* feat(storage): native Google Cloud Storage support for self-hosting
Adds GCS as a third object-storage backend with full parity with S3 and
Azure Blob: uploads, streaming downloads, deletes, head, V4 signed URLs
(single + batch), and browser/server multipart uploads via the GCS XML
API. Selection precedence is Azure Blob > S3 > GCS > local disk.
- new provider client at lib/uploads/providers/gcs (cached singleton,
ADC/Workload Identity or inline GCS_CREDENTIALS_JSON auth)
- per-context GCS_*_BUCKET_NAME config wired through getStorageConfig
- shared getServeStoragePrefix() replaces hardcoded blob/s3 serve paths
- docs (object-storage, environment-variables), .env.example, helm
values.yaml + values-gcp.yaml storage section
* fix(storage): review round 1 — GCS per-context bucket fallback + ETag quote normalization
- getGcsConfig falls back to the general bucket for every context (GCS bucket
names are globally unique, so the S3-style sim-execution-files literal default
would point at an unowned bucket; empty per-context buckets previously made
uploads and downloads disagree)
- completeGcsMultipartUpload restores quotes on ETags stripped by the shared
browser upload client before building the completion XML
- docs/.env.example/helm updated for the fallback behavior
* fix(storage): review round 2 — route chat authz and execution-URL detection through getStorageConfig
- getChatStorageConfig delegates to getStorageConfig('chat') (identical for
S3/Azure, picks up the GCS general-bucket fallback instead of reading the
raw chat config and rejecting valid chat files)
- parse route resolves the execution bucket via getStorageConfig('execution')
for all providers, so GCS execution files in the fallback bucket are still
recognized as our own objects
* fix(storage): validation pass — gcs serve-prefix parity in key parsers + CORS doc fix
- extractStorageKey, extractFilename, and extractEmbeddedFileRef now strip the
gcs/ serve prefix like s3/ and blob/, so direct-uploaded files on GCS parse,
delete, download, and embed correctly (previously only the serve route knew
the prefix)
- file-download storageProvider union includes 'gcs'
- completeGcsMultipartUpload defensively rejects a 200 response carrying an
XML error document
- docs: CORS example lists concrete x-goog-meta-* header names (GCS matches
responseHeader entries exactly; wildcards are only supported for origin)
* improvement(checkout): enforce team/enterprise-only org subscriptions, block double-covered personal checkouts, and drop renewal-triggered workspace detach
* close race with personal pro / org inclusions
* address comments
* fix(billing): compute org coverage independently of the personal-sub lookup and fail closed on unverifiable plan writes
* feat(table): per-plan table dispatch concurrency with env overrides
* fix(table): enforce shared concurrencyKey cap on database batchEnqueueAndWait
* refactor(table): thread dispatch concurrency via invocation instead of persisting it
* improvement(table): collapse dispatch concurrency env vars to FREE/PAID
* improvement(ci): job timeouts everywhere, docs-only PR skip, event-scoped sticky disks, Node pin; drop dead i18n workflow
- timeout-minutes on every runnable job (defaults ran hung jobs to the
6-hour cap — the i18n workflow burned three full 6-hour runs in Feb
before its schedule was pulled)
- paths-ignore on the pull_request trigger: docs content and markdown
don't affect the app build or images; push runs stay unfiltered
- sticky-disk keys scoped by event name so fork PR runs never share a
disk with the push runs that feed production image builds
- node-version pinned to 22 (was 'latest', non-deterministic)
- delete i18n.yml: schedule already removed after repeated 6-hour hangs,
workflow_dispatch-only since, comments stale
* improvement(ci): 45m migrate timeout (covers 30m lock wait), fork-namespaced PR sticky disks
- migrate.ts waits up to 30 minutes for the migration advisory lock
(LOCK_ACQUIRE_DEADLINE_MS); the 15m job timeout would preempt that
designed wait, so the bound is 45m
- fork PRs now get their own sticky-disk namespace so an untrusted fork
run can't poison the disks that trusted internal-PR runs restore
* improvement(ci): promote superseded first-attempt runs forward
The stale-promotion guard skipped any run whose commit was no longer the
branch head. If commit A passed its gate but was superseded mid-run by
commit B, and B then failed tests, A's promotion was skipped and the
deploy tags stayed on pre-A code with no automatic recovery (Cursor
finding on #5712).
A first-attempt run promoting an ancestor of the branch head is always a
forward deploy — runs on a ref are serialized by the concurrency group,
so nothing newer can have promoted first. Only re-runs of superseded
commits (a rollback attempt) and force-pushed-away commits are skipped.
Same semantics applied to the GHCR latest-tag guard.
* fix(ci): grant contents:read to create-ghcr-manifests for the compare-API guard
Job-level permissions replace the workflow defaults, so packages:write
alone left the guard's compare call 403ing — STATUS=unknown would have
silently skipped the GHCR latest tags on every main push.
* feat(gitlab): add access, membership, and user-admin tools
Adds member, invitation, access-request, SAML group link, and user
administration tools to the GitLab integration. Resource-scoped ops work
against projects or groups; user-admin ops require an admin token. All tools
reuse the existing host/SSRF guard via getGitLabApiBase and add a shared
getGitLabResourcePath helper.
* feat(gitlab): wire access operations into the GitLab block
Adds the new operations to the block dropdown and tools access list, with a
named access-level dropdown (enum in, integer out), first-class expires_at,
a /members/all default (direct-only opt-in), resource-type selector, and
member_role_id passthrough.
* test(gitlab): cover access operations
Covers the access_level enum-to-integer coercion, the /members/all default vs
direct-only, the 409-duplicate-add soft success, invitation per-email error
handling, user-status-action response parsing, and getGitLabResourcePath.
* docs(gitlab): document access and membership operations
* Update apps/sim/blocks/blocks/gitlab.ts
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
* fix(gitlab): address review findings
- update_user now sends admin:false so the Administrator switch can demote
(an untouched switch stays undefined and leaves the flag unchanged)
- expose the access-level dropdown for Update Invitation
- normalize comma-separated invite emails so spaced multi-email input works
* fix(gitlab): make update-invitation access level optional
Update Invitation now uses a dedicated dropdown that defaults to 'Leave
unchanged', so updating only the expiration no longer silently resets the
invitation's access level to Developer. The level is sent only when explicitly
chosen.
