Deploy to production (Automated) #1826

github-actions · 2025-07-25T17:57:01Z

This is an automated pull request to deploy the staging branch to production.
Please review the pull request and comment /deploy to merge this PR and deploy to production.

Summary by cubic

Added Grafana monitoring by exposing Prometheus metrics for tRPC API calls and ZeroDriver email operations, with a new /metrics endpoint and environment-based configuration.

New Features
- Centralized metrics utility for tracking API and email operation performance.
- tRPC middleware and ZeroDriver methods now record timing and status metrics.
- /metrics endpoint added for Prometheus scraping.
- Environment variables support Grafana integration.

@MrgSub

…ormance (#1816) # feat: add Grafana monitoring for ZeroAgent, ZeroDriver, and tRPC performance ## Summary Implements centralized Grafana monitoring for the Zero server to track performance metrics across tRPC API calls, ZeroDriver operations, and email handling. The implementation uses Prometheus-format metrics that can be scraped by Grafana Cloud for observability and performance analysis. **Key Components:** - **Centralized metrics utility** (`src/lib/metrics.ts`) with Prometheus counters and histograms - **tRPC middleware** for automatic API call timing and success/error tracking - **ZeroDriver instrumentation** for email operations (markAsRead, create) - **Metrics endpoint** (`/metrics`) for Prometheus scraping - **Environment-based configuration** for Grafana Cloud integration **Metrics Tracked:** - `trpc_request_duration_seconds` - API call timing by procedure and status - `trpc_requests_total` - API call counts by procedure and status - `zero_driver_operation_duration_seconds` - Email operation timing - `email_operations_total` - Email operation counts by provider and status - `zero_agent_operation_duration_seconds` - Agent operation timing (framework ready) ## Review & Testing Checklist for Human - [ ] **Test actual metric collection** - Perform real email operations (read, compose, sync) and verify metrics are collected at `/metrics` endpoint - [ ] **Performance verification** - Monitor response times during normal usage to ensure no degradation from monitoring overhead - [ ] **Environment configuration** - Set up `GRAFANA_ENDPOINT`, `GRAFANA_USERNAME`, `GRAFANA_PASSWORD` in staging/production environments - [ ] **Staging deployment test** - Deploy to staging and verify Cloudflare Workers compatibility (removed `collectDefaultMetrics()` due to Node.js API incompatibility) - [ ] **Complete instrumentation** - Consider adding monitoring to remaining ZeroAgent operations and additional ZeroDriver methods as needed --- ### Diagram ```mermaid %%{ init : { "theme" : "default" }}%% graph TD subgraph "Core Server" A["src/main.ts +metrics endpoint"]:::major-edit B["src/trpc/trpc.ts +middleware"]:::major-edit end subgraph "Monitoring Infrastructure" C["src/lib/metrics.ts NEW centralized utility"]:::major-edit D["src/overrides.d.ts +TypeScript types"]:::minor-edit end subgraph "Email Operations" E["src/routes/agent/index.ts +ZeroDriver monitoring"]:::major-edit end subgraph "Configuration" F["wrangler.jsonc +environment vars"]:::minor-edit G["package.json +prom-client"]:::minor-edit end A --> C B --> C E --> C C --> F D --> F subgraph Legend L1[Major Edit]:::major-edit L2[Minor Edit]:::minor-edit L3[Context/No Edit]:::context end classDef major-edit fill:#90EE90 classDef minor-edit fill:#87CEEB classDef context fill:#FFFFFF ``` ### Notes - **Cloudflare Workers Compatibility**: Removed `collectDefaultMetrics()` due to `process.cpuUsage` incompatibility - this is expected and handled - **Async Design**: Metrics collection is non-blocking to minimize performance impact - **Partial Implementation**: Currently instruments key ZeroDriver operations; additional operations can be added incrementally - **Environment Variables**: All Grafana configuration is externalized for security and flexibility **Link to Devin run**: https://app.devin.ai/sessions/f88e66bd577843aba5f0d452d4dfe0e8 **Requested by**: @MrgSub ![Metrics Endpoint Screenshot](file:///home/ubuntu/screenshots/localhost_8787_064620.png)  --- ## Summary by cubic Added Grafana monitoring for ZeroAgent, ZeroDriver, and tRPC performance by exposing Prometheus-format metrics and instrumenting key operations. - **New Features** - Centralized metrics utility for tracking API and email operation performance. - tRPC middleware and ZeroDriver methods now record timing and status metrics. - `/metrics` endpoint added for Prometheus scraping. - Environment variables support Grafana Cloud integration.

jazzberry-ai · 2025-07-25T17:57:04Z

Bug Report

Name	Severity	Example test case	Description
Incorrect file path for metrics.ts	Critical	Check if metrics are being collected by the mail application.	The file `metrics.ts` was created in the wrong directory (`apps/server/src/lib/` instead of `apps/mail/src/lib/`), preventing the mail application from collecting metrics.

