Files
twenty/packages/twenty-apps/internal/twenty-partners
Abdullah. bebe03e453 fix(security): bump tar to 7.5.16 across lockfiles (PAX file smuggling) (#21813)
## fix(security): bump tar to 7.5.16 across lockfiles (PAX file
smuggling)

Resolves [#1472 1474 1476 1479 1481 1483 1485 1487 1489 1491 1493 1496
1498 1505](https://github.com/twentyhq/twenty/security/dependabot/1472
1474 1476 1479 1481 1483 1485 1487 1489 1491 1493 1496 1498 1505).

### What

`tar` (`node-tar`) `<= 7.5.15` applies a PAX size override to
intermediary GNU long-name/long-link headers, causing a tar-parser
interpretation differential (file smuggling). Patched in `7.5.16`.

### Why these alerts

The advisory is scanned across many independent Yarn projects, so it
surfaced as one alert per lockfile: the root `yarn.lock` plus 13
`packages/twenty-apps/**` lockfiles (each pulls `tar` transitively).

### How

- Refreshed `tar` to `7.5.16` in the root and all 13 app lockfiles —
they hold `tar` via `^7.5.x` ranges that already permit it, so this is
an in-range lockfile refresh (no override) via `yarn up -R tar`.
- The root additionally had `tar@7.5.15` exact-pinned by
`@mintlify/previewing`, which has **no upstream fix** (latest `4.0.1163`
still pins `7.5.15`). Added a scoped resolution
`@mintlify/previewing/tar -> ^7.5.16`, **extending the existing scoped
tar resolutions** already used for `@electron/rebuild` and
`@electron/node-gyp`.

### Not included

`seed-dependencies/yarn.lock` (alert #1500) is intentionally excluded:
that lockfile and its checksum constants are already modified by the
open form-data PR, so its `tar` bump will follow separately to avoid a
conflict.

### Verification

- No `tar <= 7.5.15` remains across the root or any app lockfile.
- `yarn install --immutable` passes.
2026-06-19 08:49:07 +02:00
..

twenty-partners

A Twenty app that turns the CRM into the operating system for the Twenty partner program: intake partner-eligible deals, match them to vetted marketplace partners, and track the matching pipeline end-to-end.

Built on Twenty with twenty-sdk v2.5.

What's inside

  • Custom object: Partner — slug, status, availability, served geos, languages spoken, deployment expertise, Calendly link, last-match timestamp. See src/objects/partner.object.ts.
  • Opportunity extensionsmatchStatus, designDocStatus, introSentAt, lastRelanceSentAt, tftId, plus a partner relation.
  • Logic functions
    • on-opportunity-auto-match — fires when matchStatus is set to AUTO_MATCH. Assigns the longest-idle available partner and flips status to MATCHED. If no partner is available, hands off to MANUAL_MATCH with an audit Note explaining why.
    • list-available-partners — surfaces matchable partners for a given opportunity.
    • post-install — first-run setup.
  • Roles (src/roles/)
    • Twenty Partner Ops — internal team role, full CRUD on Partner/Company/Person/Opportunity.
    • Partner — placeholder external-partner role. Do not assign until Twenty ships row-level permissions — it currently grants access to every record.
  • Views (src/views/)
    • Waiting for match — opportunities awaiting human action (matchStatus is TO_BE_MATCHED or MANUAL_MATCH).
    • Matches overview — full matching funnel grouped by matchStatus (configure Kanban grouping manually in the UI).
    • Opportunities — replacement of the native opportunities view with the partner columns.
    • Partners and All matched deals — partner-side index and deal log.
  • Sidebar nav — surfaced in workflow order: Waiting for match, All partner deals, Matches overview, Partners, Opportunities.
  • Seed scripts (src/scripts/) — populate a fresh workspace with realistic demo data.

Match status pipeline

matchStatus is a non-nullable SELECT field with a default of TO_BE_MATCHED. The 10 states follow the deal lifecycle:

Status Meaning
TO_BE_MATCHED Default — deal entered, awaiting assignment
MANUAL_MATCH Needs a human to pick a partner
AUTO_MATCH Triggers automatic partner assignment
MATCHED Partner assigned
INTRODUCED_TO_A_PARTNER Customer intro sent
WORKING_WITH_A_PARTNER Engagement underway
IMPLEMENTING Active implementation
WON Deal closed won
RECONNECT_LATER Paused — reconnect in future
LOST Deal closed lost

Getting started

Requires a local Twenty server at http://localhost:2020 and Node ^24.5.

yarn install
yarn twenty dev

Default dev credentials: tim@apple.dev / tim@apple.dev.

Run yarn twenty help for the full CLI reference.

Common commands

Command What it does
yarn twenty dev Start the dev server and sync the app on file changes
yarn twenty server status Check the local Twenty server
yarn lint / yarn lint:fix Run oxlint
yarn test Run integration tests (vitest.config.ts)

Seeding demo data

Two idempotent seed scripts. Both run via the vitest.seed.config.ts config that skips the global app uninstall/reinstall.

# 1. Marketplace partners (run first — pipeline seed wires opportunities to these by slug)
yarn vitest run --config vitest.seed.config.ts src/scripts/seed-marketplace-partners.ts

# 2. Pipeline demo: 3 companies, 3 people, 15 opportunities spread across matchStatus values
yarn vitest run --config vitest.seed.config.ts src/scripts/seed-pipeline-demo.ts

Both scripts skip records that already exist (by slug, name, or firstName+lastName), so they are safe to re-run.

Known limitations

Current SDK gaps blocking further polish:

  • Custom Partner record page layout (RECORD_TABLE has no relation scoping).
  • Native Opportunities view column-order override.
  • Kanban view configuration from app code (ViewType.KANBAN is currently ignored).
  • App and field descriptions.

Learn more