* fix(gitlab): validation pass — SAML provider param, member/invitation query filter, moderation user guard, registry order
* fix(gitlab): apply 10-agent validation findings across all 62 tools
- MR draft flag now applied via Draft: title prefix (GitLab has no draft body param)
- update_user only sends admin when a real boolean (untouched switch serialized null and could demote admins)
- add_member 409 soft-success now verified against the conflict body
- auto_merge sent alongside deprecated merge_when_pipeline_succeeds
- job log capped at 200k chars, file content at 1M chars, with truncated outputs
- MR diffs signal hasMore beyond 100 files
- wire dropped params: update_issue milestoneId, MR milestone/squash/removeSourceBranch, pipelines ref, tree ref, branches search, commits since/until/path/author, update_file lastCommitId, jobs includeRetried, create_user forceRandomPassword
- complete pipeline/job status enums, access-level enums, widen stale type unions
- guards: update_invitation requires a change; create_user requires a password strategy
- fix double-encoding trap in path descriptions; doc-accuracy touch-ups
* fix(gitlab): review round 1 — dedicated no-default access level for update member, expiration clearing via explicit empty string
* fix(gitlab): explicit Clear Expiration toggle for update member/invitation
* feat(gitlab): expose full documented API surface across tools and block
- membership: add-by-username, remove-member cleanup flags, list-member filters (user_ids/state/seat info), invite_source
- listings: search/visibility/owned/membership, assignee/milestone filters, source/target branch filters, per-domain order-by + sort direction
- CI: pipeline variables + spec:inputs, manual-job variables
- repo: commit authoring (start branch, author, execute flag), release tag message + asset links, cross-fork compare + unidiff, internal notes
- catalog: access-governance template + member-provisioning and access-request-audit skills
- hardening from 3-agent validation: declared release params, tolerate single-object asset links, NaN guard on assignee filter, null/scalar JSON rejection
* fix(gitlab): tri-state controls for update-op booleans (executable flag, MR squash/remove-source-branch)
---------
Co-authored-by: Marcus Chandra <mzxchandra@gmail.com>
Co-authored-by: mzxchandra <129460234+mzxchandra@users.noreply.github.com>
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
* feat(scout): add scout agent
* fix(contracts): update contracts to include scout agent
* feat(copilot): search agent (research+scout merge) + read-only table/KB tool handlers
Mirrors mothership dev f90f9b05:
- regenerated tool-catalog/tool-schemas mirrors (search trigger replaces
research + scout; QueryUserTable / SearchKnowledgeBase entries)
- queryUserTableServerTool / searchKnowledgeBaseServerTool: read-only
wrappers delegating to the full user_table / knowledge_base handlers with
hard operation allowlists (and outputPath export rejection on
query_user_table)
- display maps: 'search' agent label/title/icon added; research + scout
entries retained so historical transcripts keep rendering
- Search.id replaces Research.id in LONG_RUNNING_TOOL_IDS (it inherits
research's long crawls)
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat(copilot): run_code compute-only handler; docs lint fix
Mirrors mothership dev db60da94: run_code is the compute-only variant of
function_execute for the search agent — same sandbox and inputs, no
outputs.files / outputTable, so it cannot create or overwrite workspace
resources. Wrapper handler hard-rejects the write vectors and delegates to
executeFunctionExecute; run_code is deliberately absent from
OUTPUT_PATH_TOOLS and the table output post-processor, so the name gating
blocks writes even for leaked args. Added to LONG_RUNNING_TOOL_IDS,
display title/icon maps, and the regenerated catalog/schema mirrors.
Also removes two ineffective biome suppression comments in the docs
workflow-preview (the rule doesn't fire in the docs app config).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(copilot): failed tool calls must surface their error in terminal data
A failed handler result that carried a defined-but-empty output (the
app-tool executor's 'Tool not found' ships output: {}) won the priority
race in getToolCallTerminalData, so the resume payload's data — the only
thing the model reads — was a bare {} with the error text dropped. The
search agent retried run_code 20+ times blind against a stale server
because every failure rendered as empty instead of 'Tool not found'.
Failed calls now always carry error in their terminal data: merged into
object outputs, wrapped alongside non-object outputs, preserved when the
output already has an error field.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat(chat): render inline question tags from the agent in chat
* fix(chat): let inert multi-step questions browse all prompts
* improvement(chat): guard question answer formatting against sparse arrays
* chore(copilot): drop user_memory from generated contracts and tool display
Companion to mothership 8ae32e97 (user_memory tool removed — the feature no
longer exists). Regenerates the mothership contract mirrors via
generate-mship-contracts.ts, which also picks up the pending telemetry
contract additions (gen_ai.agent.name labels, llm.client.context_tokens,
llm.client.compactions, llm.request.compaction_trigger, llm.compaction.pause,
gen_ai.usage.context_tokens), and removes the user_memory display title.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* improvement(chat): answered question card becomes the user turn; two select types only
UI ordering: answering a question card no longer echoes a duplicate user
bubble. The combined answer still goes on the wire as a user message, but the
chat pairs it back to its card (strict 'Prompt — Answer' match, now uniform
for single questions too) and renders the card as the answered recap — the
card IS the user turn, and the next assistant message streams below it. The
pairing is derived from the transcript, so live and reloaded renders are
identical; a dismissed card followed by an unrelated typed message does not
match and renders normally. Messages ending with a question card also drop
the copy/thumbs actions row — the card is an input surface, not a reactable
assistant turn.
Question types are now single_select and multi_select only: text is removed
(the free-text 'Something else' row covers it) and confirm collapses into
single_select with Yes/No options. multi_select rows toggle with a check and
the free-text row's arrow submits the step; answers are comma-joined labels
plus any typed entry. Agent-supplied catch-all options ('Other', 'Something
else', 'None of the above') are stripped at parse — the card always provides
its own free-text row; a question left with no real options is invalid.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* improvement(chat): question cards are single_select only
Removes multi_select (and its toggle/check UI). The card is one shape: pick
one option or type into the always-present 'Something else' row. Catch-all
stripping and the transcript pairing/recap behavior are unchanged.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* improvement(chat): bring back multi_select question cards
Re-adds multi_select with a reworked interaction: option rows carry real
checkboxes (emcn Checkbox chrome) instead of numbers and arrows, an
option-styled Submit row confirms the step, and the "Something else" row
reads as a plain option until clicked — then it becomes the focused text
box, auto-checks, and can be unchecked without losing the typed text
(blur with nothing typed reverts it). single_select behavior, catch-all
stripping, and the transcript pairing/recap format are unchanged;
multi_select answers are the checked labels comma-joined.
