* feat(enterprise): add data drains for continuous export to S3 / webhook
* chore(data-drains): regenerate migration on top of staging + bump route baseline
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* docs(data-drains): clarify retention pairing is user-coupled, not enforced
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(data-drains): preserve explicit forcePathStyle=false + reserve x-sim-signature
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* test(data-drains): drift guard ensures every webhook header is reserved
Asserts that any header buildHeaders writes is rejected when reused as a
custom signatureHeader. Adding a new metadata header without mirroring it
into RESERVED_SIGNATURE_HEADER_NAMES now fails CI.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
* chore(docs): upgrade fumadocs to latest minor versions
- fumadocs-core: 16.6.7 -> 16.8.5
- fumadocs-ui: 16.6.7 -> 16.8.5
- fumadocs-mdx: 14.2.8 -> 14.3.2
- fumadocs-openapi: 10.3.13 -> 10.8.1
- migrate deprecated sidebar.tabs to top-level tabs prop
- fix pre-existing typo (slots.paremeters) surfaced by stricter openapi types
* fix(docs): revert sidebar.tabs migration to keep deploy compat
The top-level tabs prop is only on fumadocs-ui 16.7+; deploy env was
still resolving an older type and failing typecheck. sidebar.tabs is
deprecated but still functional — keep it for now.
* fix(md-render): fix markdown rendering in file viewer
* fix(md-render): use Children.map in pre handler for robustness
* fix(md-render): add not-italic to fallback code element
* fix(md-render): fix cloneElement type error and include tables improvements
- Fix TypeScript build error: type isValidElement<Record<string, unknown>> so cloneElement accepts data-block prop
- Column sidebar: use CSS min() for responsive width instead of fixed 400px
- Table: boolean cell toggle only fires when clicking the checkbox element directly (via data-boolean-cell-toggle), not anywhere on the cell
- Table: double-clicking a boolean cell no longer opens edit mode
- Table: move row-select mousedown to the <td> to widen the hit target
- Table: run/stop button prevents row-select on mousedown
- Table: SelectAllCheckbox made keyboard-accessible; checkbox is pointer-events-none
Tool params were named `personalApiKey` but the subBlock resolves to canonical
`apiKey`, so canonical-group resolution wrote the value to params.apiKey while
the validator looked up params.personalApiKey and reported it missing.
Renames `personalApiKey` -> `apiKey` in get_person, query, list_persons,
delete_person, and types.ts. Also tightens check-block-registry.ts so a
subBlock with canonicalParamId no longer satisfies a tool param lookup by its
raw id (the raw id is deleted during extraction).
* v0.6.29: login improvements, posthog telemetry (#4026)
* feat(posthog): Add tracking on mothership abort (#4023)
Co-authored-by: Theodore Li <theo@sim.ai>
* fix(login): fix captcha headers for manual login (#4025)
* fix(signup): fix turnstile key loading
* fix(login): fix captcha header passing
* Catch user already exists, remove login form captcha
* feat(credentials): add Atlassian service account credentials
* improvement(credentials): tighten Atlassian service account plumbing
- Collapse fetchOAuthTokenBundle into fetchOAuthToken (returns the bundle)
- Reuse serviceAccountJsonSchema in the JSON form instead of hand-rolled checks
- Use parseAtlassianErrorMessage for log details; drop one-line bearer helper
- Extract ATLASSIAN_SERVICE_ACCOUNT_PROVIDER_ID/_SECRET_TYPE constants
- Use Drizzle .returning() instead of post-insert SELECT
- Helper for the duplicated 401/403 + non-OK pattern in the validator
* docs(credentials): add Atlassian service account setup guide
- New /integrations/atlassian-service-account doc covers token creation,
scope selection, and adding the credential to Sim
- Form's "View setup guide" link now points at the doc
- Fix the existing Google form link that pointed to the wrong path
Screenshot TODOs left inline as MDX comments for the docs team.
* docs(credentials): add Atlassian service account screenshots
- Auth type picker, Sim add-credential modal, Jira block credential dropdown
- Scope-picker screenshot still TODO
* docs(credentials): add Atlassian scope picker screenshot
* fix(credentials): address greptile feedback on Atlassian SA
- Drop stale 'email and API token' copy from the service description
(we only collect a token + domain, no email field)
- Move duplicate display-name check inside the create transaction so
concurrent POSTs can't both pass the check and insert duplicates
* fix(docs): move Atlassian screenshots to docs/public
Docs site serves /static/* from apps/docs/public, not apps/sim/public —
matches the existing google-service-account screenshot convention.
