Repository navigation
v0.9.55: saved credentials for databases, Bedrock, and more services with configurable keyless audiences, computer use on by default behind a permission-group restriction, AWS Marketplace listing catalog and usage billing, Google, Microsoft, Atlassian, and AWS integration validation, GitLab permission export - #9963
Merged
Merged
Conversation
…ough a product catalog (#9920) * feat(aws-marketplace): sell several listings from one integration through a product catalog * improvement(aws-marketplace): resolve each run's products once, keep env free of billing code, and drop derivable state * fix(aws-marketplace): treat a usage-only read as no answer about access, and refuse to boot on a malformed product catalog * fix(aws-marketplace): discover a license from any entitlement and decide access from the plan's dimension
….54 (#9809) * improvement(changelog): cover meaningful product updates through v0.9.54 * improvement(changelog): date catch-up stories by release and refine coverage
…ttled; show the request id in the CLI (#9924) * fix(cli): show the server's request id on API errors * fix(api): report a finished run's status once none of its pauses can be resumed * fix(cli): keep the request id on every error built from a response * fix(cli): read an internal route's request id beside the error
* feat(apollo): add optional OAuth connections * fix(apollo): gate OAuth setup on client availability * fix(apollo): respect workspace policy for OAuth setup
…, LangSmith, New Relic, Square, SendGrid, Hex, and Sentry credentials (#9926) * feat(credentials): add defaulted region fields to token credentials and LaunchDarkly EU and federal instances A token credential's connection field can now declare a fixed option set (rendered as a dropdown) and a default value. The default is what a create that omits the field gets, and what a credential saved before the field existed resolves to, so existing credentials and API callers keep the host they always used. A reconnect that leaves the field blank keeps the stored value instead of falling back to the default. LaunchDarkly is the first provider to use it: the access token is checked at, and every LaunchDarkly tool sends it to, the commercial, EU (app.eu.launchdarkly.com), or federal (app.launchdarkly.us) instance it was created in. Runs without a saved credential keep the commercial host. * feat(langsmith): verify and run saved LangSmith keys in their region A LangSmith API key only authenticates in the region its organization lives in. The saved credential now carries that region (GCP US by default, or GCP EU, GCP APAC, AWS US, or Azure US), and the key check and every LangSmith tool use its documented API host. Credentials saved before, and runs without a saved credential, stay on api.smith.langchain.com. * feat(new-relic): add the JP data center to saved keys, tools, and the legacy block New Relic now documents a Japan region whose NerdGraph endpoint is api.jp.newrelic.com. Saved User API keys can be verified and run there, the tools route jp to it, and the legacy block's region dropdown offers it. The saved key's region field is now a dropdown. Unknown region values still fall back to the US endpoint, as workflows saved before regions expect. * feat(square): verify and run saved Square tokens in the sandbox Square credentials and resources of one environment cannot be used in the other. The saved credential now carries its environment (production by default, or sandbox), and the token check, every Square tool, and the catalog image upload operation call connect.squareup.com or connect.squareupsandbox.com accordingly. Credentials saved before, and runs without a saved credential, stay on production. * feat(sendgrid): verify and run saved keys of EU regional subusers on the EU host SendGrid serves regional subusers in the EU from api.eu.sendgrid.com. The saved credential now carries its region (global by default, or eu), and the key check, every SendGrid tool, and the mail send operation use that host. Credentials saved before, and runs without a saved credential, stay on api.sendgrid.com. The connect modal notes that Marketing Campaigns actions are not available to EU subusers. * feat(hex): verify and run saved Hex tokens on the workspace's hex.tech host Hex serves EU multi-tenant, HIPAA multi-tenant, and single-tenant workspaces from their own hex.tech host instead of app.hex.tech. The saved credential now carries that host (app.hex.tech by default), accepting only a single label under hex.tech so a token is only ever sent to Hex, and the token check and every Hex tool use it. Credentials saved before, and runs without a saved credential, stay on app.hex.tech. * test(credentials): type the regional host tests and keep region option types module-private * feat(sentry): verify and run saved Sentry tokens in their data storage region Sentry serves organizations whose data is stored in the EU from de.sentry.io, and its organization list is per region. The saved credential now carries its region (us by default, or de), and the token check and every Sentry tool call sentry.io or de.sentry.io accordingly. Credentials saved before, and runs without a saved credential, stay on sentry.io. * feat(credentials): report a defaulted region field's default in the provider catalog The v2 provider catalog marked a defaulted region, instance, or host field optional without saying what it defaults to. Each field now carries an additive optional defaultValue, and the OpenAPI document and CLI client are regenerated. * docs(square): say a saved credential can hold a sandbox access token * fix(credentials): keep default-region token credentials as they were and share region definitions - A credential on its provider's default region or host keeps the bare service display name, and a vendor region host that fails to resolve is reported as the vendor being unavailable, not a typed host that was not found. - defaultValue is honored on the domain field only; providerWorkspaceId keeps its required, non-defaulted