* chore(copilot): regenerate mothership contract mirror (chat blob span attrs)
* chore(copilot): regenerate mothership contract mirror (chat blob metrics)
* feat(secrets): make output of generate api key a secret
* feat(cli): add mkdir, mv, cp to mship tool set
* feat(fork-chat): add fork chat to mothership
* fix(fork-chat): fix messageid handling in fork chat
* feat(credentials): agent-initiated oauth credential reconnect (#5488)
* feat(credentials): agent-initiated oauth credential reconnect
* fix(credentials): address reconnect review findings
* improvement(credentials): log when connect draft name lookups degrade
* fix(conflicts): remove migration
* fix(conflicts): fix conflicts
* fix(fork-chat): add migrations back
* fix(ci): fix lint
* fix(ci): fix bad import
* fix(vfs): fix 500 char limit in vfs for skills and custom tools
* feat(copilot): gate user skills to explicit slash-attach (#5536)
Stop the mothership from adopting a workspace user-skill on its own:
- Remove the load_user_skill tool and its three payload callers (chat
payload, mothership execute route, inbox executor); delete
lib/mothership/skills.ts + its test. Skills no longer autoload as the
agent's own instructions.
- Rename the workspace "## Skills" inventory to "## Agent Block Skills
— NOT FOR YOU" with a one-line guardrail so a skill's description
(e.g. "respond like a pirate") is not treated as an instruction.
Skills reach the model as behavior only via explicit /-attach.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat(lots-of-things): lots of things
* feat(subagents): add persistent subagents
* fix(copilot): let edit_workflow set knowledge-base tag filters, and stop it clearing them (#5546)
* fix(copilot): persist KB tag subblocks as JSON strings from edit_workflow
The edit_workflow tool normalizes array-with-id subblocks (via
normalizeArrayWithIds) but only re-stringifies the keys listed in
JSON_STRING_SUBBLOCK_KEYS. `tagFilters` (knowledge-tag-filters) and
`documentTags` (document-tag-entry) were missing, so agent-authored tag
filters were stored as raw JSON arrays while those UI components read
their value with JSON.parse (expecting a string). The result: an agent
edit to a Knowledge block's tag filter persisted correctly but rendered
as an empty filter in the editor (JSON.parse on an array throws -> []).
- Add `tagFilters` and `documentTags` to JSON_STRING_SUBBLOCK_KEYS so
edit_workflow stores them in the same shape the UI writes.
- Make both components' parsers tolerate an already-parsed array on read,
self-healing values already persisted in the broken (array) shape.
Search execution was unaffected (parseTagFilters accepts arrays), so the
value was never lost — only the editor render and round-trip were broken.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat(copilot): expose KB tag definitions in VFS meta.json
Surface each knowledge base's defined tags (displayName -> tagSlot) inline in
its meta.json via serializeKBMeta, loaded in one batched query
(loadKbTagDefinitions), so the agent can bind a knowledge-tag filter to a real
tag slot instead of guessing a tag name it cannot otherwise see.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(copilot): stringify KB tag subblocks on the nested-node edit path
The nested-node merge path normalized array-with-id subblocks but never
re-serialized the JSON_STRING_SUBBLOCK_KEYS, so editing a block nested in a
loop/parallel container still persisted tagFilters/documentTags (and
conditions/routes) as raw arrays -- the exact shape the subblock components
cannot JSON.parse.
Route all four write paths through a single normalizeSubblockValue helper so
the normalize and re-stringify steps cannot drift apart again, and extract the
duplicated string-or-array read logic into parseJsonArrayValue.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* refactor(copilot): tighten subblock serialization helpers
Derive KbTagDefinitionSummary from the canonical TagDefinition instead of
restating its fields, make parseJsonArrayValue generic so callers drop their
`as T[]` casts, and unexport the three builders helpers that no longer have
consumers outside the module now that normalizeSubblockValue fronts them.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(copilot): stop stripping tagFilters/documentTags from the agent's workflow view
sanitizeForCopilot dropped `tagFilters` and `documentTags` from the workflow state the
agent reads (workflows/{name}/state.json), while edit_workflow is allowed to write both.
The field was therefore write-only: on a follow-up edit the agent read back an absent
field, concluded no filter was set, and cleared the user's tag filter.
The redaction was introduced for workflow *export* (#1628) and is already enforced there
by sanitizeWorkflowForSharing's key list. The duplicate in the copilot-only
sanitizeSubBlocks was redundant for export and destructive for the agent. Removes it and
pins the contract with a regression test.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(copilot): reject malformed KB tag values instead of clearing the filter
`knowledge-tag-filters` and `document-tag-entry` had no arm in the
`edit_workflow` input validator, so they fell through to the pass-through
default. Any non-array value the agent supplied -- a double-encoded JSON
string, an object, an unparseable string -- reached `normalizeSubblockValue`,
where `normalizeArrayWithIds` coerces unparseable input to `[]`. The write
path then persisted `"[]"` over the tag filter the user had configured.
`condition-input` and `router-input` already guard against exactly this and
return an actionable error to the model. Extend that arm to cover the two KB
subblock types. It keys on subblock type, so the unrelated `tagFilters`
short-input on the Algolia block is unaffected. `null`/`undefined` and empty
arrays still clear the field, so intentional clears keep working.
Also wrap `loadKbTagDefinitions` in try/catch. Tag definitions are an optional
meta.json enrichment, but the query ran inside the top-level `Promise.all`, so
a transient failure would reject the entire workspace VFS materialize and
leave the agent unable to read any file. Now it degrades to a meta.json
without tag definitions, matching the sibling materializers.