* fix(credentials): address review feedback on Atlassian SA
- SSRF: only accept *.atlassian.net / *.jira-dev.com hosts before fetching
tenant_info, blocking probes against localhost/internal IPs
- Confluence spaces selector: pull cloudId from the SA secret instead of
calling accessible-resources, which 401s for scoped service-account tokens
- Case-insensitive https?:// strip so HTTPS://team.atlassian.net normalizes
correctly
* chore: merge staging and bump API validation route baseline to 727
* perf(credentials): single-resolve in confluence spaces selector
Atlassian SAs were hitting resolveOAuthAccountId twice (once via
refreshAccessTokenIfNeeded, once directly to read cloudId) and
decrypting the secret twice (via getAtlassianServiceAccountToken
inside refresh, then again via getAtlassianServiceAccountSecret).
Resolve once up front and branch the whole flow on the result —
SA path skips refresh entirely and pulls token+cloudId from a
single secret read.
* refactor(credentials): consolidate Atlassian SA creation into /api/credentials
Atlassian service-account creation lived in its own route, contract, and
mutation hook, copy-pasting ~140 lines of insert/membership/audit/posthog
boilerplate from /api/credentials. Two endpoints means two authz paths,
two audit shapes, two TOCTOU stories — they will drift.
Fold Atlassian into the existing service_account branch of /api/credentials,
dispatching by providerId. The Atlassian validator (tenant_info + Bearer
/myself, SSRF host allowlist, typed error codes) lives in
lib/credentials/atlassian-service-account.ts and is the only Atlassian-
specific piece left. AtlassianValidationError maps to a {code, error} 400
in the existing catch block; the rest of the flow (transaction, members,
audit, posthog, dup-check) is now shared with Google SA + env credentials.
Delete:
- /api/auth/atlassian-service-account route
- contracts/atlassian-service-account.ts + barrel export
- useCreateAtlassianServiceAccount hook
- API audit baseline 727 → 726
Both forms (Google JSON-key, Atlassian token+domain) now call
useCreateWorkspaceCredential with the appropriate body shape.
* fix(credentials): close TOCTOU and restore typed errors after consolidation
- Add inner duplicate-guard inside the create transaction (DuplicateCredentialError)
to close the race that the outer findExistingCredentialBySource leaves open.
service_account rows have no DB-level unique index on (workspaceId, providerId,
displayName), so this is the actual safety net. Tx-internal check applies to
Google + env_workspace too — race-safety win for all credential types.
- Re-emit {code: 'duplicate_display_name', error: ...} on conflict so the form's
ERROR_MESSAGES.duplicate_display_name mapping is reachable again.
- Thread Atlassian-specific audit metadata (atlassianDomain, atlassianCloudId)
back into recordAudit; consolidation had dropped them.
- Use ATLASSIAN_SERVICE_ACCOUNT_PROVIDER_ID constant in contract superRefine.
- Drop `error: any` in catch in favor of `error: unknown` + getPostgresErrorCode.
* chore(credentials): drop dead createWorkspaceCredentialBodySchema + updateWorkspaceCredentialBodySchema
Both shadowed the actually-used schemas (createCredentialBodySchema /
updateCredentialByIdBodySchema) and were missing the apiToken/domain
Atlassian fields. A future change could pick the wrong one and silently
drop those fields. Confirmed zero non-definition references in the repo
(grep across apps/, packages/, scripts/ minus build artifacts).
* fix(credentials): scope inner duplicate re-check to service_account
OAuth dedupes by accountId, env_* by envKey — both have DB-level partial
unique indexes that surface as 23505. The previous inner re-check fired
for all types and always threw DuplicateCredentialError, which mapped to
'duplicate_display_name' in the UI even when the real conflict was a
duplicate OAuth account or env key. Restrict the in-tx re-check to
service_account (the only type without a DB-level index) and let the
23505 handler emit a generic message for everything else.
---------
Co-authored-by: Waleed <walif6@gmail.com>
Co-authored-by: Siddharth Ganesan <33737564+Sg312@users.noreply.github.com>
Co-authored-by: Vikhyath Mondreti <vikhyathvikku@gmail.com>
* feat(posthog): correlate task events with Go logs via request_id
Auto-injects server request_id into all PostHog server events from
AsyncLocalStorage context. Adds task_request_started client event fired
when SSE traceparent response header arrives, carrying the trace ID used
by Go for log correlation. task_generation_aborted now includes the
in-flight request_id when available.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* improvement(posthog): tighten trace ID parse and verbose comments
* fix(posthog): use traceparent header as canonical request_id source
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
* refactor(tables): phase 1 — gutter numbering from array index
Delete the PositionGapRows component, the gap-fill loop, and the
GAP_CHECKBOX_CLASS / GAP_ROW_LIMIT / PositionGapRowsProps surface area.
The server's recompactPositions() guarantees positions are 0..N-1
contiguous in the unfiltered view, so the phantom-row machinery has
been defending against a state that essentially never happens.
