feat(credentials): regional and instance hosts for saved LaunchDarkly, LangSmith, New Relic, Square, SendGrid, Hex, and Sentry credentials by waleedlatif1 · Pull Request #9926 · simstudioai/sim

waleedlatif1 · 2026-11-12T11:45:56Z

Summary

Several saved-credential validators and their tools were hard-coded to one US or production host. This PR adds an additive region/instance/host field to those credentials. The field defaults to today's host, and the validator and every tool of each provider use it.

Shared: a token credential's domain field can declare options (shown as a dropdown) and a defaultValue. Omitted on create → default. Stored blob without it → default at resolve time. Reconnect with it left blank → the stored value is kept; a reconnect that names a region moves the credential to it. defaultValue is honored on domain only.
A credential on the default region keeps the bare service display name it had before (Sentry, not Sentry (us)). A vendor region host that fails to resolve is reported as the provider being unavailable, not as a typed host that was not found.
One defineCredentialRegions definition per vendor (tools/shared/credential-regions.ts) holds the region ids, hosts, dropdown labels, default, API base and hidden tool param. The validator, every tool, the descriptor, and the internal SendGrid/Square operation schemas all read from it.
The v2 credential provider catalog now reports a defaulted field's defaultValue (additive optional field; OpenAPI document and CLI client regenerated).
LaunchDarkly: Commercial (default) / EU (app.eu.launchdarkly.com) / Federal (app.launchdarkly.us)
LangSmith: GCP US (default) / GCP EU / GCP APAC / AWS US / Azure US
New Relic: adds JP (api.jp.newrelic.com). The region field is now a select. FedRAMP needs no change: NerdGraph has no FedRAMP-specific host, and an unlisted service's standard endpoint is already the compliant one (https://docs.newrelic.com/docs/security/security-privacy/compliance/fedramp-compliant-endpoints/), so FedRAMP accounts use US.
Square: Production (default) / Sandbox (connect.squareupsandbox.com)
SendGrid: Global (default) / EU regional subuser (api.eu.sendgrid.com). Notes that Marketing Campaigns is unavailable to EU subusers.
Hex: workspace host, default app.hex.tech. Only a single label under hex.tech is accepted (EU, HIPAA, single-tenant). Hex's known non-workspace sites (www, docs, learn, status, help, community, blog) are refused, because some of them are served by third parties.
Sentry: US (default, sentry.io) / EU (de.sentry.io), per https://docs.sentry.io/api/
Hosts come only from per-provider allowlists (or, for Hex, a strict *.hex.tech pattern). An unknown value is refused before the token is sent. The tool params that carry the region are hidden and filled only by the credential.

Backward compatibility: no new provider ids and no change to stored secret shapes. Existing credentials and legacy inline-key blocks keep today's hosts, and default-region creates keep today's display names and error codes. During a rolling deploy, an old worker sends a regional credential's token to the vendor's default host. That host belongs to the same vendor, so the call fails or gets proxied but nothing leaks.

Deploy note: during the rollout, an old pod that handles a reconnect or create of a non-default-region credential stores no region. Once the deploy finishes, that credential resolves to the default host. Avoid region changes and reconnects of regional credentials until every pod runs this release.

Not included: self-hosted Sentry (design memo)

Self-hosted Sentry is left out deliberately. It cannot ship cleanly in this PR:

Provider id. It needs a new provider id (for example sentry-self-hosted-service-account), not a third option on the us/de select. An old worker ignores a stored host and calls sentry.io, so a self-hosted token kept under sentry-service-account would be sent to sentry.io during a rolling deploy. A new id makes old workers fail closed.
Picker (the blocker). OAuthServiceConfig.serviceAccountProviderId is documented as the one non-OAuth credential family a service accepts. additionalProviderIds covers OAuth servers only (Salesforce sandbox). Showing both Sentry ids in the Sentry block's picker means extending that shared contract across the picker, credential listing and executor resolution. The alternative is a separate service or block, which is a product decision. Either way it is its own PR.
Field shape. A free-text domain (host plus optional subpath, since self-hosted Sentry can sit under a path prefix) on the new id only, normalized like the Sentry KB connector's normalizeHost and GitLab's normalizeGitLabHost. The cloud id keeps its us/de select unchanged.
Egress. The validator would call https://<host>/api/0/ through tokenCheckValidator({ egress: 'configuredEndpoint' }), as GitLab's does. The tools would take the host as a hidden, credential-filled param and go out through the executor's existing requestTarget path, which GitLab's self-managed tools already use. requestTarget has the same reachability as configuredEndpoint today: public hosts only on hosted, and the operator allowlist off hosted. So no executor change is needed.
Redirects. Keep the tools' current cross-origin redirect refusal (no allowSameOrigin), and send no token on any redirect. Sentry's API docs (https://docs.sentry.io/api/) document only sentry.io, us.sentry.io and de.sentry.io, so self-hosted behavior needs a live proof against a real install before it ships.