Adds regression tests for both, plus the first tests for
`parseJsonArrayValue`, the helper that keeps pre-fix raw-array rows readable.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* refactor(copilot): collapse duplicate JSON-array parsing in edit-workflow builders
`normalizeArrayWithIds` and `normalizeConditionRouterIds` each hand-rolled the
same "accept a raw array or the JSON string these subblocks persist" parse.
Extract `parseJsonArray`, which returns null when the value is neither, so each
caller keeps its own distinct fallback: `[]` for the former, the untouched
original value for the latter.
Behavior-preserving. An empty array is truthy, so `[]` and `"[]"` still parse
through rather than hitting either fallback.
`validation.ts` has a third copy, but `builders.ts` already imports from it, so
sharing the helper across the two would introduce an import cycle. Left as is.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat(copilot): specify tag name and legal operators in KB meta.json
`tagDefinitions` exposed `displayName`, but a `tagFilters` entry must carry the
key `tagName`. An entry written with `displayName` passes validation and
persists, then filters nothing -- a silent failure. Rename the field at the
serializer boundary; the DB column is untouched.
Also emit the operators legal for each tag's `fieldType`, reusing
`getOperatorsForFieldType`. `between` is valid for number and date but not for
text or boolean, and the agent has no way to infer that. An unrecognized
fieldType yields an empty list rather than throwing.
Still unspecified, and deliberately out of scope: a filter entry's value key is
`tagValue` (but `value` on documentTags), and `between` needs `valueTo`. Those
describe the subblock entry shape, not the knowledge base, so meta.json is the
wrong place for them.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(copilot): pass a nullish subblock clear through instead of serializing "[]"
`validateValueForSubBlockType` accepts null as an explicit clear, but
`normalizeSubblockValue` then ran it through `normalizeArrayWithIds`, which
coerces any non-array to `[]`, and persisted the string "[]".
No data is lost either way -- "[]" and an absent field both mean "no filters".
But it left the field present when the caller asked for it to be unset, so
`sanitizeForCopilot` showed the agent an empty filter rather than an absent
one, contradicting the absent-means-unset invariant the sanitizer documents.
It also made Algolia's `if (params.tagFilters)` see a set value, since "[]" is
truthy.
An explicitly empty array still serializes to "[]" -- clearing with a value is
distinct from clearing by omission.
Reported by Cursor Bugbot on #5546.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat(changes): huge changes
* fix(subagents): lanes
* fix(mship): transcript stuff
* fix(subagents): thinking lanes
* fix(superagent): fix superagent tools and checkpoints
* fix(scope): scope subagent tools
* fix(lint): fix lint
* chore(db): regenerate workspace_files.message_id migration as 0260 on staging base
* fix(superagent): fix superagent integration tools
* improvement(questions): make something else a placeholder
* chore(copilot): regenerate mothership contract mirror after staging rebase
* feat(mship): add external mcps to mship
* fix(ci): fix dev build
* fix(stream): show thinking text
* fix(ci): force redeploy
* fix(mothership): keep chat forks outside workspace storage billing
Preserve the product invariant that Mothership chat files are not charged as workspace file storage after the billing storage merge.
* fix(uploads): restore listWorkspaceFiles throwOnError option dropped in rebase
* fix(subagent-streaming): remove italics
* fix(mothership): treat subagent lanes closed by subagent_end as settled so the between-steps thinking indicator isn't suppressed
* fix(ui): thinking loader and rool names
* fix(ui): add file
* fix(thinking): show thinking during subagents
* fix(chat): drop dead thinking-channel ternary after lanes skip thinking blocks
* fix(thinking): remove thinking text
* improvement(function execute): add timeout to function execute and stop showing text in subagents
* fix(subagents): hide thinking text
* fix(ff): move ff to go
* improvement(superagent): nuke superagent
* feat(main-agent): superagent into main agent
* chore(db): regenerate workspace_files.message_id migration as 0262 on staging base
* fix(credentials): restore reconnect params on shared createConnectDraft
* fix(migrations): rebase with staging
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: Emir Karabeg <emirkarabeg@berkeley.edu>
Co-authored-by: Justin Blumencranz <96924014+j15z@users.noreply.github.com>
Co-authored-by: Vikhyath Mondreti <vikhyath@simstudio.ai>
* feat(rocketlane): Rocketlane integration — 64 tools across projects, tasks, phases, fields, time tracking, spaces, and invoices
* fix(rocketlane): allow clearing optional fields on update, require a user reference for time-off and placeholder assignment
* chore(rocketlane): trigger fresh review round
* fix(rocketlane): require an owner reference when creating a project, matching the API contract
Second service-account kind (follow-up to #5682): client-credential pairs
(client ID + secret + org identifier) that mint short-lived tokens at
execution — in-memory cache with ciphertext-fingerprint validation
(rotation-correct across instances), single-flight coalescing, 30s failure
memo, no refresh-token storage.
- Zoom Server-to-Server OAuth, Box Client Credentials Grant, and Salesforce
client-credentials (integration user) are the first minters; Salesforce's
live instance_url rides the existing instanceUrl plumbing so all 40 tools
work unchanged
- Pipedrive lands as a token-paste provider with explicit authStyle
threading: descriptor declares x-api-token, one shared header helper drives
all 18 tools + both selector routes, OAuth Bearer behavior untouched
- SSRF-allowlisted Salesforce My Domain host (production/sandbox/developer
partitioned domains); ENOTFOUND maps to site_not_found, EAI_AGAIN stays
provider_unavailable; 408/429 from token endpoints never blamed on creds
- Create route forwards clientId/clientSecret/orgId to the builder, pinned by
a route-level regression test
- Zoom user-scoped tools document that server-to-server tokens don't support
'me'
- 4 setup-guide docs pages verified against current vendor flows (incl.