DataRow now receives an arrayIndex prop and renders {arrayIndex + 1}
in the gutter. Selection coordinates still flow through row.position;
that switches in phase 2.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* refactor(tables): phase 2-5 — selection by array index, checks by row id
Decouple Tables UI selection coordinates from DB position:
- rowIndex semantics shift from row.position to array index across
selection state, mouse handlers, keyboard nav, paste, scrollIntoView
- checkedRows: Set<number> (position) → Set<string> (rowId), survives
sort/filter and realtime row inserts
- lastCheckboxRowRef stores rowId; shift-click range resolves to current
array indices for visual-order ranges
- Drop positionMap/maxPosition derived state in favor of direct rowsRef
reads
- ExpandedCellPopover anchors via data-row-id (row-id-stable) instead
of data-row (array index)
- collectRowSnapshots accepts Iterable<TableRowType> directly
- Add bounds-validation effect to clamp anchor/focus when rows.length
shrinks (sort change, pagination, realtime delete)
- Drop redundant arrayIndex prop on DataRow (rowIndex now equals it)
Server-side position math stays at API boundary only: insertRow,
duplicateRow, shift-Enter append, paste create-batch, undo snapshots.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* refactor(tables): rowId-stable selection across sort, position math via reduce
- Track anchor/focus by rowId so same-length sort changes remap selection
to the new visual index instead of leaving it on a different row.
- Replace last-row position lookups with Math.max reduce in paste's
create-batch and append-row's undo snapshot — under non-position sorts,
the last visual row's position is not the largest.
- Trim a navigation-noise comment and tighten two over-explanatory ones.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(tables): guard rowId remap effect and document paste batch position
- Skip the validation effect when rows is empty (transient state during
initial load of a new sort/filter before keepPreviousData populates) so
selection survives uncached query changes.
- Skip when isColumnSelection is true; the column-selection pinning effect
owns focus.rowIndex for those, and remapping would shrink a full-column
range to wherever the captured endpoints happened to land after reorder.
- Comment lastRowPosition's hoist invariant so a future refactor doesn't
move it inside the loop and produce colliding positions.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
* fix(tables): suppress phantom rows on sort, center gutter numbers, stop select-all viewport jump
* fix(tables): suppress scroll on Ctrl+A select-all
Cmd/Ctrl+A duplicates the select-all logic but missed the
suppressFocusScrollRef flag, so the keyboard path still triggered
the viewport jump.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
* feat(logs): add Logs block for querying execution logs from workflows
* fix(logs): guard transformResponse on non-2xx and correct executionMetadata description
- Add response.ok check in all three logs tools' transformResponse so a
4xx/5xx body cannot be silently treated as a success payload (defense
in depth; the executor already throws on non-2xx before transform runs).
- Drop totalTokens from executionMetadata description in block and tool
outputs since the snapshot route does not emit it.
* fix(logs): split summary/detail contracts to make trace tab gate type-safe
The Trace tab was silently missing from the Log Details sidepanel because
list and detail rows shared one WorkflowLog type with executionData:
z.unknown(). The UI couldn't distinguish a summary row (no spans) from a
detail row (with spans), so the tab gate read undefined and hid itself.
Splits into WorkflowLogSummary (list) and WorkflowLogDetail (typed
executionData with optional traceSpans). Detail and by-execution routes
both write through to the same logKeys.detail(id) cache, eliminating the
two-key fragmentation that caused the merge memo workaround. List route
moves to cursor pagination on (sortValue, id) with proper NULLS LAST
handling and SQL-side sort across workflow + job execution tables.
Detail route now requires and asserts workspaceId. Deep-link path uses
useLogByExecutionId instead of auto-paginating the entire workspace.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(logs): audit follow-ups — render side-effect, stats invalidation, enhanced spread order
- Move onActiveTabChange call from render into useEffect to avoid
side-effects during render (StrictMode safety).
- Re-add logKeys.stats() invalidation to cancel/retry mutations so
the dashboard reflects status flips immediately.
- Reorder enhanced: true after ...execData spread in detail and
by-execution routes so the literal discriminator is never
overwritten by stale execData.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(logs): mirror SQL NULLS LAST in JS merge for cursor consistency
The in-memory merge of workflow + job pages negated the comparator
for DESC, which placed null sort values at the start. SQL orders
both ASC and DESC with NULLS LAST, so DESC pages emitted a cursor
{v: <last non-null>, id: ...} while null rows still satisfied the
cursor predicate (OR sort_expr IS NULL) on the next page —
producing duplicate null rows across pages on cost/duration sorts.
Handle nulls explicitly in the JS comparator so they always sort
last regardless of direction, matching the SQL ordering.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(logs): final-audit follow-ups — stable tab callback, byExecution invalidation, optimistic detail patch, trace loading state
- Wrap LogDetails -> LogDetailsContent onActiveTabChange in useCallback
so the child useEffect doesn't refire on every parent render.
- Add logKeys.byExecutionAll() to cancel + retry invalidation so the
table-embedded sidebar picks up status changes immediately.
- Optimistic write-through to logKeys.detail in useCancelExecution so
the open sidebar reflects 'cancelling' instantly; rolls back on error.