handling everywhere, so a blank reconnect can never reset it. - One defineCredentialRegions factory now holds each vendor's region ids, hosts, labels, default, API base, and hidden tool param (LaunchDarkly, LangSmith, New Relic, SendGrid, Sentry, Square); the internal SendGrid and Square schemas validate against it, and the New Relic descriptor and block take their options from it. - One isTokenServiceAccountFieldRequired predicate replaces the inline defaulted-is-optional checks. - Hex refuses its known non-workspace hex.tech labels (status, learn, docs, www, help, community, blog), and the pattern's comment no longer claims more than it guarantees. - Drops a mock-only and two pass-through tests; adds Sentry to the default-region tables. * test(credentials): guard a named reconnect region against the stored one Fold the named-region reconnect case into the blank-reconnect table as a contrast row on a credential stored in eu, so it fails if a reconnect always keeps the stored region. * test(credentials): drop the repeated mock reset in the legacy region tests
* feat(bedrock): sign with a saved AWS credential's session when one is resolved A resolved saved-credential session on the provider request is used alone, passes its session token, and never falls back to inline keys or the deployment's own AWS credentials. Its client cache key names the credential and session expiry plus a digest of the key material, never a raw secret. * feat(bedrock): authorize and resolve a saved AWS credential for Bedrock model calls resolveBedrockCredentialSession runs the shared credential-use authorization, then loads the credential only within its workspace and only as a live AWS credential, resolving it to the stored key pair or a fresh STS session and recording the credential access. * fix(bedrock): bind native conversation continuation to the saved AWS credential A saved credential resolves to fresh session keys every run, so the binding names the credential instead; requests without one hash exactly as before. * feat(bedrock): sign agent, router, and evaluator Bedrock calls with a saved AWS credential A block's bedrockCredential is authorized and resolved for the run's acting user within the workflow's workspace before the provider call; a failure fails the call instead of falling back. The session stays off fallbacks on another provider. * feat(bedrock): accept a saved AWS credential in the LLM chat and guardrails operations Translate (llm_chat) and the guardrails hallucination check resolve a selected Bedrock credential for the acting user before the scoring or chat call, the same way the executor handlers do; a credential that cannot be used fails the call before any provider work. * feat(bedrock): offer a saved AWS credential in the shared LLM model credential fields Agent, router, evaluator, and translate get an AWS Authentication choice for Bedrock models: access keys (the default, and what every existing block keeps) or a saved AWS credential picker, following the Vertex credential pattern. * test(bedrock): keep the LLM operation credential test free of type errors * fix(bedrock): refuse a block set to a saved AWS credential whose ID resolves blank A block whose AWS Authentication is a saved credential, but whose credential field resolves empty at run time (an empty reference), fell through to inline keys or the deployment's own AWS credentials. The agent, router, evaluator, and translate blocks now share one selector that refuses that case, and honors an explicit access-keys mode over a stale credential ID. * docs(bedrock): document signing Bedrock model calls with a saved AWS credential * fix(bedrock): build role-session Bedrock clients per request instead of filling the shared client cache An assumed or keyless role resolves to a fresh STS session on every call, so a session-keyed cache entry was never read again and pushed other providers' warm clients out of the shared LRU. Long-lived saved keys stay cached. The session type now derives from AwsSessionCredentials, and authorization refusals carry a reason. * fix(bedrock): decide the AWS auth mode with one rule for fields and signing A block signs with a saved AWS credential only when bedrockAuthMode is 'credential', the same rule that shows and serializes the picker. The agent test no longer leaks a persistent mock rejection. * fix(bedrock): refuse an unauthorized saved AWS credential with 401 like Vertex * revert(bedrock): drop the unreachable guardrails saved-credential plumbing The Guardrails block evaluates its provider credential conditions without values, so its Bedrock fields never render or serialize; the param could only arrive outside the shared auth-mode rule. * docs(bedrock): cover inference-profile IAM scope and role session lifetime * fix(bedrock): offer the saved AWS credential only on blocks that forward it Guardrails and Pi spread the shared provider credential fields and inputs but never pass a saved credential to their call, so the AWS Authentication choice and credential picker are now opt-in. Agent, Router, Evaluator, and Translate opt in; Guardrails and Pi keep the fields and catalog schema they had before. * fix(bedrock): address review on saved AWS credential signing - Translate resolves the saved credential only for a Bedrock model, so a leftover credential choice no longer blocks a call to another provider. - A transient STS failure resolving the credential reports 503 instead of 400, using the classification the AWS tool operations already share. - llm_chat forwards the run's execution ID to the resolver, naming the role session and the credential-access audit after the run. - Native conversation binding keys a saved-credential request on the credential alone, ignoring inline keys left on the block. - Handler tests share one central mock for the Bedrock credential module; the block declaration test is replaced by Translate behavior tests. - The integration suite writes its credential-access audit inside a rollup scope and asserts it before teardown.