Type of Change

Testing

saved-credential-regions.test.ts: for every tool of each family, a saved regional credential goes to its host, a run without a credential stays on the default host, and an unknown region is refused.
service-account-secret.test.ts: each credential check hits the right URL and stores the region. Unlisted hosts (including Hex's third-party-served labels) are refused without a fetch. Default-region credentials keep the bare display name. Vendor region DNS failures are provider_unavailable, while a typed Hex host gives site_not_found.
Credential-service and orchestration tests cover legacy blobs (including Sentry) resolving to the default. They also cover a reconnect that leaves the region blank keeping the stored region, and a reconnect that names a region overriding it. That last case goes red if the stored region is always kept.
provider-catalog-contract.test.ts: a defaulted field reports defaultValue and the response still matches the strict v2 schema.
Internal Square operation and SendGrid client tests prove the regional host end to end.
Reviewers: please focus on the defaulted-field handling in service-account-secret.ts, credential-service.ts, orchestration/index.ts, and validators/http.ts.

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

vercel · 2026-11-12T11:45:58Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Nov 12, 2026 12:06pm UTC

cubic-dev-ai

All reported issues were addressed across 149 files

_{Turn on auto-fix | Re-trigger cubic}

greptile-apps · 2026-11-12T11:51:00Z

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge, with no new actionable issues found.

Summary

Adds saved region, instance, and workspace-host choices across seven credential families.

Saved credentials now keep the service location their token belongs to.
The credential catalog now shows the default for optional fields.
LaunchDarkly tools now use the selected commercial, EU, or Federal host.
LangSmith tools now use the selected cloud and provider host.
New Relic tools and its block now include the JP endpoint.
Square credentials now choose production or sandbox for every action.
SendGrid tools now send requests to the global or EU host saved with the credential.
Hex tools now use the workspace host saved with the credential.
Sentry tools now use the US or EU host saved with the credential.

No new actionable issues were found. The earlier unnumbered test-reset finding is fixed: vi.clearAllMocks() was removed from the hook. Tests were not run during this review.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[Create or reconnect] --> B[Choose supplied, stored, or default region]
  B --> C[Check token on allowed provider host]
  C --> D[Save token and region]
  D --> E[Resolve credential]
  E --> F[Fill hidden tool fields]
  F --> G[Call selected provider host]

_{Reviews (2) · Last reviewed commit: "test(credentials): drop the repeated moc..." · Reviewed by Greptile}

…nd LaunchDarkly EU and federal instances A token credential's connection field can now declare a fixed option set (rendered as a dropdown) and a default value. The default is what a create that omits the field gets, and what a credential saved before the field existed resolves to, so existing credentials and API callers keep the host they always used. A reconnect that leaves the field blank keeps the stored value instead of falling back to the default. LaunchDarkly is the first provider to use it: the access token is checked at, and every LaunchDarkly tool sends it to, the commercial, EU (app.eu.launchdarkly.com), or federal (app.launchdarkly.us) instance it was created in. Runs without a saved credential keep the commercial host.

A LangSmith API key only authenticates in the region its organization lives in. The saved credential now carries that region (GCP US by default, or GCP EU, GCP APAC, AWS US, or Azure US), and the key check and every LangSmith tool use its documented API host. Credentials saved before, and runs without a saved credential, stay on api.smith.langchain.com.

… legacy block New Relic now documents a Japan region whose NerdGraph endpoint is api.jp.newrelic.com. Saved User API keys can be verified and run there, the tools route jp to it, and the legacy block's region dropdown offers it. The saved key's region field is now a dropdown. Unknown region values still fall back to the US endpoint, as workflows saved before regions expect.

Square credentials and resources of one environment cannot be used in the other. The saved credential now carries its environment (production by default, or sandbox), and the token check, every Square tool, and the catalog image upload operation call connect.squareup.com or connect.squareupsandbox.com accordingly. Credentials saved before, and runs without a saved credential, stay on production.

…the EU host SendGrid serves regional subusers in the EU from api.eu.sendgrid.com. The saved credential now carries its region (global by default, or eu), and the key check, every SendGrid tool, and the mail send operation use that host. Credentials saved before, and runs without a saved credential, stay on api.sendgrid.com. The connect modal notes that Marketing Campaigns actions are not available to EU subusers.

…h host Hex serves EU multi-tenant, HIPAA multi-tenant, and single-tenant workspaces from their own hex.tech host instead of app.hex.tech. The saved credential now carries that host (app.hex.tech by default), accepting only a single label under hex.tech so a token is only ever sent to Hex, and the token check and every Hex tool use it. Credentials saved before, and runs without a saved credential, stay on app.hex.tech.