- Distinguish trace loading from trace-empty: when log.executionData is
not yet fetched, render "Loading trace…" instead of the empty state.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* refactor(logs): migrate stores/components to contract types
Replace the legacy `WorkflowLog` / `LogsResponse` / `WorkflowData` /
`CostMetadata` / `ToolCallMetadata` shapes in
`stores/logs/filters/types.ts` with direct use of the contract types
`WorkflowLogSummary`, `WorkflowLogDetail`, and a new `WorkflowLogRow`
alias for surfaces that render either form. Removes the
`summaryToWorkflowLog` / `detailToWorkflowLog` bridge in the React
Query layer along with their double-cast annotations.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* refactor(logs): address PR review feedback
- Whitelist sort columns against logSortBy enum to prevent client crash
when non-sortable headers (workflow, trigger) reach the contract parser.
- Extract fetchLogDetail helper shared by /api/logs/[id] and
/api/logs/by-execution/[executionId] — collapses ~360 duplicated lines
to a single source of truth keyed on lookup column.
* fix(logs): exclude job logs when level filter is workflow-only
When level=running or level=pending (workflow-only states involving
endedAt/pausedExecutions semantics), jobLevelConditions stayed empty
so no level constraint reached jobConditions — every job log in the
workspace leaked into the result. Skip the job side entirely when the
level filter has no job-applicable values (error/info).
* chore(logs): drop dead utils — mapToExecutionLog and friends
Remove ExecutionLog/RawLogResponse/ExecutionCost/LogWithExecutionData/
TraceSpan/BlockExecution interfaces and the mapToExecutionLog,
mapToExecutionLogAlt, extractOutput functions — all unreferenced after
the contract split. -212 lines.
* chore(logs): drop unused LOG_COLUMN_ORDER and LogColumnKey
* fix(logs): hydrate filters from URL synchronously on mount
The previous useEffect-based initializeFromURL caused useLogsList and
useDashboardStats to fire once with default store filters, then refetch
after the effect updated filters from the URL. Move the initial hydrate
into a useState lazy initializer so the first render already reads
URL-derived filters; the popstate handler keeps the existing effect for
back/forward navigation.
* chore(logs): trim verbose comments added during PR
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(logs): guard navigation arrows when selected log is off-page
Deep-linked logs resolved via useLogByExecutionId may not be in the
current page list, leaving selectedLogIndex at -1. The hasNext prop
was evaluating -1 < logs.length - 1 (true for any non-empty list),
which enabled the next arrow and jumped to the first item on click.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(logs): sync active-tab callback before paint to keep keyboard guards aligned
Run the resolvedTab → onActiveTabChange propagation in useLayoutEffect
so the parent's activeTabRef updates synchronously before the next
paint. This closes the brief window where window keydown handlers
in the logs page would still see activeTabRef.current === 'trace'
and short-circuit arrow-key navigation immediately after switching
to a log without a Trace tab.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
* fix(copilot): redact sim_key API keys from persisted Mothership chat messages
* improvement(emcn): promote ApiKeyReveal to SecretReveal in emcn
* fix(copilot): thread cursor across content blocks when restoring sim_key tags
* fix(mothership): stop persisting log resources from get_workflow_logs and self-heal stale log panel entries
* fix(mothership): skip retries on 404 in useLogDetail for instant self-heal
* fix(mothership): simplify onNotFoundRef sync to inline assignment
* fix(mothership): catch draft restore errors instead of crashing /home
Wrap the mount-time draft restore in try/catch with clearDraft on
throw, and coerce text to a string in the useState initializer.
A corrupt entry in mothership-drafts:v1 localStorage previously took
down the entire workspace via the error boundary.
* fix(mothership): defer state writes and log restore failures
Build the restored state in locals first and only apply on success
so a partial throw can't leave stale contexts in the UI with the
draft already cleared. Switch the empty catch to logger.error so
corrupt-draft incidents surface in production logs.