_{Comments? Email us. Your free trial ends in 4 days.}

cloudflare-workers-and-pages · 2025-07-25T17:57:06Z

Deploying zero-staging with Cloudflare Pages

Latest commit:	`e7a0463`
Status:	✅ Deploy successful!
Preview URL:	https://05ab43cb.zero-staging-c02.pages.dev

View logs

greptile-apps

Your free trial has ended. If you'd like to continue receiving code reviews, you can add a payment method here.

coderabbitai · 2025-07-25T17:57:08Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

Review comments: Directly reply to a review comment made by CodeRabbit. Example:
- I pushed a fix in commit <commit_id>, please review it.
- Explain this complex logic.
- Open a follow-up GitHub issue for this discussion.
Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
- @coderabbitai explain this code block.
- @coderabbitai modularize this function.
PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
- @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
- @coderabbitai read src/utils.ts and explain its main purpose.
- @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
- @coderabbitai help me debug CodeRabbit configuration file.

Support

Need help? Join our Discord community for assistance with any issues or questions.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

@coderabbitai pause to pause the reviews on a PR.
@coderabbitai resume to resume the paused reviews.
@coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
@coderabbitai full review to do a full review from scratch and review all the files again.
@coderabbitai summary to regenerate the summary of the PR.
@coderabbitai generate sequence diagram to generate a sequence diagram of the changes in this PR.
@coderabbitai resolve resolve all the CodeRabbit review comments.
@coderabbitai configuration to show the current CodeRabbit configuration for the repository.
@coderabbitai help to get help.

Other keywords and placeholders

Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (`.coderabbit.yaml`)

You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
Please see the configuration documentation for more information.
If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

Visit our Documentation for detailed information on how to use CodeRabbit.
Join our Discord Community to get help, request features, and share feedback.
Follow us on X/Twitter for updates and announcements.

cloudflare-workers-and-pages · 2025-07-25T17:57:09Z

Deploying with Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	zero-server-production	`e7a0463`	Jul 25 2025, 08:42 PM

graphite-app · 2025-07-25T18:00:39Z

Graphite Automations

"Deploy to Production Helper" took an action on this PR • (07/25/25)

1 reviewer was added to this PR based on Rahul Mishra's automation.

cloudflare-workers-and-pages · 2025-07-25T18:05:15Z

Deploying zero-prod with Cloudflare Pages

Latest commit:	`5fda69d`
Status:	🚫 Build failed.

View logs

# READ CAREFULLY THEN REMOVE Remove bullet points that are not relevant. PLEASE REFRAIN FROM USING AI TO WRITE YOUR CODE AND PR DESCRIPTION. IF YOU DO USE AI TO WRITE YOUR CODE PLEASE PROVIDE A DESCRIPTION AND REVIEW IT CAREFULLY. MAKE SURE YOU UNDERSTAND THE CODE YOU ARE SUBMITTING USING AI. - Pull requests that do not follow these guidelines will be closed without review or comment. - If you use AI to write your PR description your pr will be close without review or comment. - If you are unsure about anything, feel free to ask for clarification. ## Description Please provide a clear description of your changes. --- ## Type of Change Please delete options that are not relevant. - [ ] 🐛 Bug fix (non-breaking change which fixes an issue) - [ ] ✨ New feature (non-breaking change which adds functionality) - [ ] 💥 Breaking change (fix or feature with breaking changes) - [ ] 📝 Documentation update - [ ] 🎨 UI/UX improvement - [ ] 🔒 Security enhancement - [ ] ⚡ Performance improvement ## Areas Affected Please check all that apply: - [ ] Email Integration (Gmail, IMAP, etc.) - [ ] User Interface/Experience - [ ] Authentication/Authorization - [ ] Data Storage/Management - [ ] API Endpoints - [ ] Documentation - [ ] Testing Infrastructure - [ ] Development Workflow - [ ] Deployment/Infrastructure ## Testing Done Describe the tests you've done: - [ ] Unit tests added/updated - [ ] Integration tests added/updated - [ ] Manual testing performed - [ ] Cross-browser testing (if UI changes) - [ ] Mobile responsiveness verified (if UI changes) ## Security Considerations For changes involving data or authentication: - [ ] No sensitive data is exposed - [ ] Authentication checks are in place - [ ] Input validation is implemented - [ ] Rate limiting is considered (if applicable) ## Checklist - [ ] I have read the [CONTRIBUTING](https://github.com/Mail-0/Zero/blob/staging/.github/CONTRIBUTING.md) document - [ ] My code follows the project's style guidelines - [ ] I have performed a self-review of my code - [ ] I have commented my code, particularly in complex areas - [ ] I have updated the documentation - [ ] My changes generate no new warnings - [ ] I have added tests that prove my fix/feature works - [ ] All tests pass locally - [ ] Any dependent changes are merged and published ## Additional Notes Add any other context about the pull request here. ## Screenshots/Recordings Add screenshots or recordings here if applicable. --- _By submitting this pull request, I confirm that my contribution is made under the terms of the project's license._  --- ## Summary by cubic Added a patch for the novel dependency to pnpm-lock.yaml to apply custom fixes during installation.

jazzberry-ai · 2025-07-25T18:12:39Z

An error occured.