* feat(credentials): record when a saved GitHub or GitLab token expires GitHub reports a personal access token's expiry in the GitHub-Authentication-Token-Expiration response header and GitLab in the expires_at of /personal_access_tokens/self. The token check factory gains an expiresAt reader, keeps only a credible moment (a real calendar time at least an hour ahead, since the vendor just accepted the token), and the create and reconnect paths store it on credential.access_token_expires_at, the column a personal token already uses for the same meaning. A replacement token that states no expiry clears the previous one. The workspace credential contract reports it as an optional expiresAt. * feat(credentials): say a saved token expired when its provider refuses it When a provider answers a saved service-account token with a 401 and the credential records a vendor-stated expiry that has passed, the run now reports that the token expired on that date and asks for a new one, instead of the bare authorization failure. The explanation keeps the provider's status, statusText, and body, and classifies as user-actionable like a revoked grant. A token is never refused on the recorded expiry alone: only a refusal the provider already made is explained, for both external requests and internal operations. * feat(integrations): show when a saved token expires A connected credential whose saved token has a recorded expiry shows "expires in N days" or "expired" in the integrations list, the same muted caption API keys use, and a Token expiry section with the date on its detail page. * refactor(credentials): keep the expired saved-token error private to its module * refactor(credentials): share the vendor token expiry readers with the GitLab personal token The GitHub and GitLab expiry readers move to one module so the GitLab personal token path reads expires_at the same strict way: a date that does not exist is recorded as no expiry instead of rolling over into another day. * feat(credentials): report a saved token's expiry on organization credentials The organization credential presentation reports the same optional expiresAt the workspace one does. * fix(credentials): log an expired saved token's refusal as the provider's refusal The expired-token explanation is a user failure rather than a revoked grant, so it never triggers the revoked-grant handling, and it inherits the refusal's failure classification, logged mark, and external response body so the failure is still attributed to the provider and logged once. * fix(integrations): show a saved token's expiry time in UTC GitHub states the expiry to the second, so the detail page shows the date and time in UTC rather than a date that can fall on the wrong day locally. * fix(credentials): keep an imminent stated token expiry and read only GitHub's sourced header form Only an expiry that has already passed contradicts the vendor's acceptance; one that is minutes away is real and is now recorded. GitHub does not document the expiration header's value format, so the reader accepts only the numeric-offset form GitHub's own client library records and leaves any other form unread. * fix(credentials): say an expired saved token's date is UTC and keep it the provider's refusal The expired-token error extended UserFailure, but the boundary always carries the provider refusal's attribution onto it, so the base did nothing and its docs contradicted the logged classification. It is now a plain Error, and the run message names the date as UTC. * fix(credentials): read GitHub's UTC-marked token expiration header form GitHub's octokit.rb spec cassettes record the GitHub-Authentication-Token-Expiration header both with a numeric offset and as 'YYYY-MM-DD HH:MM:SS UTC'. Accept the UTC-marked form as offset zero so those tokens get their expiry recorded; every other zone name stays unread. * fix(credentials): keep saved-token expiry captions current and drop a past GitLab personal-token expiry The integrations list and detail captions re-read the clock when the day count drops or the token expires, instead of only on render. A GitLab personal token's stated expiry that is already past is dropped, the same check the service-account validators apply, now shared as credibleTokenExpiry. * fix(credentials): time a reconnected token's expiry caption from now and reject out-of-range GitHub offsets
…a IAM signJwt (#9933) * feat(credentials): domain-wide delegation for keyless Google credentials A keyless (workload identity federation) google-service-account credential can now opt into domain-wide delegation with an optional `delegation` ({ user, services }) in its keyless configuration. Runs for a delegated Workspace service (Gmail, Drive, Docs, Sheets, Calendar) exchange Sim's token at STS, have IAM signJwt the JWT-bearer assertion for the service account with sub set to the delegated user, and exchange it at oauth2.googleapis.com/token. The credential acts only as its own user: a different Impersonated Account is refused before Google is contacted. Saving a delegated credential mints a delegated token per service and makes one cheap read as the user; the stray-subject pin probe also checks signJwt. Tokens are cached per credential, secret version, delegated user, and scopes. Credentials saved without delegation store exactly the same secret and resolve exactly as before; BigQuery and Vertex AI keep the service account token path. * feat(integrations): offer keyless domain-wide delegation in the Google service account dialog The Gmail, Google Drive, Google Docs, Google Sheets, and Google Calendar integrations now offer the keyless (Workload Identity Federation) mode, with a Domain-wide delegation picker preselecting the service the dialog was opened for and a required Workspace user. The dialog lists the scopes to authorize in the Admin console, and its gcloud commands grant roles/iam.serviceAccountTokenCreator (which includes signJwt) instead of roles/iam.workloadIdentityUser when delegation is on. Other Workspace services keep the JSON key only. * docs(integrations): document keyless Google domain-wide delegation * fix(credentials): mint delegated keyless tokens only for authorized scopes A keyless credential with domain-wide delegation now signs an assertion only for the scopes its delegated services authorize, and refuses any other scope before contacting Google (a Gmail read-only connector, the admin directory scopes, cloud-platform). A requested read-only scope is minted as the authorized read-write scope that covers it, so the Drive file picker works for a credential delegated for Drive, Docs, or Sheets. The delegated assertion is exchanged through the same