* feat(knowledge): expose Cohere reranker controls on knowledge block
Add a self-hosted Cohere API key field (mirroring the agent block's hosted-key
pattern), a configurable reranker input pool size (1-100), and surface
meta.warnings from Cohere rerank responses via logger.warn. All new contract
fields are optional and nullable for full backwards compatibility.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(knowledge): address PR feedback on Cohere reranker controls
- Drop required:true on apiKey field — server has BYOK→env→rotation fallback
chain, so self-hosted users with COHERE_API_KEY env should not be blocked
- Drop .min(1) on rerankerApiKey contract field so empty strings coerce to
undefined via the transform (matches the existing query field pattern)
- Log a warning when rerankerInputCount is clamped up to topK so users notice
their setting was overridden
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* feat(knowledge): mirror agent block API key visibility for Cohere reranker
Restore required:true on the Cohere API Key field and hide it server-side via
a new NEXT_PUBLIC_COHERE_CONFIGURED public env flag — same pattern the Agent
block uses for Azure (NEXT_PUBLIC_AZURE_CONFIGURED). Self-hosters who set
COHERE_API_KEY in their environment also set NEXT_PUBLIC_COHERE_CONFIGURED=true,
which removes the field from the UI; everyone else sees a required field.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(knowledge): treat empty rerankerInputCount as unset
An empty string from the Documents Sent to Reranker input passed the
undefined/null guard, so Number('') = 0 → clamped to 1, sending only 1
document to the reranker instead of falling back to the 4× topK auto
default. Add the empty-string check to the guard.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
* fix(files): align upload route image extensions with picker
* fix(files): widen image mime mapping for chat/profile/logo uploads
* fix(files): fall back to extension when MIME is generic for image-only uploads
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(files): add new image extensions to EXTENSION_TO_MIME map
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(files): skip non-Claude image MIMEs in createFileContent
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(files): resolve content type for image-only contexts when MIME is generic
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(files): cover image/jpg in Claude gate, reverse MIME map, audit metadata
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
* feat(files): allow image uploads in workspace files
* fix(files): include images in workspace type filter
* fix(files): match all image mime types in image filter
* feat(files): export markdown as zip with embedded images in assets/ folder
* fix(files): sanitize zip filenames, fix storage context cast, cap embedded image count
* fix(files): fix race condition in asset filename deduplication
* chore(files): remove extraneous comments from export route
* fix(files): sanitize markdown zip entry name, full uuid fallback for filename dedup
* fix(files): extract userId const to satisfy TypeScript narrowing in async callback
* fix(files): use replacer function to prevent $ special-char corruption in markdown URL rewrite
* fix(files): wrap zip buffer in Uint8Array for NextResponse BodyInit compatibility
* lock behavior
* fix(workflow): track resolved isAdmin in prevIsAdminRef to prevent stale lock notification
When workspacePermissions loads asynchronously, prevCanAdminRef (which only
tracked effectivePermissions.canAdmin) would not detect the change, causing
the early-return guard to skip rebuilding the notification with the correct
unlock-button visibility. Track the same resolved value (workspacePermissions
?.viewer?.isAdmin ?? effectivePermissions.canAdmin) that is actually used to
build the notification.
* refactor(uploads): rename server fn to fetchWorkspaceFileBuffer, move client download to uploads/client/download.ts as triggerFileDownload
* more lock updates
* fix(tests): update mocks for fetchWorkspaceFileBuffer rename
* improvement(sidebar): overlay lock indicator on leading icon
* fix(sidebar): correct lock indicator HTML nesting and a11y
* improvement(sidebar): swap lock indicator with more button on hover
* fix(sidebar): gate pointer-events on lock and more button visibility
* fix(sidebar): add role=img so lock indicator is announced by AT
* fix(uploads): direct-to-S3 workspace files + shared transport
* chore(testing): centralize posthog and storage-service mocks
* fix(uploads): address PR review — abort propagation, orphan cleanup, error handling
- Throw immediately on AbortError in KB retry loop (no useless 14s backoff)
- Cleanup S3/Blob object on quota or size-cap rejection in registerUploadedWorkspaceFile
- Enforce MAX_WORKSPACE_FILE_SIZE at registration (defense vs presigned PUT lying about size)
- Handle non-OK / non-JSON responses in workspace-files upload paths
* fix(uploads): add Zod contracts for workspace presigned/register routes
* fix(uploads): correct BlobServiceClient type name in headBlobObject
* fix(uploads): address PR review — typo, complete-failure cleanup, double-increment
* fix(uploads): preserve fallback size and reuse existing display name on re-register
* fix(uploads): surface server error message and bypass quota for local-storage fallback
* fix(uploads): align register response schema with UserFile; skip presigned for KB large files
- registerWorkspaceFileResponseSchema now matches the UserFile shape the route actually returns; previous schema required workspace DB-row fields that were never populated, causing requestJson validation to reject successful uploads.
- KB batch presigned fetch now skips files >= LARGE_FILE_THRESHOLD since multipart bypasses the per-file presigned URL anyway.
* fix(uploads): idempotent register skips duplicate audit/posthog; add edge-case tests
- registerUploadedWorkspaceFile now returns { file, created } so the route can skip captureServerEvent and recordAudit on idempotent re-register (existing metadata reused). Previously a re-register fired duplicate analytics + audit log entries.
- Add tests covering: idempotent re-register skips audit/analytics, isNetworkError matches econnreset/timeout/etc keywords, multipart complete failure fires action=abort cleanup.
* fix(uploads): include 50MiB boundary in batch presigned fetch
* fix(uploads): trust HEAD size to prevent quota inflation
The head.size > 0 fallback let a client PUT 0 bytes and register
with an inflated size, debiting quota without storing data. HEAD
on an existing object always returns the true byte count, so trust
it directly — a genuine 0-byte file correctly contributes 0.