_{This error may be due to rate limits. If this error persists, please email us.}

…1828) # READ CAREFULLY THEN REMOVE Remove bullet points that are not relevant. PLEASE REFRAIN FROM USING AI TO WRITE YOUR CODE AND PR DESCRIPTION. IF YOU DO USE AI TO WRITE YOUR CODE PLEASE PROVIDE A DESCRIPTION AND REVIEW IT CAREFULLY. MAKE SURE YOU UNDERSTAND THE CODE YOU ARE SUBMITTING USING AI. - Pull requests that do not follow these guidelines will be closed without review or comment. - If you use AI to write your PR description your pr will be close without review or comment. - If you are unsure about anything, feel free to ask for clarification. ## Description Please provide a clear description of your changes. --- ## Type of Change Please delete options that are not relevant. - [ ] 🐛 Bug fix (non-breaking change which fixes an issue) - [ ] ✨ New feature (non-breaking change which adds functionality) - [ ] 💥 Breaking change (fix or feature with breaking changes) - [ ] 📝 Documentation update - [ ] 🎨 UI/UX improvement - [ ] 🔒 Security enhancement - [ ] ⚡ Performance improvement ## Areas Affected Please check all that apply: - [ ] Email Integration (Gmail, IMAP, etc.) - [ ] User Interface/Experience - [ ] Authentication/Authorization - [ ] Data Storage/Management - [ ] API Endpoints - [ ] Documentation - [ ] Testing Infrastructure - [ ] Development Workflow - [ ] Deployment/Infrastructure ## Testing Done Describe the tests you've done: - [ ] Unit tests added/updated - [ ] Integration tests added/updated - [ ] Manual testing performed - [ ] Cross-browser testing (if UI changes) - [ ] Mobile responsiveness verified (if UI changes) ## Security Considerations For changes involving data or authentication: - [ ] No sensitive data is exposed - [ ] Authentication checks are in place - [ ] Input validation is implemented - [ ] Rate limiting is considered (if applicable) ## Checklist - [ ] I have read the [CONTRIBUTING](https://github.com/Mail-0/Zero/blob/staging/.github/CONTRIBUTING.md) document - [ ] My code follows the project's style guidelines - [ ] I have performed a self-review of my code - [ ] I have commented my code, particularly in complex areas - [ ] I have updated the documentation - [ ] My changes generate no new warnings - [ ] I have added tests that prove my fix/feature works - [ ] All tests pass locally - [ ] Any dependent changes are merged and published ## Additional Notes Add any other context about the pull request here. ## Screenshots/Recordings Add screenshots or recordings here if applicable. --- _By submitting this pull request, I confirm that my contribution is made under the terms of the project's license._  --- ## Summary by cubic Fixed the order of CSS classes in the privacy policy page and removed the line about storing Google account credentials.

jazzberry-ai · 2025-07-25T18:14:10Z

Bug Report

Name	Severity	Example test case	Description
Invalid Grafana Credentials	Medium	Set GRAFANA_USERNAME or GRAFANA_PASSWORD to an empty string in the environment.	The MetricsCollector does not validate that GRAFANA_USERNAME and GRAFANA_PASSWORD are set, which leads to btoa() being called with potentially empty strings, leading to invalid authorization headers being sent to Grafana. Added a check to ensure the variables are set.
Incorrect Email Operation Total	Medium	Call ZeroDriver's markAsRead or create methods and cause them to throw an error.	The emailOperationTotal counter is incremented within the try block of the ZeroDriver's markAsRead and create methods. If an error occurs during the operation, the counter is not incremented. Moved the counter increment to the finally block, and made the status (success/failure) a parameter to timeOperation.

_{Comments? Email us. Your free trial ends in 4 days.}

cursor

Bugbot free trial expires on July 29, 2025
Learn more in the Cursor dashboard.