transport a JSON key uses (bounded read, retries on 429 and 5xx within a budget), sharing its list of diagnostic error codes. Saving checks Drive, Docs, and Sheets, which share scopes and a read, once, and the pin probe signs for every delegated scope. A stored secret naming a delegated service a later release adds stays readable: that service authorizes nothing here, and Google Cloud tokens and the known services keep working. An unreadable secret fails in the shared service-account codes. * fix(integrations): keep a keyless Google credential's delegation on reconnect Preparing a reconnect of a keyless Google credential now returns its stored Workspace user and delegated services to the credential's admin (neither is secret), and the dialog opens on them, adding the service it was opened for. Reconnecting no longer silently drops delegation. A dialog opened for a delegable service requires that service to be delegated. * docs(integrations): note keyless delegation scope limits and least-privilege role * fix(credentials): serve the Gmail label picker and name the right fix for keyless delegation A read-only Gmail request is minted as the authorized gmail.modify scope, an Impersonated Account is compared trimmed, and each documented token-endpoint refusal gets its own copy instead of always pointing at the Admin console. The stored secret is parsed in one place and the save-time read shares the POST helper's redirect and timeout guards. * refactor(credentials): read reconnect fields through the per-provider map The prepare use case no longer branches on the Google provider: each provider's reader returns everything a reconnect reopens on. The dialog takes the stored delegation type from the contract, and one helper says which services a keyless Google credential serves. * docs(integrations): describe scope-level keyless delegation and new refusal messages * fix(integrations): offer Gmail keyless delegation from the Integrations page and chat card Both entry points pass the OAuth provider id (google-email) where the dialog compared against service ids (gmail), so Gmail never offered keyless mode there and a keyless reconnect from chat was refused. The shared helpers and the dialog now map either id through googleDelegationServiceFor. * fix(credentials): mint calendar for the Calendar connector's delegated calendar.events.readonly The Calendar connector requests calendar.events.readonly, whose read-write sibling calendar.events is not what a Calendar delegation authorizes, so every keyless delegated Calendar connector token was refused. Map it to calendar, the authorized scope Google documents as covering it. * docs(integrations): note the Calendar connector's read-only events scope is served keylessly
…ata Explorer, with national clouds (#9931) * feat(credentials): resource-aware Microsoft app tokens and an optional national cloud Microsoft app credentials resolve each service's token audience from one table and cache minted tokens per credential, stored-secret version, and audience, so services that need a different resource no longer share a Graph-or-Dataverse key. A credential can name a national cloud (US Government GCC High or DoD, or China); its Entra endpoint, certificate assertion audience, and save-time Graph check follow that cloud. Global credentials store no cloud field, so existing secrets and older workers read them exactly as before, and Graph and Dataverse services refuse a national-cloud credential because their tools call the global cloud. * feat(powerbi): run Power BI as a Microsoft app credential The Power BI service offers the Microsoft app credential beside its delegated OAuth connection. A run or selector with an app credential gets an app-only token for the Power BI REST API audience (https://analysis.windows.net/powerbi/api/.default), cached apart from the credential's Graph token; national-cloud credentials are refused because the tools call api.powerbi.com. Delegated connections and every tool's params are unchanged. The Power BI integration suite proves a run and a selector end to end with a persisted app credential. * feat(azure-data-explorer): run as a saved Microsoft app credential Adds azure_data_explorer_v2, a credential-only successor whose picker selects a Microsoft app credential (client secret, certificate, or keyless federated credential) in place of the inline tenant ID, client ID, and client secret. The executor authorizes the credential and the operation mints a token for the cluster each call names: the audience is the allowlisted cluster (or resource override) host as https://<host>, and the credential's cloud must be one that host belongs to, so a US Government or China cluster takes a matching national-cloud credential. Inline secrets are never read on that path. The legacy block keeps its inline fields and behavior and is marked legacy with azure_data_explorer_v2 as its replacement. The connect dialog gains a Cloud choice; a global credential's payload and stored secret are unchanged. * fix(credentials): decrypt Microsoft app secrets only on a token miss and scope the ADX operation - Token cache key is named before decrypting, so a cached token skips the decrypt and parse; Azure Data Explorer authorization no longer decrypts, and its cluster key includes the resource's clouds. - The ADX operation re-checks the credential against the run's workspace or organization, as the AWS operation path does. - A credential in the wrong Microsoft cloud is refused as cloud_mismatch with its own message instead of "reconnect the credential"; ADX tool errors come from the refusal code, not log detail. - The operation-minted service comes from the shared ADX credential config. - Reconnect reopens a national-cloud credential on its stored cloud. - China signs in at login.partner.microsoftonline.cn (Entra national-cloud reference) for both ADX auth paths; Kusto authorities derive from MICROSOFT_CLOUDS. - Drop the one-line ADX operations passthrough; refresh TSDoc and the Power BI description. * fix(credentials): refuse a national-cloud Microsoft app credential for Dataverse as a cloud mismatch * refactor(credentials): read a reconnect's stored mode and cloud through one per-provider map * fix(credentials): resolve a reconnect's cloud before saving and refuse a cross-cloud ADX resource A Microsoft app reconnect now waits for the stored cloud, or asks for one when it cannot be read (an organization credential or a failed lookup), instead of saving as global. The ADX schema refuses a resource override whose cloud differs from the cluster's before any credential is decrypted, and the Power BI description says app credentials run in the global cloud only.
