Files
sim/scripts
WaleedandClaude Opus 4.7 08eeecbebe fix(security): KB fileUrl LFI, MCP/Agiloft SSRF pinning, form OTP, KB authz (#4639)
* fix(security): KB fileUrl LFI, MCP/Agiloft SSRF pinning, form OTP, KB authz

* fix(otp): don't leak caught error.message; fail-closed on DB retry exhaust

- Chat/form OTP routes: replace `error.message || fallback` with generic
  `Failed to process request` in 500 responses (logger still captures detail).
- otp.ts incrementOTPAttempts DB path: on MAX_RETRIES exhaustion, delete the
  verification row and return `'locked'` instead of trusting a possibly-
  undercounted final read.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* fix(mcp): use undici fetch directly in pinned-fetch for typed dispatcher

Replace `globalThis.fetch` + double-cast with `undici.fetch` so the
`dispatcher` option is part of the real type contract. This guarantees
pinning won't silently break if a future runtime swaps the underlying
fetch implementation.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* fix(build): keep agiloft/grafana tool configs client-safe

Tool config files are statically reachable from the client bundle (via
tools/registry.ts → tools/{service}/index.ts). Importing
`@/lib/core/security/input-validation.server` from these files pulled
`node:dns/promises` into the Turbopack client bundle and broke the build.

Split agiloft utils into client-safe (`utils.ts`, plain fetch + sync
`validateExternalUrl`) and server-only (`utils.server.ts`, DNS-pinned
variants). Routes that need TOCTOU protection import the pinned helpers;
the executor-side tool path falls back to sync URL validation (matches
the supabase precedent and pre-PR baseline).

Grafana update tools likewise switch from `secureFetchWithValidation`
(server-only) to inline sync `validateExternalUrl` + plain fetch.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* fix(knowledge): case-insensitive scheme checks for fileUrl

Boundary schema accepted uppercase schemes (e.g. HTTPS://, DATA:) via the
case-insensitive http regex, but the processor's case-sensitive
startsWith('data:') / startsWith('http') / startsWith('https://') checks
rejected them with a confusing "Unsupported fileUrl scheme" error.
Aligns processor checks to the schema using case-insensitive regex per
RFC 3986 §3.1.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* fix(mcp): annotate undici/DOM type-bridge double-casts in pinned-fetch

Strict audit was failing on two new `as unknown as` casts in pinned-fetch.ts.
They bridge DOM `RequestInit`/`Response` ↔ undici equivalents (structurally
compatible at runtime since Node's global fetch is undici) and are required
to satisfy the FetchLike contract. Annotate so they count as documented
exemptions instead of new violations.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-16 23:05:52 -07:00
..

Block Documentation Generator

This directory contains scripts to automatically generate documentation for all blocks in the Sim platform.

Available Scripts

  • generate-docs.ts: Generates documentation for all blocks. Run via bun run generate-docs from apps/sim, or directly with bun run scripts/generate-docs.ts from the repo root.

How It Works

The documentation generator:

  1. Scans the apps/sim/blocks/blocks/ directory for all block definition files
  2. Extracts metadata from each block including:
    • Name, description, and category
    • Input and output specifications
    • Configuration parameters
  3. Generates standardized Markdown documentation for each block
  4. Updates the navigation metadata in meta.json

Running the Generator

# From the repo root
bun run scripts/generate-docs.ts

Dependencies are managed by Bun workspaces — bun install at the repo root installs everything needed.

CI Integration

The documentation generator runs automatically as part of the CI/CD pipeline whenever changes are pushed to the main branch. The updated documentation is committed back to the repository.

Adding Support for New Block Properties

If you add new properties to block definitions that should be included in the documentation, update the generateMarkdownForBlock function in scripts/generate-docs.ts.

Preserving Manual Content

The documentation generator now supports preserving manually added content when regenerating docs. This allows you to enhance the auto-generated documentation with custom examples, additional context, or any other content without losing your changes when the docs are regenerated.

How It Works

  1. The generator creates clean documentation without any placeholders or markers
  2. If you add manual content to a file using special comment markers, that content will be preserved during regeneration
  3. The manual content is intelligently inserted at the appropriate section when docs are regenerated

Using Manual Content Markers

To add custom content to any tool's documentation, insert MDX comment blocks with section markers:

{/_ MANUAL-CONTENT-START:sectionName _/}
Your custom content here (Markdown formatting supported)
{/_ MANUAL-CONTENT-END _/}

Replace sectionName with one of the supported section names:

  • intro - Content at the top of the document after the BlockInfoCard
  • usage - Additional usage instructions and examples
  • configuration - Custom configuration details
  • outputs - Additional output information or examples
  • notes - Extra notes at the end of the document

Example

To add custom examples to a tool doc:

{/_ MANUAL-CONTENT-START:usage _/}

## Examples

### Basic Usage

```json
{
  "parameter": "value",
  "anotherParameter": "anotherValue"
}
```

Advanced Configuration

Here's how to use this tool for a specific use case... {/_ MANUAL-CONTENT-END _/}


When the documentation is regenerated, your manual content will be preserved in the appropriate section automatically. The script will not add any placeholders or markers to files by default.