mirror of
https://github.com/simstudioai/sim.git
synced 2026-09-24 15:45:35 +08:00
WaleedandClaude Opus 4.7
0c69302369
* fix(integrations): validate and harden jira, jsm, ashby, google drive, slack, confluence, notion Audit and fix contract drift, input validation, and error handling across integrations: - Jira: NaN guards on worklog seconds, JSON.parse try/catch on internal API responses, domain normalization (strip leading https://), JQL injection prevention via project key validation, ADF helper consolidation, /search/jql nextPageToken pagination, defensive .trim() on ID path params, encodeURIComponent on watcher account IDs, resolveAssigneeAccountId helper, parent-as-object wrapping, summary fallback, add read-bulk operation. Restored total field (always null) to preserve contract. - JSM: customer/organization route validation - Ashby: types and tool output cleanup across all 30+ tools - Google Drive: tighter response handling across read/write/share tools - Slack: types and tool fixes (canvas, reactions, messaging, members) - Confluence: update tool and types - Docs: regenerated mdx for all touched integrations * fix(ashby): add subblock migrations for removed expand form definition fields * fix(slack): restore canvas_id fallback to data.id for backwards compat Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(jsm): explicit 400 when deprecated `emails` param is sent Address greptile review on PR #4345: instead of silently dropping `emails` and falling through to list-customers, return a 400 telling the caller to use `accountIds`. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(google_drive): include HTTP status in fallback error messages Address greptile review on PR #4345: when Google Drive returns a non-JSON error body, surface the response status/statusText so failures are diagnosable instead of falling through to a generic message. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(ashby): drop stray websiteUrl→website remap for update_candidate The update_candidate tool reads params.websiteUrl directly; mapping it to result.website added a confusing dead field. The websiteUrl subBlock auto-passes through with the matching name. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(google_drive): rename canonical params to avoid subBlock ID clash `mimeType`, `query`, and `pageSize` canonical IDs collided with existing subBlock IDs in the same block (failing the canonical-param validation test). Drop the canonicalParamId from search/get_content single-input fields and route them to tool params explicitly in tools.config.params. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(ashby): remove filterCandidateId from removed-subblock migrations The candidate-id filter was reintroduced as a valid Ashby subBlock, but the migration map still rewrote it to _removed_filterCandidateId on every workflow load, silently breaking the field. Drop the entry so user values persist. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(ashby): restore documented response fields dropped during refactor Restore three fields that exist in Ashby's API responses but were dropped during the recent refactor: applicationLimitCalloutHtml on /jobPosting.info, compensation on /job.info (and add the `compensation` expand), and managerId on /user.list. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * correctness * updated types * fix(ashby): gate operation-specific param mappings to prevent stale overwrites Multiple subBlocks share the same target tool param (createdAt is set by appCreatedAt/candidateCreatedAt/noteCreatedAt; candidateId by appCandidateId/ filterCandidateId). Because subBlock values persist across operation switches, a stale value from a prior operation could silently overwrite the correct one. Guard each mapping with an explicit operation check. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(ashby): gate offerApplicationId mapping by operation Same shared-target hazard as the prior fix: offerApplicationId maps to result.applicationId without an operation guard, so a stale value from list_offers could overwrite the active applicationId on get_application, change_application_stage, or list_interviews. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(ashby): include list_locations in includeArchived condition Ashby's /location.list accepts includeArchived per the API docs, and the docs page already documents the toggle for list_locations. Add the missing operation value so the toggle renders. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(jira): forward explicit notifyUsers=true query param on issue update Block now distinguishes true/false/undefined for notifyUsers, but the route collapsed true and undefined into a no-param request. Forward the explicit true intent so it survives any future API default change or proxy override. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(jira): quote project key in JQL to defend against injection * fix(jira): quote project key in bulk_read JQL for defense in depth The alphanumeric regex check above already blocks injection, but quoting the project key matches the pattern used elsewhere (issues/route.ts) and hardens the path against future regex changes. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
The open-source platform to build AI agents and run your agentic workforce. Connect 1,000+ integrations and LLMs to orchestrate agentic workflows.
Build Workflows with Ease
Design agent workflows visually on a canvas—connect agents, tools, and blocks, then run them instantly.
Supercharge with Copilot
Leverage Copilot to generate nodes, fix errors, and iterate on flows directly from natural language.
Integrate Vector Databases
Upload documents to a vector store and let agents answer questions grounded in your specific content.
Quickstart
Cloud-hosted: sim.ai
Self-hosted: NPM Package
npx simstudio
Note
Docker must be installed and running on your machine.
Options
| Flag | Description |
|---|---|
-p, --port <port> |
Port to run Sim on (default 3000) |
--no-pull |
Skip pulling latest Docker images |
Self-hosted: Docker Compose
git clone https://github.com/simstudioai/sim.git && cd sim
docker compose -f docker-compose.prod.yml up -d
Sim also supports local models via Ollama and vLLM — see the Docker self-hosting docs for setup details.
Self-hosted: Manual Setup
Requirements: Bun, Node.js v20+, PostgreSQL 12+ with pgvector
- Clone and install:
git clone https://github.com/simstudioai/sim.git
cd sim
bun install
bun run prepare # Set up pre-commit hooks
- Set up PostgreSQL with pgvector:
docker run --name simstudio-db -e POSTGRES_PASSWORD=your_password -e POSTGRES_DB=simstudio -p 5432:5432 -d pgvector/pgvector:pg17
Or install manually via the pgvector guide.
- Configure environment:
cp apps/sim/.env.example apps/sim/.env
# Create your secrets
perl -i -pe "s/your_encryption_key/$(openssl rand -hex 32)/" apps/sim/.env
perl -i -pe "s/your_internal_api_secret/$(openssl rand -hex 32)/" apps/sim/.env
perl -i -pe "s/your_api_encryption_key/$(openssl rand -hex 32)/" apps/sim/.env
# DB configs for migration
cp packages/db/.env.example packages/db/.env
# Edit both .env files to set DATABASE_URL="postgresql://postgres:your_password@localhost:5432/simstudio"
- Run migrations:
cd packages/db && bun run db:migrate
- Start development servers:
bun run dev:full # Starts Next.js app and realtime socket server
Or run separately: bun run dev (Next.js) and cd apps/sim && bun run dev:sockets (realtime).
Copilot API Keys
Copilot is a Sim-managed service. To use Copilot on a self-hosted instance:
- Go to https://sim.ai → Settings → Copilot and generate a Copilot API key
- Set
COPILOT_API_KEYenvironment variable in your self-hosted apps/sim/.env file to that value
Environment Variables
See the environment variables reference for the full list, or apps/sim/.env.example for defaults.
Tech Stack
- Framework: Next.js (App Router)
- Runtime: Bun
- Database: PostgreSQL with Drizzle ORM
- Authentication: Better Auth
- UI: Shadcn, Tailwind CSS
- Streaming Markdown: Streamdown
- State Management: Zustand, TanStack Query
- Flow Editor: ReactFlow
- Docs: Fumadocs
- Monorepo: Turborepo
- Realtime: Socket.io
- Background Jobs: Trigger.dev
- Remote Code Execution: E2B
- Isolated Code Execution: isolated-vm
Contributing
We welcome contributions! Please see our Contributing Guide for details.
License
This project is licensed under the Apache License 2.0 - see the LICENSE file for details.
Made with ❤️ by the Sim Team