… refresh outages and pace token retries by failure kind (#9925) * feat(credentials): carry a provider's Retry-After on token request failures A 429 or 503 token answer now records its Retry-After (delay-seconds or HTTP-date, RFC 9110 section 10.2.3) as an optional retryAfterMs on TokenServiceAccountValidationError, through throwForProviderResponse and the shared client-credentials grant, whose provider classifier receives it. * feat(credentials): keep valid client-credential tokens through refresh outages The per-instance client-credential mint cache now: - serves a cached token that is inside its five-minute early-refresh window but not expired when the refresh fails with an outage or throttling, as MSAL, Azure.Core and botocore do; a refusal of the credentials still fails - retries a quick transient mint failure once after about a second - replays failures by kind instead of a flat 30 s: a refusal 30 s, a throttled answer for its Retry-After (1 s to 5 min), an outage 5 s growing to 30 s while it continues The policy lives in lib/credentials/token-request-resilience.ts so the coordinated resolver can share it. * feat(credentials): share token refresh resilience across workers in the coordinated resolver The coordinated client-credentials resolver (Shopify, Linear, Atlassian, Vanta) now applies the same policy as the per-instance mint cache, through the shared row every worker reads: - a quick outage is retried once under the application lock, within the 15 s its waiters allow - a refusal is remembered 30 s, a throttled answer for its Retry-After (1 s to 5 min, Vanta's now included), an outage 5 s growing to 30 s while it lasts - while an outage or throttling is remembered, the stored token for the same secret is served until 30 s before it expires; a refusal fails at once Rolling deploys stay safe: a refusal is stored exactly as before, and outages add only a consecutiveFailures key that previous decoders ignore (both prior decoders are pinned in the integration tests). The replay length rides on the row's existing expiresAt. Expired memos are kept five more minutes so the next failure can extend the backoff; an older build's sweep only resets it. * fix(credentials): pace throttled and Vanta token retries and replay remembered failures without the lock - A 429 that names no Retry-After is replayed for at least a minute, doubling up to the five-minute cap, instead of the 5 s outage curve. - The outage backoff never undercuts Entra's 5 s first-retry floor through jitter. - Vanta asks for a token at most once per 15 s while exchanges fail (no in-request retry, replay floored), within its documented 5 tokens a minute, through a new optional minExchangeIntervalMs on the coordinated resolver. - A remembered failure and the still-valid fallback are served from committed rows before the application lock is taken, so a refresh outage no longer serializes every resolution behind the lock. - retryAfterMs now only carries a provider's Retry-After; a replayed memo reports its remainder as the additive replayForMs, which the per-instance layer honors exactly. - One decode/verify path for stored tokens; the stored-failure permanence check uses isPermanentTokenFailureCode instead of building an error. * fix(credentials): honor every minter's Retry-After and close token fallback gaps - Carry the token endpoint's Retry-After on 429/503 failures from every bespoke client-credential minter (Box, Zoom, DocuSign, NetSuite, Help Scout, Ramp, Jama, Zendesk, Salesforce, Zoho Desk) and through the CrowdStrike, SailPoint and ZoomInfo client errors, so their throttled answers wait as long as the provider asks instead of the fixed backoff. - Recheck the 30 s expiry margin when the per-instance cache falls back to a still-valid token after a slow failed refresh. - Map an unreadable Vanta token body to provider_unavailable so it is remembered for every worker and paced at 15 s like any failed exchange. - Remember a refusal whose code the shared failure row cannot store with an additive `refusal` flag, so a replay never serves the stale token. - Rename the credentials helper to throttledRetryAfterMs so it no longer shares a name with providers/retry.ts. * fix(credentials): keep throttling and outage backoff streaks apart and redact the fallback log in selector mode * fix(credentials): end a refused token, read legacy refusals as refusals, and keep throttle delays through SailPoint and CrowdStrike - A refusal of the credentials drops the per-instance cached token and expires the shared token minted with that secret, so a later outage cannot serve it again. - A previous build's provider_unavailable memo with a non-transient 4xx status replays as a refusal instead of serving the stored token. - The SailPoint saved-credential minter returns the first 429 with its Retry-After instead of retrying until the exchange timeout swallows it. - A CrowdStrike error whose body cannot be read keeps its status and Retry-After. - Vanta logs a malformed or oversized token response apart from an unreadable stream. * fix(credentials): keep SailPoint throttle delays through unreadable error bodies and replay only coordinated failures locally - A SailPoint token error whose body cannot be read keeps its status and Retry-After, as CrowdStrike's does; caller cancellation still propagates. - A shared-token (Vanta) mint failure is replayed per instance only when the coordinated layer remembers it (replayForMs); a failure it does not remember asks again at once. * fix(credentials): skip the fallback token once a provider refused it during the failed refresh