* fix(uploads): audit verified file size, not client-supplied
* fix(uploads): handle register retries and name-collision races
Two bugs in registerUploadedWorkspaceFile:
1. Register retry could orphan storage. When a successful response
was lost on the wire and the client retried, the quota check saw
the bytes already counted, failed, and cleanupOrphan deleted the
already-registered storage object — leaving the DB row pointing
to nothing. Fix: check getFileMetadataByKey before quota guard
and short-circuit on existing record.
2. Concurrent same-named uploads could lose data. allocateUniqueWorkspaceFileName
is best-effort; two racing uploads can pass it and both attempt
the same display name. The loser's insert hits 23505, the catch
block called cleanupOrphan, and successfully-uploaded bytes
were deleted. Fix: retry on 23505 with a fresh allocateUniqueWorkspaceFileName,
matching the pattern in uploadWorkspaceFile. Throw FileConflictError
after exhaustion.
* fix(uploads): retry transient DirectUploadErrors at outer KB level
The KB outer retry only triggered on isNetworkError, missing
transient 5xx from S3/Azure (DirectUploadError code
DIRECT_UPLOAD_ERROR or MULTIPART_ERROR). Adds isTransientUploadError
and retries on it, restoring resilience for small-file presigned
PUTs against flaky cloud storage.
* fix(uploads): only retry transient 5xx, not deterministic 4xx
DirectUploadError now carries the HTTP status. isTransientUploadError
gates on 5xx so callers don't loop on 400/403/404 (e.g., malformed
request, expired signature). Multipart per-part retry also short-circuits
on 4xx — same reasoning.
* refactor(uploads): collapse getFileContentType into resolveFileType
The two helpers differed only in whether application/octet-stream
falls back to the extension map. Add an option flag to resolveFileType
and keep getFileContentType as a thin wrapper for direct-PUT callers
that need to preserve the exact browser-reported content-type.
* chore(uploads): trim verbose comments
Drop inline comments that restate code ("Use the full storageKey as fileName"),
collapse a multi-line block comment into a tighter TSDoc on the existence
check, and prune verbose vitest file headers — describe blocks already
document what's tested.
* fix(uploads): regenerate fileId per insert retry; require cloud storage for register
* fix(uploads): cap formdata fallback at 100MB; drop unused size param
* fix(uploads): abort multipart on get-part-urls failure; retry register on transient errors
* fix(uploads): drop vestigial size field from register contract
* fix(uploads): abort multipart on complete-fetch throw
* fix(uploads): set kb presignedEndpoint fallback; race-safe blob HEAD
* fix(uploads): include ?type=knowledge-base on kb presigned fallback
* fix(uploads): remove abort listener on xhr timeout
* fix(uploads): add timeout/abort to kb api fallback upload
* fix(connectors): harden 10 KB connectors after audit
Validated each issue against provider docs before fixing.
- jira: migrate from deprecated /rest/api/3/search (Atlassian sunset
May 2025) to /rest/api/3/search/jql with nextPageToken pagination
- confluence: unify stub hash across v1 CQL (`when`) and v2
(`createdAt`) paths via shared pageToStub helper using version.number
- salesforce: replace hardcoded login.salesforce.com userinfo with
host fallback so sandbox-issued tokens (test.salesforce.com) work
- servicenow: validate sys_id against /^[a-f0-9]{32}$/ and switch
getDocument to path-based /api/now/table/{table}/{sys_id} to close
encoded-query injection; reject `^` in kbCategory filter
- zendesk: URL-encode Search API query via URLSearchParams; whitelist
ticket statuses; encode locale path segment
- github: add 10MB cap and /git/blobs/{sha} fallback for files >1MB
that /contents/ returns with encoding:"none"
- slack: replace SHA-256 over formatted-message window with metadata
hash slack:{channelId}:{latestTs}:{count} so list and getDocument
agree; cache auth.test team_id on syncContext
- obsidian: drop syncRunId from stub hash (Local REST API has no
HEAD/Last-Modified per OpenAPI spec); fall back to path-only stub
so engine two-stage check short-circuits unchanged notes
- evernote: title fallback for attachments-only notes — breaks
infinite hydration loop where empty plaintext returned null
- google-docs: drop residual `error instanceof Error` pattern
Confluence and Slack hash format changes self-heal with a one-time
re-sync; no data loss.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(connectors/slack): include oldestTs in hash to catch window-shift edits
Audit caught that the metadata hash slack:{channel}:{latestTs}:{count}
misses edits to the oldest message in the rolling window — count and
latestTs both stay constant. Adding oldestTs catches window-shift
when a new message arrives and pushes the oldest out without changing
the newest.