Salesforce External Client Apps — the classic Connected App wizard is
disabled by default since Spring '26); integrations sidebar gains a Service
Accounts & API Keys section
* feat(clickup): add ClickUp integration with OAuth + API-token auth, 23 tools, block, and attachment upload
- 23 tools covering tasks (create/get/update/delete/list/search), comments
(create/get/update/delete), attachment upload, tags, members, custom
fields, and the workspace/space/folder/list hierarchy
- OAuth provider wiring (authorization-code flow, non-expiring tokens) plus
clickup-service-account token-paste credential (personal pk_ API tokens),
with a shared clickupAuthorizationHeader helper (pk_ tokens sent bare,
OAuth tokens as Bearer)
- File upload follows the internal-route pattern: contract-validated
/api/tools/clickup/upload-attachment builds the multipart form and
returns UserFiles
- ClickUp block with per-operation subBlocks, canonical file param,
BlockMeta templates/skills, and gradient brand icon
- Generated integration docs page + hand-written service-account guide
* fix(clickup): apply validation-audit fixes across tools, block, and upload route
- Map documented task fields that were dropped: markdown_description,
subtasks, watchers, custom_fields, time_spent, folder, space — making
the include_subtasks / include_markdown_description options observable
- Expand verified filters: assignees/tags/due-date ranges on get_tasks and
search_tasks, include_closed on search_tasks; add due_date_time /
start_date_time flags and update-task assignee add/remove
- Guard update_comment against an empty body and require comment text in
the block; prefer markdown_content over content on create_list and make
markdown reachable for lists in the UI
- Drop the unverified 'required' field from custom-field outputs; read
both err and error keys from ClickUp error bodies; correct notify_all
wording
- Upload route: 100MB size cap, shared attachment mapper with full
documented response fields (version, thumbnails), base-URL constant
* fix(docs): restore clickup-service-account guide and shield it from doc generation
The generator prunes integration pages it does not derive from blocks;
add the hand-written ClickUp API-token guide to
HANDWRITTEN_INTEGRATION_DOCS so regeneration cannot delete it.
* fix(clickup): address review findings — dedupe catalog entries, config-time list parent validation, upload memory cap, unique icon gradient ids
- Remove duplicated clickup entries in docs meta.json and integrations.json
introduced by a double docs regeneration
- Add a Location dropdown for Get Lists / Create List so the folder ID or
space ID is conditionally required at configuration time instead of
failing at run time
- Pass the 100MB cap into downloadServableFileFromStorage so oversized
files abort during download instead of after full buffering
- Use useId()-derived SVG gradient ids for ClickUpIcon in both icon files
* chore(clickup): format integrations.json entry per biome
* improvement(clickup): final validation-pass refinements across tools and block
- create_task: add doc-backed sprint points param (parity with update)
- get_tasks/search_tasks: expose include_markdown_description
- update_task legacy numeric priority in list responses mapped instead of
dropped; create_comment omits absent response fields instead of
emitting sentinel ''/0 values
- order_by only sent when explicitly chosen (Default sentinel); comment
text no longer UI-required for update_comment (resolve-only and
assignee-only updates are valid per the tool contract, which still
rejects an empty body)
- add_tag_to_task sends no request body per docs; upload tool tolerates
non-JSON error responses
* fix(clickup): tolerate nested user wrapper in member mapping
The task/list member endpoints document a flat member object; accept the
workspace-members-style nested { user: {...} } wrapper as well so both
shapes map correctly.
* fix(clickup): map size-limit errors from download/compile to a 400 upload-size response
downloadServableFileFromStorage enforces maxBytes on both the raw download
and the resolved (compiled) artifact via PayloadSizeLimitError; catch it in
the route so oversized content returns the intended 400 instead of
bubbling to the generic 500 handler.
* feat(clickup): add custom field values, checklists, and time tracking (15 tools, 38 total)
- Set/remove custom field values on tasks (PUT/DELETE /task/{id}/field/{field_id});
block value input parses JSON for structured field types, plain values pass through
- Checklist CRUD: create/rename/reorder/delete checklists and create/update/
delete checklist items (assign, resolve, nest), mapped from the documented
{checklist} response shape
- Time tracking: list entries in a date range (assignee/location filters,
task-tag and location-name includes), create/update/delete entries, start/
stop timers, and read the currently running timer; entries mapped from the
documented data envelope with negative-duration running semantics
- Block gains 15 operations with conditionally-required fields, timestamp
wand configs, tri-state billable/resolved dropdowns, and a single-location
filter selector matching the API's one-location-filter rule
* fix(clickup): new-tools audit fixes — POST for set custom field value, tolerant time-entry envelopes, richer mappings
- Set Custom Field Value uses POST per the live reference OpenAPI (the
llms mirror shows PUT; the reference console spec is authoritative)
- delete_time_entry maps the documented array envelope; create_time_entry
tolerates both data-wrapped and flat echo bodies
- Time entries surface task_tags and task_location so the include switches
are observable; checklists carry date_created
- Custom field value input parses any JSON literal (numbers, booleans,
arrays, objects) and passes plain text through
- Update Time Entry supports duration edits; single-assignee time ops get
their own field so a comma-separated list can't silently NaN out
* fix(clickup): send explicit date-time flags whenever a date is set
The due/start date-time switches previously only transmitted true; a
timed date could never be flipped back to date-only. The flag is now sent
as an explicit boolean whenever the corresponding date is provided and
omitted otherwise.
* improvement(clickup): final per-tool audit polish — checklist item children, tolerant comment date
- Checklist items surface the documented children array of nested item IDs
- create_comment tolerates a string-typed date in the response
* fix(clickup): reject empty update_task bodies with a clear local error, matching sibling update tools
* fix(babysit): resolve merge conflicts against staging during the review loop
* fix(babysit): trim merge-conflict handling to essentials
* fix(babysit): gate conflict-resolution pushes and handle UNKNOWN mergeable
* fix(babysit): bound persistent UNKNOWN mergeable state and clarify step skip
* fix(babysit): merge instead of rebase to resolve conflicts, drop force-with-lease
* fix(babysit): don't skip pending review findings when resolving a merge conflict
* fix(babysit): spot-check commit hygiene before a merge-conflict push
* fix(babysit): commit merge-conflict fixes before pushing, bound UNKNOWN before waiting
* fix(babysit): run pre-push checks before committing the merge-conflict fix
* fix(babysit): bound persistent CONFLICTING state and fix pre-push check order
* fix(babysit): reconcile hard rule with step 2's merge-conflict sync exception
* fix(babysit): page all review threads before branching on mergeable state
* fix(babysit): cut merge-conflict handling down to the essentials
* fix(babysit): simplify merge-conflict handling to a minimal step
* improvement(ci): decouple image builds from the test gate
- build-amd64 now starts immediately and pushes only sha tags (ECR :sha,
GHCR :sha-amd64). The EventBridge deploy triggers filter on exactly the
latest/staging/dev ECR tags, so nothing deploys from these pushes.
