Add internal endpoint for task status change notifications

[tofikwest]

Summary

• Adds POST /v1/internal/tasks/notify-status-change internal endpoint so enterprise-api can delegate task notification delivery (email + in-app) to the comp API
• Makes changedByUserId optional in TaskNotifierService.notifyStatusChange() — when omitted, uses 'Automation' as the actor name and skips user lookup
• This centralizes all notification infrastructure (Resend + Novu) in the comp API instead of duplicating it in enterprise-api

What changed

• apps/api/src/tasks/internal-task-notification.controller.ts (new) — Internal controller guarded by InternalTokenGuard, accepts { organizationId, taskId, taskTitle, oldStatus, newStatus }
• apps/api/src/tasks/tasks.module.ts — Registered new controller
• apps/api/src/tasks/task-notifier.service.ts — Made changedByUserId optional with conditional DB lookup and 'Automation' fallback name

Depends on / Related

• Companion PR: https://github.com/trycompai/comp-private/pull/169 (enterprise-api side)
• Deploy this first, then merge the comp-private PR

Test plan

• Type check passes (tsc --noEmit)
• Calling POST /v1/internal/tasks/notify-status-change with valid X-Internal-Token sends email + in-app notification
• Calling without token returns 401
• Existing notifyStatusChange() calls with changedByUserId still work unchanged

🤖 Generated with Claude Code

[cursor]

PR Summary

Medium Risk
Adds new internal API surfaces that can trigger outbound email/in-app notifications; mistakes in guarding, recipient selection, or payload values could spam users or leak task metadata, though access is protected by InternalTokenGuard.

Overview
Adds a new internal, InternalTokenGuard-protected controller exposing POST /v1/internal/tasks/notify-status-change and POST /v1/internal/tasks/notify-automation-failures to trigger task notifications without a user actor.

Updates TaskNotifierService.notifyStatusChange to make changedByUserId optional (skipping user lookup and using "Automation" as the actor when absent), and adds notifyAutomationFailures which sends both email (new AutomationFailuresEmail template) and in-app Novu notifications to the task assignee plus org admins/owners, honoring unsubscribe preferences. The OpenAPI spec is updated accordingly and the new controller is wired into TasksModule.

^{Written by Cursor Bugbot for commit 318cb35. This will update automatically on new commits. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
app	Skipped		Feb 19, 2026 4:33am
portal	Skipped		Feb 19, 2026 4:33am

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

[cursor]

Unused changedByName variable is dead code

Low Severity

In notifyAutomationFailures, changedByName is assigned 'Automation' but never referenced anywhere in the method. The email template AutomationFailuresEmail doesn't accept a changedByName prop, and the in-app notification message is constructed without it. This appears to be a leftover from copying the notifyStatusChange pattern where changedByName is actually used in the email template and Novu payload.