Also drop residual error instanceof Error pattern in validateConfig.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(connectors): address remaining audit findings
- jira: thread VALIDATE_RETRY_OPTIONS through getJiraCloudId so the
validate path uses the tighter retry budget
- confluence: thread VALIDATE_RETRY_OPTIONS through getConfluenceCloudId;
drop residual error instanceof Error pattern
- zendesk: log a warning when statusFilter is set and limit exceeds
the Search API 1000-result cap; add priority to tagDefinitions and
mapTags so the metadata isn't orphaned
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(connectors): address PR review comments
- github: skip blob fetch for empty 0-byte files
- salesforce: add fallback message for empty error
- zendesk: warn on invalid statusFilter instead of silent fallthrough
- evernote: remove dead content.trim() guard
* fix(zendesk): add fallback message for empty validateConfig error
* docs(obsidian): clarify hash strategy and re-hydration behavior
* fix(connectors): address parallel audit findings
- servicenow: case-insensitive sys_id pattern; validate workflowState/incidentState/incidentPriority as numeric, kbCategory via allowlist
- salesforce: include 400 in userinfo host fallthrough for sandbox tokens
- zendesk: add missing 'new' and 'hold' options to ticketStatus dropdown
* fix(servicenow): allow string workflowState values (published/draft/review/retired)
* fix(obsidian): validateConfig must check authenticated field, not just status
GET / is the only public endpoint per the Local REST API spec — it returns
200 regardless of auth and exposes the real signal via response.authenticated.
The prior status-based check let invalid API keys pass validation.
* fix(jira): encode collected count in cursor so maxIssues cap works without syncContext
* fix(connectors): address remaining audit findings
- slack: detect message edits and new threaded replies via edited.ts/latest_reply in contentHash
- github: skip binary files via NUL-byte sniff and filter oversized files at tree-list time
- servicenow: add 'outdated' workflow state to allowlist and dropdown; add Canceled (8) to incident state dropdown
- salesforce: drop 400 from userinfo host fallthrough (Salesforce returns 401/403 for cross-env tokens)
* fix(github): apply binary check to blob fallback path
fetchBlobContent now runs isBinaryBuffer on base64-decoded data and
returns null for binaries; getDocument propagates the null so 1-10MB
binary files are skipped instead of being decoded into garbled UTF-8.
* fix(confluence): reuse pageToStub in getDocument to keep hashes in sync
Replace duplicated versionKey/contentHash logic with a single call to
pageToStub so listDocuments and getDocument can never drift.
* fix(connectors): address audit findings across 7 connectors
- github: branch with slashes encoded per-segment in sourceUrl; treat 403
Contents API responses (>100MB or restricted) as null instead of
throwing; fetchBlobContent throws on unexpected encoding rather than
returning empty content
- jira: ADF extractor handles hardBreak, mention, and emoji nodes
- google-docs: paragraph join uses newline so heading/body boundaries
are preserved
- servicenow: drop legacy 'wiki' field from kb_knowledge requests; only
the 'text' field is reliably present on modern instances
- salesforce: KnowledgeArticleVersion query adds IsLatestVersion=true to
avoid duplicate historical versions; encode externalId in sObject GET
- slack: subtype filter switches to a denylist (SLACK_NOISE_SUBTYPES) so
thread_broadcast / me_message / reminder_add are kept; reply_count
folded into contentHash to detect threaded reply deletes
- confluence: drop bare-string cursor fallback; unparseable cursors now
restart the listing instead of silently re-listing blogposts from 0
* fix(servicenow): allow non-ASCII KB category names
Switch from a \w-based allowlist (ASCII only) to a denylist that
rejects only encoded-query-meaningful characters (^, control chars,
quotes). International category names like 'Général' or 'Ação' are
now accepted.
* fix(servicenow): restore wiki field fallback for kb_knowledge
Wiki-template KB articles populate the wiki field and leave text empty;
HTML-template articles do the opposite. Removing wiki caused wiki-format
articles to resolve to empty content and be silently skipped.
* fix(connectors): jira pagination signal and google-docs paragraph join
- jira: rely solely on absence of nextPageToken for end-of-results;
data.isLast on /rest/api/3/search/jql is unreliable (JRACLOUD-95477)
and the OR-with-isLast logic could truncate pagination early
- google-docs: strip trailing newline from each paragraph before
joining so heading->body produces a single newline, not two
* fix(jira): rely solely on nextPageToken for end-of-results
data.isLast on /rest/api/3/search/jql is unreliable (JRACLOUD-95477)
and the previous OR-with-isLast logic could truncate pagination early
if Jira ever returned isLast=true alongside a valid nextPageToken.
* fix(slack): exclude DM channel IDs from direct lookup
DM (D...) channel IDs require im:*/mpim:* OAuth scopes, which the
connector does not request. The regex now matches only public (C) and
private (G) channel IDs to fail fast with a clearer error instead of
hitting missing_scope from Slack.
* fix(slack): align validateConfig channel ID regex with resolveChannel
The previous fix narrowed the regex in resolveChannel to [CG] but missed
the duplicate in validateConfig, which still admitted DM IDs and would
fall through to a name-based search returning 'Channel not found.'