…B Insights, Railway, and Qdrant; fix Kalshi Ed25519 signing (#9927) * fix(kalshi): sign requests with Ed25519 keys, the type Kalshi generates by default Kalshi picks the verification algorithm from the registered public key: Ed25519 over the pre-sign text, or RSA-PSS SHA-256 for an RSA key. The signer always passed the sha256 digest and PSS padding, which Node and Bun refuse for an Ed25519 key, so every authenticated call with a default key failed before it was sent. The key type is now read from the parsed key (a PKCS#8 RSA key shares the Ed25519 PEM header), and any other key type is refused. * feat(amplitude): saved project credential and a credential-only Amplitude block An Amplitude credential holds a project's API key, secret key, and data residency region, verified by listing the project's events on the region's Dashboard REST host with the Basic key pair the tools send (Amplitude answers 403 for either key being invalid). The region and key shapes are checked before any request. Each tool group maps only the params it declares: analytics tools take both keys and the region, ingestion tools the API key and region, and User Profile the secret key. The legacy block keeps its inline keys and is hidden from the toolbar in favor of amplitude_v2. * feat(kalshi): saved API key credential and a credential-only Kalshi block A Kalshi credential holds an API key ID and its private key, verified by a free balance read signed the way the tools sign every authenticated call; a key that cannot sign or a key ID that would break the header is refused before any request. The tools that sign requests map the key ID and private key from the credential, while market data stays public, so kalshi_v3 shows the credential picker only on account and trading operations. Token credential fields gain an optional multiline flag so the connect form keeps a pasted PEM key's line breaks. kalshi and kalshi_v2 keep their inline keys and now point at kalshi_v3. * feat(splunk): saved authentication token credential and a credential-only Splunk block A Splunk credential holds an authentication token and the management URL, verified by reading authentication/current-context (documented, no capability needed) through the guarded egress with the URL normalized as the tools build it; an answer without a user context is not taken as proof, and certificate verification is never relaxed. The tools send the token whenever one is set, so the credential policy marks the inline username and password as replaced by the token: tokenCredentialOAuth gains an optional list of such params, and the saved-credential contract accepts any token-filled param (not only accessToken) beside them. splunk keeps its inline connection fields and points at splunk_v2. * feat(cbinsights): saved API client credential and a credential-only CB Insights block A CB Insights credential holds the client ID and secret, verified by exchanging them at POST /v2/authorize, the call the tools make before their first request; a success without a token is not taken as proof, and the error body is never logged. The tools keep minting and caching their own token per run, so the credential fills the same client ID and secret they take inline. The lookup's profileUrl is request data sent to api.cbinsights.com, recorded as such in the saved-credential contract. cbinsights keeps its inline client fields and points at cbinsights_v2. * chore(audits): shrink the unused-exports baseline for exports now in use The Kalshi signer is exercised by its tests and the CB Insights API base by the saved credential check, so neither is unused any more. * test(credentials): cover a token-replaced sign-in whose token fills a param other than accessToken The saved-credential contract now accepts any credentialParams entry filled with the token beside tokenReplacesParams (Splunk's authToken), and names that in its error. * feat(railway): saved token credential, type-aware, and a credential-only Railway block A Railway credential holds a token, its type (account, workspace, or project), and for a workspace token the workspace ID. Each type is verified with the read Railway documents for its scope, since `me` answers only an account token: an account token reads `me`, a workspace token reads its workspace by ID (passed as a GraphQL variable), and a project token reads `projectToken` with the Project-Access-Token header the tools send for it. A GraphQL error or a body without the queried object is not taken as proof. The tools receive the token and its type, so a project token keeps its own header. Token credential fields gain an optional flag: an optional field is left out of the required create fields, the connect form does not require it and omits it when blank, and the secret builder stores it only when set. Existing descriptors declare no optional field, so their required fields and stored secrets are unchanged. railway keeps its inline token and points at railway_v2. * feat(qdrant): saved API key credential bound to its instance URL, and a credential-only Qdrant block A Qdrant credential holds a database API key and the instance URL, verified by listing collections (a read every key may run; a collection-scoped key sees a filtered list) with the api-key header the tools send, through the guarded egress with the URL normalized as the tools build it. An answer without a collection list is not taken as proof. The tools receive the key and the verified URL, so a run reaches only that instance. qdrant keeps its inline URL and optional key, which a self-hosted instance without an API key still needs, and points at qdrant_v2. The successor test matrix counts a field repeated per operation (Qdrant's URL) once. * fix(credentials): honor an optional domain field in the token secret builder The optional flag was honored by the create contract and connect form for any field, but the secret builder only applied it to the workspace ID and still required any domain field. Derive both the same way, and store a domain only when it is required or supplied. No descriptor marks a domain optional today, so