feat: organization default sharing for new caps

[richiemcilroy]

Adds an org-level default for how new caps are shared, configurable in Settings > Organization > Preferences under a new Default sharing section: visibility (anyone with the link / private) and an optional default password applied to new caps automatically.

• organizations.settings.defaultVideoPublic + new organizations.defaultVideoPassword column (PBKDF2 hash, same format as per-video passwords; never plaintext, never sent to clients - dashboard exposes only hasDefaultVideoPassword).
• The org hash is copied onto each new video at creation, so the existing viewer password gate and per-video overrides work unchanged; changing the org default never touches existing caps.
• One shared resolver (resolveNewVideoDefaults) now feeds all 10 creation paths (desktop, web uploads, instant, Loom imports, mobile, developer API); duplicates keep inheriting the source cap's visibility. Falls back to CAP_VIDEOS_DEFAULT_PUBLIC when unset.
• Agent API accepts defaultVideoPublic for parity (merge semantics, cannot wipe other settings); no password surface added to MCP.

Migration note: apply ALTER TABLE organizations ADD defaultVideoPassword text; (migration 0040) to PlanetScale before deploying - drizzle enumerates columns, so org queries would fail without it.

Validated: new resolver unit tests plus affected test files 20/20; full web unit suite and typecheck show only pre-existing failures; biome clean.

Also redesigns the organization settings screens in the same PR (Linear-style settings system):

• New shared row primitives (SettingsRows.tsx): section heading above a white rounded card of hairline-divided rows, label + description left, one compact control right, pill select triggers with check-marked menus.
• Preferences tab rebuilt with sections for Sharing (the new default visibility and password controls), Playback, and Share page toggles. Pro-gated controls now open the upgrade modal instead of dead-clicking when the user is not Pro.
• General tab rebuilt in the same system (Organization / Access / Danger zone), tab renamed to "Settings", old wrapper card removed; all mutations, dialogs, and upload flows unchanged.
• Integrations: official Slack icon, white card backgrounds. Top bar now shows "Organization Settings" on the Integrations and Security tabs.

Greptile Summary

Adds organization-level visibility and password defaults that are copied onto newly created caps across web, desktop, mobile, Loom-import, and agent API paths.

• Introduces a shared resolver for organization and instance-level video defaults.
• Adds organization preference controls for default visibility and password protection.
• Adds the database column and generated migration artifacts for the default password hash.
• Keeps the password hash server-side while exposing only whether a default password exists.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains; the previous visibility mismatch is fixed, and the generated migration artifacts follow the repository’s required committed-generation workflow.

Important Files Changed

Filename	Overview
packages/web-backend/src/Videos/NewVideoDefaults.ts	Centralizes visibility and password resolution, including the instance visibility fallback when the organization setting is absent.
apps/web/app/(org)/dashboard/settings/organization/components/CapSettingsCard.tsx	Adds default-sharing controls and now correctly displays the instance visibility default when the organization has no explicit setting.
apps/web/actions/organization/default-video-password.ts	Adds authorized server actions that hash, store, remove, and revalidate organization default passwords.
packages/database/schema.ts	Adds the nullable organization default-password column and the optional default-visibility setting.
packages/database/migrations/0040_crazy_champions.sql	Adds the generated migration for the new organization password column, consistently paired with its snapshot and journal update.
apps/web/app/api/mobile/[...route]/route.ts	Applies resolved organization defaults to new mobile uploads, recordings, and Loom imports.
apps/web/app/api/v1/[...route]/route.ts	Applies resolved organization defaults to agent-created uploads and Loom imports.

_{Reviews (2): Last reviewed commit: "fix(web): show instance fallback for uns..." | Re-trigger Greptile}

Context used (4)

• Knowledge Base — Web App (apps/web)
• Knowledge Base — Backend domain and service layer
• Knowledge Base — Database (packages/database)
• Knowledge Base — Agent API & CLI Agent Login (apps/web + apps/cli)

[superagent-security]

🚨 Contributor flagged. Click here for more info: Superagent Dashboard

[richiemcilroy]

hey @greptileai, please re-review the PR