apps/server/src/routes/agent/index.ts

apps/server/src/lib/metrics.ts

# READ CAREFULLY THEN REMOVE Remove bullet points that are not relevant. PLEASE REFRAIN FROM USING AI TO WRITE YOUR CODE AND PR DESCRIPTION. IF YOU DO USE AI TO WRITE YOUR CODE PLEASE PROVIDE A DESCRIPTION AND REVIEW IT CAREFULLY. MAKE SURE YOU UNDERSTAND THE CODE YOU ARE SUBMITTING USING AI. - Pull requests that do not follow these guidelines will be closed without review or comment. - If you use AI to write your PR description your pr will be close without review or comment. - If you are unsure about anything, feel free to ask for clarification. ## Description Please provide a clear description of your changes. --- ## Type of Change Please delete options that are not relevant. - [ ] 🐛 Bug fix (non-breaking change which fixes an issue) - [ ] ✨ New feature (non-breaking change which adds functionality) - [ ] 💥 Breaking change (fix or feature with breaking changes) - [ ] 📝 Documentation update - [ ] 🎨 UI/UX improvement - [ ] 🔒 Security enhancement - [ ] ⚡ Performance improvement ## Areas Affected Please check all that apply: - [ ] Email Integration (Gmail, IMAP, etc.) - [ ] User Interface/Experience - [ ] Authentication/Authorization - [ ] Data Storage/Management - [ ] API Endpoints - [ ] Documentation - [ ] Testing Infrastructure - [ ] Development Workflow - [ ] Deployment/Infrastructure ## Testing Done Describe the tests you've done: - [ ] Unit tests added/updated - [ ] Integration tests added/updated - [ ] Manual testing performed - [ ] Cross-browser testing (if UI changes) - [ ] Mobile responsiveness verified (if UI changes) ## Security Considerations For changes involving data or authentication: - [ ] No sensitive data is exposed - [ ] Authentication checks are in place - [ ] Input validation is implemented - [ ] Rate limiting is considered (if applicable) ## Checklist - [ ] I have read the [CONTRIBUTING](https://github.com/Mail-0/Zero/blob/staging/.github/CONTRIBUTING.md) document - [ ] My code follows the project's style guidelines - [ ] I have performed a self-review of my code - [ ] I have commented my code, particularly in complex areas - [ ] I have updated the documentation - [ ] My changes generate no new warnings - [ ] I have added tests that prove my fix/feature works - [ ] All tests pass locally - [ ] Any dependent changes are merged and published ## Additional Notes Add any other context about the pull request here. ## Screenshots/Recordings Add screenshots or recordings here if applicable. --- _By submitting this pull request, I confirm that my contribution is made under the terms of the project's license._  --- ## Summary by cubic Removed unused Grafana environment variables from wrangler.jsonc to clean up configuration.

jazzberry-ai · 2025-07-25T18:22:15Z

Bug Report

Name	Severity	Example test case	Description
Missing Grafana Error Handling	Medium	Simulate a Grafana endpoint outage. Verify that the application logs the error, but metrics are lost.	The `sendToGrafana` function in `src/lib/metrics.ts` lacks proper error handling for the `fetch` call. This can lead to loss of metrics data if the Grafana endpoint is unavailable. Retries with exponential backoff should be implemented.
Storing Refresh Tokens in DB	Critical	Compromise the database. Verify the refresh tokens can be used to access email accounts.	Storing refresh tokens in the database represents a significant security risk. If the database is compromised, attackers could use the refresh tokens to gain persistent access to user email accounts. The application needs to use a more secure method of storing credentials, such as encryption, token revocation, or secrets management.

_{Comments? Email us. Your free trial ends in 4 days.}

# READ CAREFULLY THEN REMOVE Remove bullet points that are not relevant. PLEASE REFRAIN FROM USING AI TO WRITE YOUR CODE AND PR DESCRIPTION. IF YOU DO USE AI TO WRITE YOUR CODE PLEASE PROVIDE A DESCRIPTION AND REVIEW IT CAREFULLY. MAKE SURE YOU UNDERSTAND THE CODE YOU ARE SUBMITTING USING AI. - Pull requests that do not follow these guidelines will be closed without review or comment. - If you use AI to write your PR description your pr will be close without review or comment. - If you are unsure about anything, feel free to ask for clarification. ## Description Please provide a clear description of your changes. --- ## Type of Change Please delete options that are not relevant. - [ ] 🐛 Bug fix (non-breaking change which fixes an issue) - [ ] ✨ New feature (non-breaking change which adds functionality) - [ ] 💥 Breaking change (fix or feature with breaking changes) - [ ] 📝 Documentation update - [ ] 🎨 UI/UX improvement - [ ] 🔒 Security enhancement - [ ] ⚡ Performance improvement ## Areas Affected Please check all that apply: - [ ] Email Integration (Gmail, IMAP, etc.) - [ ] User Interface/Experience - [ ] Authentication/Authorization - [ ] Data Storage/Management - [ ] API Endpoints - [ ] Documentation - [ ] Testing Infrastructure - [ ] Development Workflow - [ ] Deployment/Infrastructure ## Testing Done Describe the tests you've done: - [ ] Unit tests added/updated - [ ] Integration tests added/updated - [ ] Manual testing performed - [ ] Cross-browser testing (if UI changes) - [ ] Mobile responsiveness verified (if UI changes) ## Security Considerations For changes involving data or authentication: - [ ] No sensitive data is exposed - [ ] Authentication checks are in place - [ ] Input validation is implemented - [ ] Rate limiting is considered (if applicable) ## Checklist - [ ] I have read the [CONTRIBUTING](https://github.com/Mail-0/Zero/blob/staging/.github/CONTRIBUTING.md) document - [ ] My code follows the project's style guidelines - [ ] I have performed a self-review of my code - [ ] I have commented my code, particularly in complex areas - [ ] I have updated the documentation - [ ] My changes generate no new warnings - [ ] I have added tests that prove my fix/feature works - [ ] All tests pass locally - [ ] Any dependent changes are merged and published ## Additional Notes Add any other context about the pull request here. ## Screenshots/Recordings Add screenshots or recordings here if applicable. --- _By submitting this pull request, I confirm that my contribution is made under the terms of the project's license._  --- ## Summary by cubic Removed the MetricsCollector class and added authentication to the /metrics endpoint to restrict access. - **Security** - The /metrics endpoint now requires a valid Authorization header with the Grafana password.

jazzberry-ai · 2025-07-25T19:44:59Z

Bug Report

Name	Severity	Example test case	Description
Metrics are not sent to Grafana	High	Check Grafana dashboard; no new metrics are visible.	The `MetricsCollector` class was removed, which was responsible for collecting and sending metrics to Grafana.