stored secrets are unchanged. * fix(amplitude): send both saved keys to User Profile over Basic auth Amplitude's User Profile API documents only Basic authentication with the project API key and secret key. A saved Amplitude credential now fills the API key too, and the tool sends Basic auth whenever an API key is present. Inline calls that pass only the secret key keep the Api-Key header they sent before. * test(kalshi): keep only the signer cases that guard the key-type fix Drop the PKCS#1, query-string, literal newline and auth-header cases, which restate unchanged behavior or repeat the validator's Ed25519 check. * docs(amplitude): note that User Profile sends both saved keys in the v2 block TSDoc * fix(railway): require the workspace ID in the connect form once the token type is workspace * chore(audits): re-record the tool-registry boundary baseline for the new credential validators * fix(amplitude): default the saved credential's data residency to us
#9934) * feat(connectors): sign S3 connector requests with a seeded AWS session The S3 knowledge connector can now sign with keys a saved AWS credential resolved to, read from the run's syncContext. STS session tokens are sent as x-amz-security-token and included in the SigV4 signed headers. A saved credential signs only for Amazon S3 in an AWS region: a custom endpoint is refused so an AWS session never reaches an S3-compatible host. Inline keys sign exactly as before. * feat(knowledge): let a key connector sync with its declared saved credential A key-based connector may now declare a saved-credential alternative (auth.savedCredential); Amazon S3 declares a saved AWS credential. A row that names a credential resolves it for the knowledge base's own scope through the same owner check and STS exchange AWS tools use, and the resolved session is seeded into syncContext. Rows that store a key keep using it, and key-only connectors are unchanged. - connectorUsesCredential/connectorHasAuthSource decide the auth source in one place for the resolver, sync engine, validation and setup. - resolveConnectorAccessToken takes the knowledge base scope. - A run token reuses an STS session until shortly before it expires and re-seeds syncContext when it is replaced. - Setup with a saved credential is gated by the global knowledge-connector-saved-credentials flag: workers from an earlier release read a key connector without a key as credential-removed and unschedule it, so the flag stays off until the release is live on the app and Trigger.dev. - The connector catalog and v2 contract gain optional savedCredential and apiKeyOnly fields; generated OpenAPI, CLI API and CLI docs updated. - Adds a central mock for @/lib/internal/aws/credentials. * feat(knowledge): offer a saved AWS credential when setting up an S3 connector When knowledge-connector-saved-credentials is on, the add-connector modal lets Amazon S3 authenticate with a saved AWS credential instead of its access keys, hides the key-only Access Key ID and custom endpoint fields, and never sends values typed into them. The edit modal keeps the credential replaceable for a connector that syncs with one, including after its credential was removed. Inline keys stay the default. * docs(knowledge): describe the S3 connector's saved AWS credential option * fix(knowledge): refuse moving a stored-key connector onto its saved credential The access update accepted a credentialId for a key connector that still stored its key. The key stayed on the row and took over again, silently, once the credential was deleted. Switching auth source now means creating the connector anew, as it did before saved credentials. * fix(knowledge): classify saved AWS credential failures and labels consistently - Share the AWS failure message and transient check with the AWS tools, so STS throttling or an IdP outage during setup is no longer a 400. - Refuse another service's credential on S3 creation, as access updates do. - Return an empty access token for a saved AWS credential, not its id. - Record saved-credential connectors as authMode savedCredential in audit. - Narrow savedCredential.provider to aws, the only provider that resolves. - Derive create's key-vs-credential choice from connectorUsesCredential and rename the run-token refresh. * fix(connectors): sign saved AWS credentials only for commercial and GovCloud S3 China regions serve S3 under amazonaws.com.cn and the isolated partitions under their own domains, so a saved credential for them failed with an opaque DNS error. Refuse them with a clear message instead. * docs(knowledge): state saved-credential availability and rollback limits Catalog and connector credentialId descriptions say saved credentials work once the deployment enables them, the connector credentialId field covers saved credentials, and the flag notes that a release rollback is unsafe once any connector uses one. Regenerates OpenAPI, CLI API and CLI docs. * fix(knowledge): redact saved AWS session secrets and share the credential service check A saved AWS credential resolves to an empty bearer with its secret key and session token in awsSession, so redacting accessToken alone left them in provider validation text. Both validation sites now redact every secret the resolved token carries (connectorTokenSecrets). Setup and access updates now share requireConnectorCredentialService, so a key connector's saved-credential setup refuses a missing service config instead of skipping the provider check. * fix(knowledge): keep long-lived saved AWS keys per run and gate saved-credential edits on rollout - Reuse a saved AWS credential without a session token for the whole run instead of reloading it on every page and hydration - Hide the edit form's saved-credential replacement while saved-credential setup is disabled, matching the server gate - Classify a connector whose credential service has no config as internal, not caller-fixable - State in the v2 catalog that apiKey connectors with savedCredential accept credentialId * docs(knowledge): describe the saved-credential provider as a service, not an OAuth service * test(llm): mock AWS credentials through the central @sim/testing mock
