PR Custody

feat(security-radar): re-land #752 with consumer-exclusion + cleanup

@KJ-11draftchecks n/achecks…kj/security-radar-reland → main42 files · +2916 −218updated 7h ago

▸Description · 1 noise

Summary

Re-lands the org-scoped Security Radar dashboard (originally #752, reverted in #786) on top of current main, with follow-up fixes folded in. Single squashed commit; the feature itself is unchanged from #752 — all its in-branch Bugbot fixes are preserved.

What's folded in beyond the original #752

Drop the no-op securityProcedure alias — it was literally = orgProcedure and added nothing. All four security procedures now use orgProcedure directly (which already provides org-scoped Prisma + tenant-scoped ClickHouse).
Exclude the consumer (Connect) project from the connected-accounts breakdown — listRecentConnectedAccounts is now scoped to ctx.orgProjectIds (DEVELOPER-only since #780), so zero-activity consumer accounts no longer leak into the table. The ClickHouse aggregation already excluded it via orgProcedure.
Trim scoped-db.ts to a minimal diff — keep the functional connectedAccounts org-scope delegate + ORG_MODELS entry; drop the incidental reformatting the reviewer flagged; restore the doc-comments the original churn deleted.

Why revert-the-revert

A reverted merge can't be cleanly re-merged (git treats the commits as already merged), so this re-lands via git revert of the revert — which 3-way-merges the feature against today's main, handling the ~8 shared files (usage-chart, scoped-db, root.ts, …) automatically. Applied with zero conflicts.

Verification

tsgo typecheck: 0 errors in the changed surface (security-radar / scoped-db / the 4 procedures). The unrelated enhanced-link/connect-announcement errors seen locally are the frontend_docs OpenAPI-preset artifact (internal endpoints omitted) and are present on bare main; CI/Vercel use the full spec.

Still pending (separate follow-ups)

Task B — visual polish (designer-first, on this preview). All medium/high Bugbot findings are already fixed in-branch; only two low-severity cosmetic nits remain ("View logs" hidden when enabled===null; loading skeleton covers the table header).
Branded types (reviewer comment on merge-canonical.ts) — the brands live in platform's private @composiohq/types; needs platform to re-export them from @composiohq/lib and publish, then a dashboard bump + import swap. Separate PR.

🤖 Generated with Claude Code

▸ 1 bot/status comment hidden

@vercel[bot]7h ago

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
dashboard	Ready	Preview, Comment	Jun 13, 2026 1:29am

loading diff…