_{Comments? Email us. Your free trial ends in 4 days.}

# READ CAREFULLY THEN REMOVE Remove bullet points that are not relevant. PLEASE REFRAIN FROM USING AI TO WRITE YOUR CODE AND PR DESCRIPTION. IF YOU DO USE AI TO WRITE YOUR CODE PLEASE PROVIDE A DESCRIPTION AND REVIEW IT CAREFULLY. MAKE SURE YOU UNDERSTAND THE CODE YOU ARE SUBMITTING USING AI. - Pull requests that do not follow these guidelines will be closed without review or comment. - If you use AI to write your PR description your pr will be close without review or comment. - If you are unsure about anything, feel free to ask for clarification. ## Description Please provide a clear description of your changes. --- ## Type of Change Please delete options that are not relevant. - [ ] 🐛 Bug fix (non-breaking change which fixes an issue) - [ ] ✨ New feature (non-breaking change which adds functionality) - [ ] 💥 Breaking change (fix or feature with breaking changes) - [ ] 📝 Documentation update - [ ] 🎨 UI/UX improvement - [ ] 🔒 Security enhancement - [ ] ⚡ Performance improvement ## Areas Affected Please check all that apply: - [ ] Email Integration (Gmail, IMAP, etc.) - [ ] User Interface/Experience - [ ] Authentication/Authorization - [ ] Data Storage/Management - [ ] API Endpoints - [ ] Documentation - [ ] Testing Infrastructure - [ ] Development Workflow - [ ] Deployment/Infrastructure ## Testing Done Describe the tests you've done: - [ ] Unit tests added/updated - [ ] Integration tests added/updated - [ ] Manual testing performed - [ ] Cross-browser testing (if UI changes) - [ ] Mobile responsiveness verified (if UI changes) ## Security Considerations For changes involving data or authentication: - [ ] No sensitive data is exposed - [ ] Authentication checks are in place - [ ] Input validation is implemented - [ ] Rate limiting is considered (if applicable) ## Checklist - [ ] I have read the [CONTRIBUTING](https://github.com/Mail-0/Zero/blob/staging/.github/CONTRIBUTING.md) document - [ ] My code follows the project's style guidelines - [ ] I have performed a self-review of my code - [ ] I have commented my code, particularly in complex areas - [ ] I have updated the documentation - [ ] My changes generate no new warnings - [ ] I have added tests that prove my fix/feature works - [ ] All tests pass locally - [ ] Any dependent changes are merged and published ## Additional Notes Add any other context about the pull request here. ## Screenshots/Recordings Add screenshots or recordings here if applicable. --- _By submitting this pull request, I confirm that my contribution is made under the terms of the project's license._  --- ## Summary by cubic Removed all Prometheus metrics code and related configuration from the server to simplify the codebase. - **Refactors** - Deleted metrics library and middleware. - Removed metrics usage from agent routes and tRPC procedures. - Cleaned up unused Grafana environment variables.

jazzberry-ai · 2025-07-25T20:18:41Z

An error occured.

_{This error may be due to rate limits. If this error persists, please email us.}

cursor

Bug: Driver Null Check Inconsistency

The null check for this.driver was removed from the create method, making it inconsistent with other methods in the class (e.g., sendDraft, delete). This omission causes a runtime error (e.g., TypeError) if create is called when this.driver is null/undefined, instead of providing the expected "No driver available" error.

apps/server/src/routes/agent/index.ts#L122-L125

Zero/apps/server/src/routes/agent/index.ts

Lines 122 to 125 in a5d8f5a

    
           async create(data: IOutgoingMessage) { 
        
             return await this.driver.create(data); 
        
           }

Fix in Cursor • Fix in Web

## Description Added 'style' tag to the list of allowed HTML tags in the email sanitization configuration. This change enables the preservation of inline CSS styles when processing email HTML content, which is important for maintaining the original formatting and appearance of emails.  ## Summary by CodeRabbit * **New Features** * Enhanced email content display by allowing inline styles in emails. * Improved security by sanitizing CSS within email styles to allow only safe properties and block harmful rules.

jazzberry-ai · 2025-07-25T20:21:31Z

Bug Report

Name	Severity	Example test case	Description
Incomplete CSS Sanitization	Medium	Send an email with `font-family`, `width`, `border-radius`, or `@media` rules.	The `allowedProperties` in `css-sanitizer` is incomplete, leading to stripping of CSS styles and degradation of email appearance.
Insufficient Protection of `/metrics` Endpoint	High	Leak the `GRAFANA_PASSWORD` through logs or misconfiguration.	The `/metrics` endpoint is protected only by a bearer token, which is vulnerable to leakage and unauthorized access.