- New promote-images job retags sha -> latest/staging (and GHCR
latest-amd64/version-amd64) via buildx imagetools once tests and
migrations pass — a seconds-long manifest copy instead of rebuilding
after the gate. Cuts push-to-deploy from ~13.5 to ~7 minutes.
- Split the Next.js production build out of test-build into a parallel
Build App job with its own sticky-disk keys, cutting PR feedback from
~5.5 to ~3.5 minutes.
- create-ghcr-manifests and process-docs now gate on promote-images.
* improvement(ci): harden promotion — atomic retag, stale-run guards, gate all mutable GHCR tags
Review follow-ups:
- promote-images is a single job (not a matrix): verifies all four :sha
manifests exist before moving any deploy tag, so a missing image can't
cause a partial mixed-version deploy
- stale-run guard on promote-images and create-ghcr-manifests: re-running
an old run no longer retags latest/staging back to stale code (a
one-click prod rollback); superseded runs skip mutable tags with a
warning while immutable sha/version tags still publish
- ARM64 build now pushes only the immutable :sha-arm64 tag; latest-arm64
and version tags moved behind the gate into create-ghcr-manifests
(closes the pre-existing hole where a failing run moved latest-arm64)
- dropped dead detect-version needs from both build jobs
- sticky-disk comment corrected (clone + last-writer-wins, not exclusive
mounts); build job shares warm bun/node_modules disks, keeps its own
turbo cache key so test/build entries don't evict each other
* chore(pii): remove GLiNER/GPU image + add spaCy-skip fast path to CPU server
* feat(pii): restrict block-output redaction to regex-only entities
* fix(pii): derive spaCy-NER set from registry + skip fast path when score_threshold set
* fix(pii): include ORGANIZATION in app-side NER set (align with server)
* feat(instagram): add Instagram Login OAuth, tools, and block
* feat(instagram): add Gmail-style media uploads for publish ops
Resolve UserFiles to Meta-fetchable presigned HTTPS URLs (600s TTL) via
internal publish routes, and fix OAuth scope storage plus connect-draft
wiring so Instagram Login publishing is testable end-to-end.
Co-authored-by: Cursor <cursoragent@cursor.com>
* refactor(instagram): simplify messaging tools to direct requests, clean up types
* fix(instagram): parallelize carousel child polling, enforce 2-10 items, extend poll window and insights periods, use canonical user_id in OAuth callback
* fix(instagram): resolve user id from user_id only, accept numeric user_id
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(instagram): use form/query params for publish and comment endpoints, request message timestamps explicitly
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(instagram): normalize Graph ID outputs to strings so downstream .trim() calls are safe
Co-authored-by: Cursor <cursoragent@cursor.com>
* style(instagram): use brand gradient tile for the block icon
Match the official Instagram look by filling the tile with the orange–pink–purple radial gradient so the white camera glyph sits on a full-bleed brand background.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(instagram): tighten publish defaults and cloud-storage upload UX
Default Reel share-to-feed to Yes, drop unused media fields params, share publish transform helpers, and warn when cloud storage is missing for Meta-fetchable uploads.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(instagram): fail closed when cloud storage status is unknown
Treat loading/error as blocked for requiresCloudStorage uploads, show the warning once the check finishes, and disable selecting local workspace files Meta cannot fetch.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(instagram): proactively refresh long-lived tokens before expiry
Meta only allows refreshing still-valid Instagram tokens, so refresh within 14 days of expiry (after the 24h age gate) instead of waiting until after accessTokenExpiresAt.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(oauth): restore TikTok clientIdParamName JSDoc after merge
The staging merge dropped the opening /** on ProviderAuthConfig.clientIdParamName, which broke TypeScript parse in CI.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(api): Zod-contract storage-status and ratchet validation baseline
Wire /api/files/storage-status through a shared route contract so the
strict API validation audit stays at zero non-Zod routes after the new
Instagram cloud-storage check.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(instagram): match Gmail advanced media placeholders
Drop public-URL paste hints from advanced fields and the cloud-storage banner so the UI mirrors Gmail attachments.
Co-authored-by: Cursor <cursoragent@cursor.com>
* code review + hide from toolbar
* address comments
* fix(instagram): drop hidden Instagram from OAuth catalog pin test
Instagram is hideFromToolbar so it is excluded from integrations.json;
the pinned slug map must not expect it until the block is visible again.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(instagram): validate client ID before creating connect draft
Avoid orphan pending credential drafts when INSTAGRAM_CLIENT_ID is missing,
matching the Shopify authorize ordering.
