* chore(ci): guard bedrock-sdk against automated version bumps
The 2026-07 prod outage (empty Bedrock streams breaking invoice OCR and
the assistant) came from an unreviewed @anthropic-ai/bedrock-sdk 0.32.0
bump. The package is exact-pinned to 0.29.1, but nothing stopped an
automated PR from proposing the bump again. Add a dependabot config in
security-updates-only posture (open-pull-requests-limit: 0) with an
ignore for bedrock-sdk >=0.30.0 so neither scheduled nor security
updates can reintroduce it silently.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(enable-banking): stop renewal history floods (gap-fill default + backfill reconciliation)
Renewing a bank connection walks the same pending_selection -> active
flow as a first connect, and a fresh consent often makes the bank
release history the first connect never delivered. Two gaps turned that
into a flood of falsely 'unhandled' rows over already-bookkept periods
(11 companies, ~600 rows in prod):
- The picker defaulted every renewal to the fiscal-year lookback. It now
probes the connection's newest imported transaction and defaults a
renewal to 'continue where the last fetch stopped' (7-day overlap,
absorbed by external_id dedup), with an .attn warning when a longer
lookback re-requests already-fetched periods.
- The inline initial backfill ran without the SIE-overlap guard that the
manual /sync route and the cron both apply. It now suppresses
auto-categorization on overlap and runs the same unattended-threshold
reconciliation sweep, scoped per ledger account via
resolveCashAccountScope instead of the pooled unscoped form
(#1290/#1298), and surfaces the linked count as auto_matched in the
sync summary.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(enable-banking): renewal guard survives mid-open refetch; harden sweep scope and window
Skeptic pass findings on the renewal-flood guard:
- REFUTED: the settings panel's visibility refetch (near-certain in a
BankID reconnect) hands the open picker a fresh accounts identity; the
pre-existing reset effect then wiped the gap-fill state while the
probe effect never re-ran, silently stranding the renewal back on the
fiscal-year default with no warning. The probe now keys its state by
connectionId and shares the reset's triggers via an accounts dep, so
wipe and re-probe always pair up.
- The sweep skips accounts whose cash_accounts row did not resolve
(found: false) instead of degrading to the pooled currency-only form
(#1290 write shape), which could otherwise follow a same-request
mirror-upsert failure.
- The sweep window opens at the oldest booking date the bank actually
returned: over-returning ASPSPs ingest rows outside the requested
window, which the sweep would otherwise never examine.
- resolveGapFillStart clamps to the backend's 365-day lookback floor so
the radio never promises a start date the backfill cannot honor.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(enable-banking): address PR #1590 review findings
- zizmor: add a 7-day cooldown to the dependabot npm entry.
- CodeRabbit: clear the event bus in the accounts-route beforeEach (repo
test convention); surface probe query failures in AccountPickerDialog
so a failed probe cannot read as a first connect and silently restore
the fiscal-year default; build the sweep's ledger-account list with a
string filter instead of a nullish fallback so the pooled scope path
is structurally unreachable.
- Swedish compliance review: document at the sweep site that linking
writes bank-feed metadata only, never journal tables, with the
opening-balance link trigger and unlinkReconciliation reversibility
spelled out.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Mattsson
a47ba9fede