_{Comments? Email us. Your free trial ends in 4 days.}

# READ CAREFULLY THEN REMOVE Remove bullet points that are not relevant. PLEASE REFRAIN FROM USING AI TO WRITE YOUR CODE AND PR DESCRIPTION. IF YOU DO USE AI TO WRITE YOUR CODE PLEASE PROVIDE A DESCRIPTION AND REVIEW IT CAREFULLY. MAKE SURE YOU UNDERSTAND THE CODE YOU ARE SUBMITTING USING AI. - Pull requests that do not follow these guidelines will be closed without review or comment. - If you use AI to write your PR description your pr will be close without review or comment. - If you are unsure about anything, feel free to ask for clarification. ## Description Please provide a clear description of your changes. --- ## Type of Change Please delete options that are not relevant. - [ ] 🐛 Bug fix (non-breaking change which fixes an issue) - [ ] ✨ New feature (non-breaking change which adds functionality) - [ ] 💥 Breaking change (fix or feature with breaking changes) - [ ] 📝 Documentation update - [ ] 🎨 UI/UX improvement - [ ] 🔒 Security enhancement - [ ] ⚡ Performance improvement ## Areas Affected Please check all that apply: - [ ] Email Integration (Gmail, IMAP, etc.) - [ ] User Interface/Experience - [ ] Authentication/Authorization - [ ] Data Storage/Management - [ ] API Endpoints - [ ] Documentation - [ ] Testing Infrastructure - [ ] Development Workflow - [ ] Deployment/Infrastructure ## Testing Done Describe the tests you've done: - [ ] Unit tests added/updated - [ ] Integration tests added/updated - [ ] Manual testing performed - [ ] Cross-browser testing (if UI changes) - [ ] Mobile responsiveness verified (if UI changes) ## Security Considerations For changes involving data or authentication: - [ ] No sensitive data is exposed - [ ] Authentication checks are in place - [ ] Input validation is implemented - [ ] Rate limiting is considered (if applicable) ## Checklist - [ ] I have read the [CONTRIBUTING](https://github.com/Mail-0/Zero/blob/staging/.github/CONTRIBUTING.md) document - [ ] My code follows the project's style guidelines - [ ] I have performed a self-review of my code - [ ] I have commented my code, particularly in complex areas - [ ] I have updated the documentation - [ ] My changes generate no new warnings - [ ] I have added tests that prove my fix/feature works - [ ] All tests pass locally - [ ] Any dependent changes are merged and published ## Additional Notes Add any other context about the pull request here. ## Screenshots/Recordings Add screenshots or recordings here if applicable. --- _By submitting this pull request, I confirm that my contribution is made under the terms of the project's license._  --- ## Summary by cubic Removed all Prometheus metrics and Grafana integration from the server codebase. - **Dependencies** - Removed prom-client and related packages from dependencies and lockfile.

jazzberry-ai · 2025-07-25T20:29:32Z

Bug Report

Name	Severity	Example test case	Description
Potential CSS Sanitizer Bypass	Medium	Inject CSS with `content` property or complex `animation` syntax.	The `@barkleapp/css-sanitizer` might be vulnerable to bypasses, allowing malicious CSS to be injected into emails. The current configuration might not be sufficient to prevent all potential attacks. Additionally, the use of `@ts-ignore` suggests a potential underlying type issue that should be properly resolved.

_{Comments? Email us. Your free trial ends in 4 days.}

cursor

Bug: Inconsistent Null Handling Across Methods

The null check for this.driver was removed from the create method, making it inconsistent with other methods in the same class (e.g., sendDraft, delete) that retain this check. If this.driver is null, this will cause a runtime error (e.g., TypeError) when attempting to call this.driver.create(data), instead of throwing the explicit "No driver available" error.

apps/server/src/routes/agent/index.ts#L122-L125

Zero/apps/server/src/routes/agent/index.ts

Lines 122 to 125 in 7aa0caa

    
           async create(data: IOutgoingMessage) { 
        
             return await this.driver.create(data); 
        