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
* feat(table): make plan table limits configurable via env vars
* fix(table): coerce env table limits to number for skipValidation env
* improvement(env): extract envNumber helper for numeric env coercion
* improvement(knowledge): use envNumber helper for KB_CONFIG_* env reads
* fix(testing): add envNumber to env mock factory
* fix(env): allow zero in envNumber for max-throughput configs
* fix(env): add min option to envNumber for strict-positive configs
* fix(chat): close SSO auth bypass via checkSSOAccess body flag
- Remove checkSSOAccess short-circuit; SSO branch always validates via getSession()
- Skip chat_auth cookie issuance/validation for SSO deployments to prevent replay
- Split eligibility pre-flight into dedicated POST /api/chat/[identifier]/sso route
- Drop .passthrough() and checkSSOAccess from deployed chat contracts
- Add SSO branch test coverage in chat utils
* fix(chat): cast allowedEmails to string[] for SSO eligibility check
* fix(chat): close SSO GET cookie replay and add eligibility rate limit
- Skip chat_auth cookie validation for SSO in GET handler (replay vector for pre-fix cookies)
- Route SSO GET through getSession() instead of always returning auth_required_sso so post-IdP config fetch works
- Add per-IP rate limiting to /api/chat/[identifier]/sso to prevent allowlist enumeration
* feat(files): resolve workspace file page URLs to raw content in markdown preview
* refactor(files): replace regex URL matching with URL constructor in resolveSimFileUrl
* fix(files): render mermaid diagrams in markdown preview using design tokens
Streamdown intercepts fenced code blocks before components.code is called,
so the previous mermaid branch in the code renderer was dead code. Add a
remarkMermaid plugin that transforms mermaid code nodes at the MDAST stage
via data.hName/hProperties so remark-rehype emits a <mermaid-diagram>
element that our MermaidDiagram component handles. This avoids Streamdown's
built-in mermaid renderer which uses mismatched Tailwind semantic classes.
* fix(trace): reduce default tree pane width from 360 to 280
* fix(files): guard resolveSimFileUrl against cross-origin URL hijacking
* refactor(files): use getBrowserOrigin() instead of window.location.origin
* fix(trace): reduce default tree pane width to 240
* fix(files): narrow img src type before passing to resolveSimFileUrl
* fix(files): use narrow props type for img renderer instead of runtime narrowing
* fix(files): accept full ImgHTMLAttributes for img renderer to satisfy Streamdown Components type
* fix(files): treat null getBrowserOrigin as same-origin to prevent SSR hydration mismatch
* improvement(files): use centered aspect-ratio skeleton for mmd file preview
* improvement(files): diagram-shaped skeleton card for mmd file preview
* fix(files): only rewrite relative workspace file URLs to avoid hydration mismatch
* fix(files): pass context not resolved params to parseRequest in view route
* fix(files): simplify mmd file skeleton to match pptx card pattern
* fix(files): match mmd skeleton to actual rendered layout — full-height zoomable area
* fix(sidebar): left-align folder lock icon next to name
* fix(file): zero byte codegen file format
* address comments
* distinguish streaming from actual empty pdf
* fix mermaid diagram state mgmt
* mermaid linter errors sent back to llm
* address comments
* fix autozoom
* Revert "improvement(executor): correctness-by-construction for workflow logs (#4382)"
This reverts commit add55b4ffa.
* fix(terminal): re-read entries inside reconcileFinalBlockLogs loop
For workflows with loop or parallel iterations, finalBlockLogs can
contain multiple terminal logs sharing the same blockId. The prior
code captured entries once before the loop, so entries.find always
matched the same first running entry — later iterations stayed
isRunning: true and got swept to "cancelled" instead of showing
their actual terminal state. Re-read the snapshot per iteration so
each updateConsole's isRunning: false flush narrows the next match.
* chore(terminal): remove dead consoleMode 'add' branch and helpers
Every callsite passes consoleMode: 'update'. Deletes the field, the
unreachable 'add' branches in onBlockCompleted/onBlockError, and the
addConsoleEntry/addConsoleErrorEntry helpers that only the dead
branch invoked.
* fix(executor): reconcile finalBlockLogs on execution:completed
block:completed callbacks fire-and-forget; the last block's event can
arrive after execution:completed, leaving its console entry stuck
isRunning. Mirror the error/cancelled paths: emit finalBlockLogs on
execution:completed and reconcile + sweep on the client.
* fix(executor): emit finalBlockLogs on queued/HITL error and cancel paths
queued-workflow-execution and human-in-the-loop-manager only attached
finalBlockLogs to execution:completed. Without it on cancel/error,
reconcileFinalBlockLogs is a no-op and the client sweep flips
already-completed blocks to canceled. Mirror the route.ts pattern.
Vikhyath Mondreti