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: Bill Leoutsakos <billleoutsakos@Bills-MacBook-Pro.local>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Vikhyath Mondreti <vikhyath@simstudio.ai>
* improvement(landing): SEO copy and metadata rewrite across marketing pages
* improvement(landing): remove em dashes from marketing copy
* fix(landing): name Sim in the knowledge base H1
* fix(workspace): recover from stale sessions instead of blank loader after impersonation
* fix(workspace): gate stale-session recovery on auth state and surface failed sign-out
* fix(workspace): proceed with redirect when session query errors but cached identity exists
* feat(credentials): token-paste service accounts for 12 providers (HubSpot, Airtable, Notion, Asana, Attio, Linear, monday, Shopify, Webflow, Trello, Cal.com, Wealthbox)
* refactor(credentials): registry-dispatch service accounts + doc-verified validator hardening
- Migrate Google/Atlassian/Slack service-account branches to the same
registry pattern as token-paste providers (builder + resolver maps,
unified required-fields contract validation)
- Fix Shopify service-account store domain never reaching tool URL builders
- Linear: rate-limit 400s no longer mislabeled as invalid credentials;
validation header matches runtime header rule
- Trello: server API key rejection no longer blamed on customer token
- Fleet-wide: network errors and non-JSON provider bodies map to
provider_unavailable via shared fetchProvider/parseProviderJson
- HubSpot: drop regional-host displayName upgrade; Wealthbox: explicit 402;
monday: provider-side GraphQL errors mapped correctly; Attio: null-body guard
* polish(credentials): ship-gate fixes, setup-guide docs, and lint pass for token service accounts
- 12 setup-guide docs pages (docs.sim.ai/integrations/<provider>-service-account)
incl. the Trello authorize-link flow the integration depends on
- Attio: HTTP 400 on /v2/self maps to invalid_credentials (live-verified)
- monday: scan all GraphQL errors for provider-side codes; no empty audit ids
- Compile-time descriptor/validator lockstep (typed registry) and
prototype-safe provider-id guard (Object.hasOwn)
- Shared errors.test.ts pinning fetchProvider/parseProviderJson/
throwForProviderResponse guarantees for all validators
- Stale TSDoc updated after the registry migration; biome organizeImports pass
* docs(credentials): vendor-doc accuracy pass on service-account setup guides
34 corrections from a 12-agent audit against live official vendor docs:
current HubSpot Development-area nav, Notion connections rename, monday
Developer Center paths, Shopify legacy-vs-Dev-Dashboard token flows, and
hedged wording for claims vendors do not document (expiry, limits)
* improvement(credentials): vendor-accurate credential nouns on connect surfaces
'Add service account' only where the vendor actually has service accounts
(Google, Atlassian); token-paste providers now use their own vocabulary via a
connectNoun descriptor field — 'Add private app token' (HubSpot), 'Add API key'
(Attio/Linear/Cal.com), 'Add personal access token' (Airtable), etc. Docs page
titles updated to match; slugs and internal provider ids unchanged
* fix(credentials): classify auth-shaped Shopify GraphQL errors as invalid credentials
Shopify can reject invalid or revoked shpat_ tokens with HTTP 200 and a
GraphQL error body instead of a 401; those now map to invalid_credentials
instead of a provider-outage message
* fix(credentials): empirically-grounded HubSpot token verification
Live probing showed the documented access-token-info route returns a bare
404 for unrecognized tokens (ambiguous with a missing route), so 404/400
now falls back to the Account Information API, which answers with a JSON
401 for rejected tokens and 200/403 for live ones — verified against the
real endpoints
* fix(credentials): review-round-2 fixes for service-account edge cases
- Shopify tools prefer the credential-validated store domain over the
block's auto-detected shopDomain (a store-bound token must hit its own store)
- Unknown non-empty service-account providerIds are rejected instead of
silently persisting as google-service-account (empty stays the legacy
Google fallback)
- Shopify/modal domain normalization strips URL paths ('https://x.myshopify.com/admin')
- monday: warning-class GraphQL errors no longer reject a token whose me
data proves it authenticated
* chore(credentials): format shopify validator test
* fix(credentials): cold-review hardening pass
- Object.hasOwn guards on all provider-id registry lookups (crafted
'__proto__'/'constructor' providerIds now 400 instead of 500) + regression test
- fetchProvider gets a 10s AbortSignal.timeout so a hung provider can't pin
the create/reconnect request
- HubSpot: unexpected 403 on the token-info route defers to the account-info
fallback instead of blaming the token
- Linear selector routes use the SDK apiKey option for lin_api_ keys (bare
header parity with the tools sweep)
- Docs: UI steps aligned to the vendor-noun connect labels; HubSpot
scope-propagation claims softened; Trello in-product-link promise corrected
* fix(docs): remove Ask AI widget
* improvement(landing): add visible FAQ schema, fix SEO redirects and Organization schema
- Move existing plain-markdown FAQ sections in 8 library posts + emcn blog
into the faq frontmatter array so they emit FAQPage JSON-LD (previously
visible text with zero structured data)
- Add new, fact-checked FAQ content to the 8 posts with none: openai-vs-n8n-vs-sim,
v0-5, enterprise, copilot, executor, multiplayer, mothership, series-a
- Add sales ContactPoint to the site-wide Organization schema
- Add 301 redirects for legitimate crawler/dead-link 404s (/$, /&, /Sim,
/homepage, /logo, /en-US) surfaced by an external SEO audit; left out
bot-noise paths, already-fixed OG image 404s (#5636), and *.sim.ai
customer chat subdomains that need manual DB verification, not a
blanket redirect
* revert(docs): restore Ask AI widget
Ask AI removal is a separate change, out of scope for this PR — restoring
the component, chat panel, api/chat route, and its deps to their
pre-existing state.
* fix(content): correct stale/mislabeled competitor facts surfaced in FAQ audit
- n8n's license is "fair-code" (n8n's own coined term), not "fair-use" —
a different legal concept entirely; fixed 4 occurrences
- Activepieces' integration count is 750+ per their live catalog, not the
280+ figure carried over from an older snapshot; fixed 4 occurrences
across best-zapier-alternatives and n8n-alternatives
* feat(landing): extend enterprise product-preview design to solutions and workflows pages
Parametrize enterprise feature graphics with content props and retell each
solutions page's feature blocs for its domain (engineering, it, compliance,
finance, hr) plus the workflows platform page. Add five new graphics in the
same visual vocabulary, animated platform-UI heroes with domain-specific
loops on all six pages, hero category tags, container-query proportional
tile scaling with wide/2x2 layout options, and a shared pre-footer CTA band.
Enterprise page renders identically.
Co-authored-by: Cursor <cursoragent@cursor.com>
* feat(landing): surface Platform and Solutions menus in top nav
Renders PLATFORM_MENU and SOLUTIONS_MENU alongside Resources (Platform,
Solutions, Resources trigger order), drops the internal-only Mothership
item, centers the five-item Platform panel's two-tile last row, and lets
the mobile sheet scroll now that all three sections outgrow a phone
viewport.
Co-authored-by: Cursor <cursoragent@cursor.com>
* feat(landing): add scheduled tasks page and nav item
Adds the /scheduled-tasks landing page (SolutionsPage consumer with a
chat-free schedule-trigger editor hero and enterprise feature tiles
retold for recurring runs) and a sixth Scheduled Tasks item in the
Platform menu, restoring the clean 3x2 grid.
Co-authored-by: Cursor <cursoragent@cursor.com>
* feat(landing): add knowledge, tables, files, and logs platform pages
Completes the Platform nav dropdown — its knowledge, tables, files, and
logs items previously 404'd. Each page is a SolutionsPage consumer with a
product-UI hero loop, enterprise-style feature tiles, CTA band, and SEO
metadata. Removes the dead platform-page component family (workflows was
its last consumer) and adds the new routes to the sitemap.
