dashboard@0.102.0

Minor Changes

• 546c449: Collect a work email on the sign-up page and hand it to the hosted AuthKit
  screen. auth.login takes an optional email; when a login carries a company
  name — the marker that it began on /sign-up — the server sets WorkOS's
  login_hint so the email field arrives pre-filled, and screen_hint=sign-up so
  the user lands on the sign-up screen rather than sign-in. The email is validated
  before the login nonce is minted and is never stored. The call to action now
  reads "Start Trial"; it previously named a single identity provider, which
  misdescribed a hand-off that has always been generic.
• 54755b5: Add a Device Agent configuration tab for organization administrators to choose
  per-tool enforcement layers, release policy, and reconciliation cadence.
• 13301b5: Add a self-serve path into the shared read-only demo organization. A new auth.enterDemo endpoint switches any authenticated session into the demo org (no membership required); request auth, grant resolution, and member/role listings gain demo carve-outs; the demo org always enforces a fixed read-only scope set with a verb-based write guard as backstop. The dashboard gains an /explore-demo entry route, an "explore a live demo org" link on the book-a-demo gate, and a demo banner whose exit switches back to the user's own organization without logging out.
• 909b466: The External Services page is now organization-scoped: org admins register how Gram authenticates into their own cloud account, behind a new customer_managed_encryption_keys entitlement enforced on both externalCredentials and externalKeys. The platform-admin UI is removed, though its endpoints remain for HTTP-only management. Two new methods support verification: externalCredentials.verifyGcpIam probes that Gram can actually impersonate the named service account, and externalCredentials.getGcpSetupInfo reports the Gram service account a customer must grant roles/iam.serviceAccountTokenCreator to.
• f95d50f: Platform admins can now curate the shared remote identity provider catalog from the dashboard, under a new Platform Admin section in the sidebar: list, create, edit, refresh discoverable metadata, and delete the providers that every organization inherits. The listing reports platform-owned and tenant-owned client counts separately, so a delete that will be refused says up front which blockers the admin can clear and which belong to an organization. adminRemoteSessions.listGlobalIssuers and adminRemoteSessions.getGlobalIssuer now return both counts alongside the issuer. Organizations can register a client against an inherited platform provider straight from their own provider list.
• 546c449: Add a /sign-up page that collects the company name before handing off to the
  identity provider. auth.login takes an optional org_name param; when set, the
  server validates it and stashes a signup intent against the login nonce, then
  creates the organization during the auth callback once the identity provider has
  answered. The name never travels through a redirect param or the address bar, and
  a failed signup returns to /sign-up rather than /register. Signup attempts and
  the resulting org creation are captured as onboarding_event / new_org_created
  with created_via: "signup" so the funnel can be measured end to end.
• ca3e972: Show active trial status in the project and organization navigation, including the current trial day, remaining days, elapsed progress, and a link to Sales.

Patch Changes

• 847a496: Adding Figma from the MCP catalog now connects your project directly to Figma's official server instead of routing through a proxy, so there's nothing to authorize or allowlist.
• 0afb752: Import ChatGPT conversations from the OpenAI Compliance Logs Platform. A new chatgpt_compliance AI-integration provider polls workspace-scoped CONVERSATION_MESSAGE log files (the supported successor to the deprecated stateful conversations endpoint) and persists them as external chats and messages — the same tables and Agent Sessions surface the Anthropic compliance import feeds. The provider is separate from codex_compliance because the scopes differ: COSTS files are per API organization while conversation logs are per ChatGPT workspace, so the new config takes a workspace UUID. Includes the workspace-scoped compliance client, Temporal schedule wiring, and a "ChatGPT Conversations" integration card in org settings.
• 7fd5e1a: Classify Codex account identity and billing mode (DNO-734). Codex sessions on
  every capture path (legacy hooks, OTEL logs, ingest adapter) now stamp
  account_type from email resolution — resolved work email is team, anything
  else personal — and team sessions resolve the org-level billing mode declared
  on the codex_compliance integration config (the session provider "openai" now
  maps to that config, fixing the mapping bug that made the config's
  billing_mode unreachable). Compliance COSTS import rows (codex and
  ChatGPT/Work) carry account_type=team and the config's billing mode directly.
  The estimated-cost tooltip copy mentions ChatGPT plans alongside Claude's.
• 49e00bb: Import Codex cloud task transcripts as agent sessions (DNO-752). A new
  codex_cloud_sessions schedule on the chatgpt_compliance integration polls the
  workspace-scoped CODEX_LOG compliance feed and persists cloud web-task
  prompts and responses as external chats + messages under the new codex-web
  chat source, with prompt-derived titles and idempotent replays. Only
  CODEX_WEB client events are imported (desktop-app events are counted and
  skipped pending the unified-app verification), and the feed's per-turn token
  counts are deliberately not persisted — cloud tokens meter through the
  compliance COSTS promotion, so carrying them here would double count.
  Enforcement over cloud runs remains impossible (post-hoc batch feed); this
  provides visibility and post-hoc review only. Also fixes a latent
  multi-schedule reset gap: a key or external-scope change on an integration
  now resets every synced sibling schedule's watermark (previously only the
  provider-named schedule reset, so a workspace/org change could leave a
  sibling feed silently skipping the new scope's history).
• c44a461: Extend spend-gate enforcement to Codex and Cursor at parity with Claude. Over-budget actors are now denied on the legacy provider endpoints (hooks.codex: PreToolUse, PermissionRequest, UserPromptSubmit; hooks.cursor: preToolUse, beforeMCPExecution, beforeSubmitPrompt) and on the unified hooks.ingest path for the codex and cursor adapters (case-insensitive match) — previously the ingest spend gate was Claude-only even though risk scanning already ran adapter-agnostically there. Cursor MCP calls are spend-gated exactly once (at beforeMCPExecution, mirroring the risk-scan dedup), tool-call spend denies mint a durable block page whose link rides the deny reason, idempotent redeliveries keep the deny without minting duplicate block rows, and the block page headline falls back to spend-rule framing instead of rendering an empty policy name. The gate keeps running before any risk-policy evaluation and failing open on infrastructure errors; opencode still passes through pending a product decision on its enforcement surface.
• 230744c: Refresh the Codex setup copy for the unified ChatGPT desktop app (DNO-737).
  The tile referred to a standalone "Codex desktop app" that OpenAI has since
  merged into the ChatGPT app, and now states that Codex mode there is covered
  while Chat and Work modes are not — those are captured through the OpenAI
  Compliance API integration instead. The two OpenAI hook/plugin doc links were
  redirecting and now point at their current destinations.
• 547bb72: Reduce the Skills table to its most useful overview columns and rebalance their widths for easier scanning.
• da7e758: Display enabled warning policies in the Shadow MCP inventory status card.
• f926dc1: Add project-scoped LiteLLM integration provisioning, key rotation, revocation, and lifecycle metadata APIs.
• 20662cc: The project sidebar now keeps nav groups collapsed by default: only the group containing the current page opens automatically, and a new chevron on each group header lets you pin other groups open without navigating. Vertical spacing between and within groups is tighter, so more of the nav fits on screen.
• ff02538: Make the root TypeScript check pass and keep generated SDK warnings out of dashboard linting.
• 817174d: Make RBAC always on, provision built-in roles and grants for new organizations,
  and assign the first organization user the Admin role.
• 9f35728: Make Skills table columns sortable from their headers while preserving recently updated as the default order.
• ba561ad: Webhooks are now available to every organization, marked Beta. The Webhooks page
  no longer shows a preview gate, and delivery is controlled solely by the
  organization's own webhooks toggle.