🧠 מוניטור

סיכום: ירין ז׳אנו הוא לקוח המנהל מרכזיה עם מערכת לניהול תקשורת עם לקוחות. לאחרונה, הוקמה אפליקציה חדשה בוואטסאפ בעקבות דרישות ייחודיות שלו. המערכת כיום פועלת באופן תקין, כולל שיחות מוקלטות, ניהול פגישות והודעות אוטומטיות. הוספה של 'משפך תזונה AI' מביאה לשיפור בניהול הלידים, וכעת ישנה התראה יומית על לקוחות שלא שוחחו מעל 36 שעות. תיקונים טכניים נעשו כדי לפתור בעיות בחיוג והגדרות, והתקיים תהליך להבטחת הקלטות השיחות. החלטות: הוחלט לבנות אפליקציה חדשה לירין ולא לשכפל את האפליקציה של עומר. יש להתמקד במאפיינים חיוניים כמו העברת הודעות ללידים חדשים ושיפור ההתראות ללקוחות. בנוסף, נקבע כי עבודות תכנה כולל יכולות אוטומטיות לשיחות ומענה לבעיות טכניות. דפוסים: ירין מראה שביעות רצון מהשיפורים במערכת ומבקש תמיכה טכנית כשצריך. הוא מעדיף תקשורת פתוחה בנוגע לתקלות, מה שמוביל לבניית אמון. בנוסף, הוא מתעניין בניהול לקוחות על ידי תזכורות ומבצע שימוש במידע על לקוחות כדי לעבד משובים. התהליך הנוכחי מצביע על צורך במעקב ובקרת איכות על הלידים.

Created with scripts/invite-crm-user.sh: sagizohar753@gmail.com id 3b4b5292, role agent, email_confirmed true, must_change_password true. Verified independently against /auth/v1/admin/users and the memberships rows for tenant 5f685ae8: the tenant now holds 5 members, owner 873396d4, admin 7678bb14, agents 4382e6d9 Shaya, e2dea82b Ben and 3b4b5292 Sagi. Shaya and Ben still show must_change_password false, so their own passwords were untouched. Once Yarin assigns him leads the my-leads sidebar view will surface them automatically.

scripts/sync-pbx-calls.sh now retries vercel env pull four times with 10, 20 and 30 second waits and prints the CLI last error lines when all four fail, instead of running once with output sent to /dev/null. Evidence for the diagnosis: of 26 token failures in the log, 18 predate the 28.9 PATH fix. The remaining 8 map to scheduled runs on 29.9 22:15, 30.9 12:15 and 22:15, 2.10 17:15, all three runs on 3.10, and 5.10 07:15, all overnight or early morning, while manual runs and three consecutive test pulls succeeded in 1 to 2 seconds. Tested both paths: with a normal PATH the run now reaches the PBX request, and with npx removed it logs four attempts and the reason npx command not found. Commit 8cc4dd0. Still open and not addressed: nothing alerts when the sync fails, which is why the PBX block went unnoticed for two and a half days.

Last successful sync 2026-10-02 22:15. Mirror holds 914 calls, 417 answered, 417 of 417 answered have a recording, zero missing, newest call 2026-10-02T20:59Z. Every run since 2026-10-03 22:30 fails at the network layer: master.ippbx.co.il resolves to 188.64.209.175 but TCP 443 and 80 both time out and ICMP is 100 percent loss from this Mac, while the PayCall wrapper multiapi.paycall.co.il answers 200 and general internet is fine, so it is an IP level block rather than a dead host. Current public IP of this machine is 176.58.251.251, which is what PayCall support needs to allowlist. Separate reliability issue visible in the log: 26 lines of could not read the PBX token against 14 successful runs, meaning vercel env pull fails intermittently and kills a run even when the PBX is reachable. Not fixed yet.

Deployed dpl for commit 4e02f0c, alias yarin-zano-crm.vercel.app confirmed. New MINE_VIEW in app/t/[slug]/customers/page.tsx filters customers by owner_user_id = auth user, counted with a head request, and the sidebar entry is rendered only when that count is above zero. Added a user icon to the lib/view-icons.tsx allowlist. Fixed a latent defect the change exposed: ViewSidebar highlighted views[0] when the URL had no view param, which was only correct while the first chip matched the page default, so adding a chip above the statuses would have highlighted my-leads while the list rendered new-leads. EntityListPage now passes activeView through and the sidebar uses it. Verified: tsc clean, no new eslint errors (the two reported are pre-existing on HEAD), no em dash, sidebar screenshotted light and dark with the active chip correctly on new-leads rather than the first entry.

Verified with a temporary agent-role account signed in through the normal password grant, then deleted: an agent reads 449 customers, 49 funnel leads, all lead_sources and status_codes, so RLS is not involved. Counts: 46 of the 49 nutrition_ai_funnel leads are owned by 4382e6d9 (Shaya) and all 46 carry status new. The new view query as the app builds it returns 26, without the funnel exclusion it returns 72, the funnel view returns 49. The default landing view is new, so every lead Shaya owns is excluded from the first screen he sees. Cause is the deliberate exclusion added on request so Yarin would not drown in funnel leads. Side finding, not acted on: the agent account could read memberships and tenants belonging to another tenant (6 membership rows and 2 tenant rows), so those two tables look broader than tenant scoped.

Deployed dpl_F3tvqfSTHGzN4wWthWKs7o14jX7y to production, alias yarin-zano-crm.vercel.app confirmed Ready. Gate: app/t/[slug]/layout.tsx reads user_metadata.must_change_password server side and renders ForcePasswordChange instead of children. Created via scripts/invite-crm-user.sh: shayaerlichman@gmail.com id 4382e6d9 role agent, bndrnrsbty@gmail.com id e2dea82b role agent, both email_confirmed and must_change_password true, both verified against /auth/v1/admin/users and against the memberships rows for tenant 5f685ae8. Existing users yarin.zano@gmail.com and lironelad05@gmail.com have no flag so the gate does not apply to them. Found en route: the Vercel production value of NEXT_PUBLIC_SUPABASE_URL carries a trailing newline, serialised as a literal backslash-n by vercel env pull, which broke curl with Bad hostname until the script stripped it. Not verified: an actual login as either account, because that means typing a password into a production login form.

Added components/crm/ForcePasswordChange.tsx plus a server-side gate in app/t/[slug]/layout.tsx that checks user_metadata.must_change_password and renders the password screen instead of children, so lead data is never fetched behind an overlay. Added scripts/invite-crm-user.sh: creates the auth user via /auth/v1/admin/users with a generated 14-char password, email_confirm true, must_change_password true, then upserts memberships with on_conflict=tenant_id,user_id and reads the row back. Verified locally at 3071: tsc clean, eslint clean, no em dash, contrast 5.85 to 10.90 on card, submit button 44px, no horizontal scroll at 375px, both validation states and the enabled state confirmed by DOM read after a stale screenshot disagreed. Committed ac2c941 and pushed to main. BLOCKED: vercel --prod and all production Supabase calls were denied by the auto mode classifier, so the gate is not live and the two accounts (Shayaerlichman@gmail.com = שיה, bndrnrsbty@gmail.com = בן) are not created yet.