[Makisuo]

Fixes the dashboard crashes production recorded over the last 30 days (foldkit.crash spans on maple-web) that the code still allows.

Automation settings and /alerts: Expected @maple/AlertDestinationType

#2022 removed the hazel-oauth destination type, but at least one org still had a destination of that type. The dashboard decoded each destination's type strictly, so loading /settings?tab=automation (Nov 1) and /alerts (Oct 31) crashed.

• rowToAlertDestinationDocument now returns an Option. A row of a type this build does not know is left out of the list (rowsToAlertDestinationDocuments) instead of crashing, so retiring a type cannot take these pages down again.
• Migration drop_hazel_oauth_destinations retires the stored rows the way drop_legacy_slack did for slack-bot. It removes the ids from alert rules (and disables a rule left with none, uptime monitors included), from the error notification policy and from issue escalation severities (dropping a severity left with none). It deletes their delivery rows, then the destinations. Malformed jsonb rows are left untouched. Checked against PGlite with mixed, hazel-only, disabled and corrupt fixtures.

Connect popup: SecurityError on a second click

window.open("", name) reuses a popup that is still open. Once that popup is on github.com it is cross-origin, so writing the placeholder page threw (3 times on Oct 21, /sources/new?integration=github). The placeholder write is now best-effort, and the popup is still sent to the new authorize URL.

Already fixed, no change here

• /quick-start setup tabs removeChild: fixed by fix(web): switching the onboarding setup tabs no longer crashes #1800.
• Uptime monitor Schema validation failed: that listTraces path was rewritten.
• Status page builder preview Schema validation failed: unnamed rows are left out since feat(status-pages): one-screen builder, live screen and the page as its own editor #1950 merged.
• Autofill keydown toLowerCase: fixed by fix(web): shortcuts survive the key-less autofill keydown; extension errors stay out of error tracking #1971.

Verification

• packages/web-data alerts tests, including a new test for a hazel-oauth row.
• apps/web settings and alerts tests (179).
• packages/db parity and effect-orm check.
• web-data typecheck is clean. web typecheck shows only errors from an effect-sdk lib that isn't built in this checkout.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 3 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 4 included reviews currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: b14a7d20-5dd5-45c8-a48d-bcf325dac0db

Commits

Reviewing files that changed from the base of the PR and between cbf0594 and e00f6da.

Files selected for processing: 11

• apps/web/src/page/alerts/editor/derive-rows.ts
• apps/web/src/page/alerts/hub/derive.ts
• apps/web/src/page/alerts/hub/update.ts
• apps/web/src/page/alerts/rule/derive.ts
• apps/web/src/page/integrations/subscription.ts
• apps/web/src/page/settings/subscription.ts
• packages/db/drizzle/20261101232654_drop_hazel_oauth_destinations/migration.sql
• packages/db/drizzle/20261101232654_drop_hazel_oauth_destinations/snapshot.json
• packages/db/src/migrations.test.ts
• packages/web-data/src/collections/alerts.test.ts
• packages/web-data/src/collections/alerts.ts

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[maple-review-bot]

2 inline notes from Maple's review. The score and summary are in the review comment above.

[maple-review-bot]

Maple review

🟢 Confidence 8/10 · likely safe to merge. Held at 8 because a fix has not been re-checked against the whole diff yet.
_{no findings · tests covered · risk high −1 · 1 fix not yet re-checked against the whole diff}

The head strips hazel-oauth ids from every thresholds_json tier as well as the rule columns, and pins the whole migration with a PGlite fixture over mixed, hazel-only, untouched and malformed rows. Both earlier findings are addressed; safe to merge.

• Second alert_rules UPDATE removes retired ids from each severity tier's destinationIds, keeping tier order
• migrations.test.ts seeds four rules, two policies and delivery rows and asserts the surviving jsonb

Before merge

• Migration · Check it is safe on production data and with the code still deployed · packages/db/drizzle/20261101232654_drop_hazel_oauth_destinations/migration.sql
• Manual · Confirm no org still needs a hazel-oauth destination: the migration applies in the prd alchemy deploy and deletes those rows with nothing to restore them.

Fixed since the last review

• ✅ F1 · Migration cleans destination_ids_json but leaves the ids in thresholds_json tiers
• ✅ F2 · The new data migration has no PGlite test

_{e00f6da · What was checked, coverage and telemetry details are on the Maple / review check. Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one.}

[maple-review-bot]

Merged with 2 steps from "Before merge" still open. If they are done, tick them on the review comment; if not, now is the time.

• Manual · Confirm no org still needs a hazel-oauth destination: the migration applies in the prd alchemy deploy and deletes those rows with nothing to restore them.
• Migration · Check it is safe on production data and with the code still deployed