           }

Fix in Cursor • Fix in Web

# READ CAREFULLY THEN REMOVE Remove bullet points that are not relevant. PLEASE REFRAIN FROM USING AI TO WRITE YOUR CODE AND PR DESCRIPTION. IF YOU DO USE AI TO WRITE YOUR CODE PLEASE PROVIDE A DESCRIPTION AND REVIEW IT CAREFULLY. MAKE SURE YOU UNDERSTAND THE CODE YOU ARE SUBMITTING USING AI. - Pull requests that do not follow these guidelines will be closed without review or comment. - If you use AI to write your PR description your pr will be close without review or comment. - If you are unsure about anything, feel free to ask for clarification. ## Description Please provide a clear description of your changes. --- ## Type of Change Please delete options that are not relevant. - [ ] 🐛 Bug fix (non-breaking change which fixes an issue) - [ ] ✨ New feature (non-breaking change which adds functionality) - [ ] 💥 Breaking change (fix or feature with breaking changes) - [ ] 📝 Documentation update - [ ] 🎨 UI/UX improvement - [ ] 🔒 Security enhancement - [ ] ⚡ Performance improvement ## Areas Affected Please check all that apply: - [ ] Email Integration (Gmail, IMAP, etc.) - [ ] User Interface/Experience - [ ] Authentication/Authorization - [ ] Data Storage/Management - [ ] API Endpoints - [ ] Documentation - [ ] Testing Infrastructure - [ ] Development Workflow - [ ] Deployment/Infrastructure ## Testing Done Describe the tests you've done: - [ ] Unit tests added/updated - [ ] Integration tests added/updated - [ ] Manual testing performed - [ ] Cross-browser testing (if UI changes) - [ ] Mobile responsiveness verified (if UI changes) ## Security Considerations For changes involving data or authentication: - [ ] No sensitive data is exposed - [ ] Authentication checks are in place - [ ] Input validation is implemented - [ ] Rate limiting is considered (if applicable) ## Checklist - [ ] I have read the [CONTRIBUTING](https://github.com/Mail-0/Zero/blob/staging/.github/CONTRIBUTING.md) document - [ ] My code follows the project's style guidelines - [ ] I have performed a self-review of my code - [ ] I have commented my code, particularly in complex areas - [ ] I have updated the documentation - [ ] My changes generate no new warnings - [ ] I have added tests that prove my fix/feature works - [ ] All tests pass locally - [ ] Any dependent changes are merged and published ## Additional Notes Add any other context about the pull request here. ## Screenshots/Recordings Add screenshots or recordings here if applicable. --- _By submitting this pull request, I confirm that my contribution is made under the terms of the project's license._  --- ## Summary by cubic Removed an unused import of prom-client from main.ts to clean up the code.

jazzberry-ai · 2025-07-25T20:32:38Z

Bug Report

Name: Missing CSS properties in sanitization

Severity: Medium

Example test case: Emails using font-family will not render correctly, as font-family is not in the allowedProperties list.

Description: The CSS sanitization logic in apps/server/src/lib/email-processor.ts might be too restrictive, preventing legitimate CSS properties like font-family from being used, leading to incorrect email rendering.

_{Comments? Email us. Your free trial ends in 4 days.}

cursor

Bug: Inconsistent Driver Null Handling

The null check for this.driver was removed from the create method. This creates an inconsistency, as other methods in the ZeroDriver class (e.g., sendDraft, delete) retain this safety check. If this.driver is null, calling create will now throw a generic TypeError (e.g., "Cannot read property 'create' of null") instead of the descriptive "No driver available" error, making debugging more difficult and breaking consistent error handling.

apps/server/src/routes/agent/index.ts#L122-L126

Zero/apps/server/src/routes/agent/index.ts

Lines 122 to 126 in 39d8727

    
           async create(data: IOutgoingMessage) { 
        
             return await this.driver.create(data); 
        
           }

Fix in Cursor • Fix in Web

# READ CAREFULLY THEN REMOVE Remove bullet points that are not relevant. PLEASE REFRAIN FROM USING AI TO WRITE YOUR CODE AND PR DESCRIPTION. IF YOU DO USE AI TO WRITE YOUR CODE PLEASE PROVIDE A DESCRIPTION AND REVIEW IT CAREFULLY. MAKE SURE YOU UNDERSTAND THE CODE YOU ARE SUBMITTING USING AI. - Pull requests that do not follow these guidelines will be closed without review or comment. - If you use AI to write your PR description your pr will be close without review or comment. - If you are unsure about anything, feel free to ask for clarification. ## Description Please provide a clear description of your changes. --- ## Type of Change Please delete options that are not relevant. - [ ] 🐛 Bug fix (non-breaking change which fixes an issue) - [ ] ✨ New feature (non-breaking change which adds functionality) - [ ] 💥 Breaking change (fix or feature with breaking changes) - [ ] 📝 Documentation update - [ ] 🎨 UI/UX improvement - [ ] 🔒 Security enhancement - [ ] ⚡ Performance improvement ## Areas Affected Please check all that apply: - [ ] Email Integration (Gmail, IMAP, etc.) - [ ] User Interface/Experience - [ ] Authentication/Authorization - [ ] Data Storage/Management - [ ] API Endpoints - [ ] Documentation - [ ] Testing Infrastructure - [ ] Development Workflow - [ ] Deployment/Infrastructure ## Testing Done Describe the tests you've done: - [ ] Unit tests added/updated - [ ] Integration tests added/updated - [ ] Manual testing performed - [ ] Cross-browser testing (if UI changes) - [ ] Mobile responsiveness verified (if UI changes) ## Security Considerations For changes involving data or authentication: - [ ] No sensitive data is exposed - [ ] Authentication checks are in place - [ ] Input validation is implemented - [ ] Rate limiting is considered (if applicable) ## Checklist - [ ] I have read the [CONTRIBUTING](https://github.com/Mail-0/Zero/blob/staging/.github/CONTRIBUTING.md) document - [ ] My code follows the project's style guidelines - [ ] I have performed a self-review of my code - [ ] I have commented my code, particularly in complex areas - [ ] I have updated the documentation - [ ] My changes generate no new warnings - [ ] I have added tests that prove my fix/feature works - [ ] All tests pass locally - [ ] Any dependent changes are merged and published ## Additional Notes Add any other context about the pull request here. ## Screenshots/Recordings Add screenshots or recordings here if applicable. --- _By submitting this pull request, I confirm that my contribution is made under the terms of the project's license._  --- ## Summary by cubic Added a check in ZeroDriver's create method to throw an error if no driver is available, preventing calls without a valid driver.

