal when switching surfaces).
Iter 2: "did not find any discrete regression introduced by the diff" — clean.

Cursor Bugbot — 3 issues (against the original commit)

🟡 Decimal widget forced dark in light-themed Connect surface → fixed in 88f084d4 with a surface→colorScheme map.
🟢 Redundant empty type import → fixed in 88f084d4.
🟡 Same script URL causes wrong workspace on cross-surface navigation → already fixed in 934ef075 (same root cause as Codex iter 1).

All three threads replied to with the resolving commit SHAs.

CI status

4/4 green on the latest commit (88f084d4): tsgo typecheck, Block raw db/clickhouse imports, Analyze (javascript-typescript), Analyze (actions). Vercel preview deploy: ✅ Ready (dashboard-git-zen-decimal-for-you-support-ssmfqw.preview.composio.dev).

▸ 1 bot/status comment hidden

@vercel[bot]4w ago

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
dashboard	Ready	Preview, Comment	May 19, 2026 5:56am

loading diff…

@zen-agent4w ago

Post-PR status update

Build checks (`/build-checks`)

pnpm typecheck — PASS (tsgo --noEmit exit 0)
pnpm lint — fails with 5 errors identical to those on origin/main (verified by stashing this branch and re-running). All in files this PR doesn't touch (create-auth-config-dialog.tsx, manage-auth-config-sheet.tsx, menu-nav.tsx, session-preview-panel.tsx, etc.). Pre-existing — not blocking.
Scoped oxlint src/clients/decimal/ src/server/api/routers/decimal/ src/app/(connect)/[org]/~/connect/support/ src/env.ts — 0 errors.

Codex review (`/codex-review-loop`) — 2 iterations

Iter 1: P2 — "the shared Decimal script URL is deduped by next/script across surfaces, so the second-mounted surface inherits the first's SDK config". Fixed in 934ef075 by replacing next/script with manual DOM script management (useEffect injects/removes the tag, shutdowns + clears window.Decimal when switching surfaces).
Iter 2: "did not find any discrete regression introduced by the diff" — clean.

Cursor Bugbot — 3 issues (against the original commit)

🟡 Decimal widget forced dark in light-themed Connect surface → fixed in 88f084d4 with a surface→colorScheme map.
🟢 Redundant empty type import → fixed in 88f084d4.
🟡 Same script URL causes wrong workspace on cross-surface navigation → already fixed in 934ef075 (same root cause as Codex iter 1).

All three threads replied to with the resolving commit SHAs.

feat(connect): replace Intercom with Decimal in For You support

Description

How did I test this PR

Post-PR status update

Build checks (`/build-checks`)

Codex review (`/codex-review-loop`) — 2 iterations

Cursor Bugbot — 3 issues (against the original commit)

CI status

Description

How did I test this PR

Post-PR status update

Build checks (`/build-checks`)

Codex review (`/codex-review-loop`) — 2 iterations

Cursor Bugbot — 3 issues (against the original commit)

CI status

Tests / E2E

Remaining blockers

Description

How did I test this PR

Post-PR status update

Build checks (/build-checks)

Codex review (/codex-review-loop) — 2 iterations

Cursor Bugbot — 3 issues (against the original commit)

CI status

Description

How did I test this PR

Post-PR status update

Build checks (/build-checks)

Codex review (/codex-review-loop) — 2 iterations

Cursor Bugbot — 3 issues (against the original commit)

CI status

Tests / E2E

Remaining blockers

Build checks (`/build-checks`)

Codex review (`/codex-review-loop`) — 2 iterations

Build checks (`/build-checks`)

Codex review (`/codex-review-loop`) — 2 iterations