…n types module-private

…e region Sentry serves organizations whose data is stored in the EU from de.sentry.io, and its organization list is per region. The saved credential now carries its region (us by default, or de), and the token check and every Sentry tool call sentry.io or de.sentry.io accordingly. Credentials saved before, and runs without a saved credential, stay on sentry.io.

…rovider catalog The v2 provider catalog marked a defaulted region, instance, or host field optional without saying what it defaults to. Each field now carries an additive optional defaultValue, and the OpenAPI document and CLI client are regenerated.

…and share region definitions - A credential on its provider's default region or host keeps the bare service display name, and a vendor region host that fails to resolve is reported as the vendor being unavailable, not a typed host that was not found. - defaultValue is honored on the domain field only; providerWorkspaceId keeps its required, non-defaulted handling everywhere, so a blank reconnect can never reset it. - One defineCredentialRegions factory now holds each vendor's region ids, hosts, labels, default, API base, and hidden tool param (LaunchDarkly, LangSmith, New Relic, SendGrid, Sentry, Square); the internal SendGrid and Square schemas validate against it, and the New Relic descriptor and block take their options from it. - One isTokenServiceAccountFieldRequired predicate replaces the inline defaulted-is-optional checks. - Hex refuses its known non-workspace hex.tech labels (status, learn, docs, www, help, community, blog), and the pattern's comment no longer claims more than it guarantees. - Drops a mock-only and two pass-through tests; adds Sentry to the default-region tables.

Fold the named-region reconnect case into the blank-reconnect table as a contrast row on a credential stored in eu, so it fails if a reconnect always keeps the stored region.

…tests

waleedlatif1 · 2026-11-12T12:00:23Z

@greptile

waleedlatif1 · 2026-11-12T12:00:24Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-11-12T12:00:31Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 149 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

cubic-dev-ai Bot reviewed Nov 12, 2026

View reviewed changes

Comment thread apps/sim/lib/credentials/token-service-accounts/descriptors.ts Resolved

Comment thread apps/sim/tools/sendgrid/add_contact.ts Resolved

greptile-apps Bot reviewed Nov 12, 2026

View reviewed changes

Comment thread apps/sim/lib/oauth/credential-service.test.ts Resolved

vercel Bot deployed to Preview November 12, 2026 11:52

View deployment

waleedlatif1 added 13 commits November 12, 2026 03:56

test(credentials): type the regional host tests and keep region optio…

908cff1

…n types module-private

docs(square): say a saved credential can hold a sandbox access token

f87800f

test(credentials): guard a named reconnect region against the stored one

6ab98b0

Fold the named-region reconnect case into the blank-reconnect table as a contrast row on a credential stored in eu, so it fails if a reconnect always keeps the stored region.

test(credentials): drop the repeated mock reset in the legacy region …

9efa32f

…tests

waleedlatif1 force-pushed the feat/credential-region-hosts branch from 84d23f5 to 9efa32f Compare November 12, 2026 11:59

cubic-dev-ai Bot reviewed Nov 12, 2026

View reviewed changes

vercel Bot deployed to Preview November 12, 2026 12:06

View deployment

waleedlatif1 merged commit d5e98fa into staging Nov 12, 2026
83 checks passed

waleedlatif1 deleted the feat/credential-region-hosts branch November 12, 2026 17:02

Navigation Menu

Repository navigation

feat(credentials): regional and instance hosts for saved LaunchDarkly, LangSmith, New Relic, Square, SendGrid, Hex, and Sentry credentials - #9926

feat(credentials): regional and instance hosts for saved LaunchDarkly, LangSmith, New Relic, Square, SendGrid, Hex, and Sentry credentials#9926
waleedlatif1 merged 13 commits into
stagingfrom
feat/credential-region-hosts

waleedlatif1 commented Nov 12, 2026

Uh oh!

vercel Bot commented Nov 12, 2026 •

edited

Loading

Uh oh!

cubic-dev-ai Bot left a comment •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

greptile-apps Bot commented Nov 12, 2026 •

edited

Loading

Diagram

Uh oh!

Uh oh!

waleedlatif1 commented Nov 12, 2026

Uh oh!

waleedlatif1 commented Nov 12, 2026

Uh oh!

cubic-dev-ai Bot commented Nov 12, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

waleedlatif1 commented Nov 12, 2026

Summary

Not included: self-hosted Sentry (design memo)

Type of Change

Testing

Checklist

Uh oh!

vercel Bot commented Nov 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

greptile-apps Bot commented Nov 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Summary

Diagram

Uh oh!

Uh oh!

waleedlatif1 commented Nov 12, 2026

Uh oh!

waleedlatif1 commented Nov 12, 2026

Uh oh!

cubic-dev-ai Bot commented Nov 12, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vercel Bot commented Nov 12, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

greptile-apps Bot commented Nov 12, 2026 •

edited

Loading