jazzberry-ai · 2025-07-25T20:37:03Z

Bug Report

Name	Severity	Example test case	Description
CSS Sanitization Bypass via `border` Property	Medium	`<style>.test { border: 100px solid red !important; }</style>`	The allowed `border` property in the CSS sanitizer can be abused to create unexpected layout effects or visual distortions, especially when combined with `!important`. The limited number of other allowed CSS properties makes this more impactful.

_{Comments? Email us. Your free trial ends in 4 days.}

MrgSub · 2025-07-25T20:40:14Z

/deploy

github-actions bot added the production-deploy This PR is meant to update production label Jul 25, 2025

greptile-apps bot reviewed Jul 25, 2025

View reviewed changes

graphite-app bot requested a review from MrgSub July 25, 2025 17:57

cursor bot reviewed Jul 25, 2025

View reviewed changes

apps/server/src/routes/agent/index.ts Outdated Show resolved Hide resolved

apps/server/src/lib/metrics.ts Outdated Show resolved Hide resolved

cursor bot reviewed Jul 25, 2025

View reviewed changes

MrgSub approved these changes Jul 25, 2025

View reviewed changes

github-actions bot merged commit e7a0463 into main Jul 25, 2025
15 checks passed


	async create(data: IOutgoingMessage) {
	return await this.driver.create(data);
	}

Uh oh!

Deploy to production (Automated) #1826

Deploy to production (Automated) #1826

Uh oh!

Conversation

github-actions bot commented Jul 25, 2025 • edited by cubic-dev-ai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by cubic

Uh oh!

jazzberry-ai bot commented Jul 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Bug Report

Uh oh!

cloudflare-workers-and-pages bot commented Jul 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying zero-staging with Cloudflare Pages

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai bot commented Jul 25, 2025

Review skipped

Chat

Support

CodeRabbit Commands (Invoked using PR comments)

Other keywords and placeholders

CodeRabbit Configuration File (.coderabbit.yaml)

Documentation and Community

Uh oh!

cloudflare-workers-and-pages bot commented Jul 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying with Cloudflare Workers

Uh oh!

graphite-app bot commented Jul 25, 2025

Graphite Automations

Uh oh!

cloudflare-workers-and-pages bot commented Jul 25, 2025

Deploying zero-prod with Cloudflare Pages

Uh oh!

jazzberry-ai bot commented Jul 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jazzberry-ai bot commented Jul 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Bug Report

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

jazzberry-ai bot commented Jul 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Bug Report

Uh oh!

jazzberry-ai bot commented Jul 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Bug Report

Uh oh!

jazzberry-ai bot commented Jul 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Bug: Driver Null Check Inconsistency

Uh oh!

jazzberry-ai bot commented Jul 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Bug Report

Uh oh!

jazzberry-ai bot commented Jul 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Bug Report

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Bug: Inconsistent Null Handling Across Methods

Uh oh!

jazzberry-ai bot commented Jul 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

github-actions bot commented Jul 25, 2025 •

edited by cubic-dev-ai bot

Loading

jazzberry-ai bot commented Jul 25, 2025 •

edited

Loading

cloudflare-workers-and-pages bot commented Jul 25, 2025 •

edited

Loading

CodeRabbit Configuration File (`.coderabbit.yaml`)

cloudflare-workers-and-pages bot commented Jul 25, 2025 •

edited

Loading

jazzberry-ai bot commented Jul 25, 2025 •

edited

Loading

jazzberry-ai bot commented Jul 25, 2025 •

edited

Loading

jazzberry-ai bot commented Jul 25, 2025 •

edited

Loading

jazzberry-ai bot commented Jul 25, 2025 •

edited

Loading

jazzberry-ai bot commented Jul 25, 2025 •

edited

Loading

jazzberry-ai bot commented Jul 25, 2025 •

edited

Loading

jazzberry-ai bot commented Jul 25, 2025 •

edited

Loading

jazzberry-ai bot commented Jul 25, 2025 •

edited

Loading

jazzberry-ai bot commented Jul 25, 2025 •

edited

Loading