Co-authored-by: Cursor <cursoragent@cursor.com>
* refactor(landing): consolidate hero-loop engine and code-window graphics, drop dead variant surface
- Extract shared useDesignScale + useMotionSafeCycle hooks and a HeroLoopShell
so all seven hero loops share one scale/reduced-motion clock engine
- Merge workflows-editor-loop and scheduled-tasks-hero-loop into one
parameterized shared EditorLoop (content-injection, same pattern as
EnterpriseLoopContent)
- Consolidate the four identical code-window feature graphics into one shared
CodeWindowGraphic + single CSS module; pages keep thin data wrappers
- Remove the unreachable 'split'/'standard'/align variant surface from
SolutionsPage/SolutionsCardRow/SolutionsCard and trim unused barrel re-exports
- Enterprise hero now consumes the shared PlatformHeroVisual instead of an
inline byte-identical copy
- Add /scheduled-tasks to the sitemap
- a11y: closed mobile-nav sheet is now invisible (out of tab order) with
aria-controls wiring; decorative tables-hero checkboxes are no longer
keyboard-focusable
- memo() the static EnterpriseSidebar; hoist per-render header arrays; remove
comments that restated component TSDoc
* fix(landing): highlight Scheduled tasks in the scheduled-tasks hero sidebar
Thread activeNav through the shared EditorLoop content so the
scheduled-tasks hero highlights its own module row, matching the other
platform heroes.
* chore(landing): drop spacing constants orphaned by the variant removal
Remove the now-unconsumed cardRowHeaderStack/cardRowHeaderCtaGap/
cardTextToVisual/rowSubtitle constants, fix a stale cardVariant TSDoc
reference, and restore import order in the workflows editor-loop wrapper.
* chore(landing): single-source RESET_FADE_MS and drop the unused card frame size
RESET_FADE_MS now lives only in the shared loop-engine hook module; the
enterprise stage-data copy is removed. SolutionsVisualFrame loses its
size prop and cardHeight constant - only the 16:9 hero preset remained
in use after the split-variant removal.
* fix(landing): make the knowledge-answer question bubble visible on light tiles
The frameless vignette sits directly on the tile's --surface-3 fill, so
the build tile's --surface-3 bubble treatment vanished. The question
chip now uses the graphic family's white card chrome (--white fill,
--border-1 hairline), matching its own source card. Also restores
biome's import order in the workflows editor-loop wrapper (fixes the
failing lint:check CI step).
* chore(landing): share one ZipIcon across the files preview and files hero
Extract the duplicated zip-archive SVG into components/shared/zip-icon
and consume it from both the homepage files preview and the files hero
loop.
---------
Co-authored-by: andresdjasso <andresdjasso@users.noreply.github.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Waleed Latif <walif6@gmail.com>
* fix(tools): resolve {{ENV_VAR}} references in user-only params for copilot tool executions
Chat-invoked integration tools with API-key auth have been broken since the
mothership tool-dispatch rewrite (#4090) removed the orchestrator's env
reference resolution. Agents pass {{VAR}} references (the VFS exposes env var
names only), and the literal placeholder was sent to the provider, producing
auth failures like Sentry's 401 Invalid token.
Resolution is deliberately narrower than the removed deep resolver: only
whole-value references on params declared visibility user-only, gated to
copilot executions, resolving against the same personal+workspace env merge
workflow runs use. LLM-writable params (urls, headers, bodies) never resolve,
so references cannot be used to extract secrets. Missing variables fail fast
with an actionable error instead of a provider-side 401.
* refactor(tools): delegate copilot env reference resolution to the shared executor resolver
Replaces the hand-rolled exact-match regex with resolveEnvVarReferences
(allowEmbedded: false), the same resolver used by workflow runs, MCP config,
and webhooks — one set of reference semantics instead of two that can drift.
Behavior is identical; all existing tests pass unchanged.
* fix(tools): fail fast on env references without user context, clarify personal-only scope errors
Addresses review: a copilot execution missing userId now errors explicitly
instead of forwarding the literal placeholder upstream, and a missing-variable
error without a workspace context explains that only personal variables are
in scope there (matching workflow-run resolution semantics).
* feat(billing): allow programmatic workflow execution on the free plan
Remove the free-plan paywall on programmatic execution (API-key/public
execute, MCP serve, generic webhooks, cross-origin chat embeds) added in
#5036. The gate shipped dark behind FREE_API_DEPLOYMENT_GATE_ENABLED to
curb bot abuse; with that abuse handled upstream, free workspaces can use
the API again (still subject to the free-tier rate limits).
- Delete isWorkspaceApiExecutionEntitled / api-access.ts and the
FREE_API_DEPLOYMENT_GATE_ENABLED env flag
- Ungate the execute, mcp/serve, and webhooks/trigger routes and the chat
embed check (assertChatEmbedAllowed removed)
- Remove the deploy-modal upgrade wall (DeployUpgradeGate) and the now
unused useWorkspaceOwnerBilling client hook; the owner-billing endpoint
stays as reusable billing infrastructure
- Restore pre-gate upgrade-page copy (Pro feature line, free API endpoint
rate-limit column)
* chore(billing): drop orphaned owner-billing endpoint and dead chat logger
Self-review follow-ups: the /api/workspaces/[id]/owner-billing route +
contract existed solely for the deploy-modal gate's client hook (deleted
here); host-context serves the same ownerBilling data server-side, so the
standalone endpoint is dead HTTP surface. workspaceOwnerBillingSchema and
the WorkspaceOwnerBilling type stay (embedded in workspaceHostContextSchema).
Also removes the now-unused ChatAuthUtils logger.
* style: biome formatting after gate removal
* improvement(chat): show resource-type icons on inline workspace resource links
* fix(chat): derive wsres click title from markdown label, not DOM textContent
* fix(chat): keep dashed-underline affordance for unmapped wsres link types
* fix(chat): parse wsres links once, derive file icons from the VFS path
* fix(custom-blocks): reserve system output names and hide own block from command modal
* fix(mothership): constrain custom block image icons in subagent tool rows
* improvement(custom-blocks): allow result as an exposed output name
Waleed