…ical, and Google Ads (#9928) * feat(google-ads): accept a Google service account JSON key Google Ads now offers the google-service-account credential: a service account added as a user of the Ads account signs in as itself with the adwords scope (developer tokens were retired). Keyless Google credentials stay refused because Google documents no Workload Identity path for Ads. * feat(infisical): log machine identities in with Universal Auth Infisical credentials gain a Universal Auth mode: the machine identity's client ID and secret are stored instead of a pasted access token, and Sim logs in at the credential's instance through the configured-endpoint egress guard whenever its token expires. One coordinated token serves every credential for an identity, so logins don't multiply per worker. Pasted access-token credentials are unchanged. Adds postToConfiguredTokenEndpoint, the guarded token request for hosts taken from a validated credential field. * feat(servicenow): connect with an OAuth client's client credentials ServiceNow credentials gain an OAuth client credentials mode beside the username and password login. The client ID and secret are stored, and Sim mints a token at the instance's /oauth_token.do through the configured-endpoint egress guard, shared across workers. The minted token resolves with authStyle 'bearer', which the ServiceNow tools and the attachment upload operation send as a bearer token. Saved logins store and resolve exactly as before. Shared changes, each additive: exchangeClientCredentialsGrant takes an egress option for configured hosts; a tool policy can name mapped params a credential mode lacks (optionalCredentialParams), which are cleared rather than failing; a token descriptor field can belong to the pasted-token mode only; a token check's account id may be absent for a sign-in mode. * feat(snowflake): connect with an RSA key pair Snowflake connections gain a key-pair mode beside keyless workload identity and programmatic access tokens. Sim stores the user's unencrypted RSA private key and signs a JWT for every run (iss ACCOUNT.USER.SHA256:<fp>, sub ACCOUNT.USER, uppercased, 59-minute lifetime) that tools and selectors send with the KEYPAIR_JWT token type. The account comes from the host the way Snowflake's drivers derive it. Key pairs need no workload identity, so organization connections and deployments without a signing key can use them; the connect dialog now always offers them. Token and keyless credentials store and resolve exactly as before. Host hints now name .snowflakecomputing.cn, which the validator, tools, and selectors already accept. * refactor(servicenow): keep the Basic header builder private to its utils serviceNowAuthorization is now the only caller, so the export was unused. * fix(snowflake): name an underscore account the same from either of its hostnames Snowflake also serves an account whose name has underscores at a hostname with hyphens in their place. Organization names hold only letters and numbers and account names never hold a hyphen, so every hyphen after the first in an org-account host label is a replaced underscore and is restored before the key-pair JWT names the account. The derivation moves next to normalizeSnowflakeHost and its suffix list. The connection secret type is renamed for the three modes, and the modal shares one saved- connection submit hook. * refactor(credentials): share the token response reader with the Infisical login readAccessTokenResponse holds the refusal classification, capped JSON read, token and lifetime checks, and lifetime cap that exchangeClientCredentialsGrant and the Infisical Universal Auth login both need. An Infisical expiresIn of 0 (an access token TTL of 0) is served for the daily cap instead of failing as an outage. egress and fetchOptions become a discriminated union, and the configured-endpoint guard's own cases are tested where it lives. * refactor(servicenow): tighten the saved-credential params and auth types The hidden credential params become a constant like Zendesk's, the upload schema accepts only the bearer authStyle, and serviceNowAuthorization takes an optional username so the upload client no longer fakes one. A pasted-token-only descriptor field stays hidden until that mode is chosen and is never required in client-credentials mode. * fix(snowflake): list the key-pair connection in the credential provider catalog * refactor(servicenow): mark the username with requiredForAuthMethods so the catalog scopes it to the password sign-in * fix(snowflake): verify key pairs through the egress guard and leave an organization reconnect's mode unchosen Key-pair validation now sends its signed JWT through the same guarded egress path as keyless, so an account host that resolves to a private address is refused as host_not_allowed. An organization credential's stored mode is not reported, so its reconnect starts with no mode chosen instead of defaulting to a programmatic access token. The Infisical and ServiceNow grant tests use the shared jsonResponse helper. * fix(snowflake): mask the key-pair private key when unfocused and type the key-pair header test The key-pair private key textarea hides its value off focus, matching the Google JSON key field, and the new getSnowflakeHeaders case passes the oauthCredential its params type requires. * fix(snowflake): accept underscore account hosts in the connect form and state the key-size ceiling * fix(credentials): expire a coordinated token an internal operation's provider refuses
#9929) * refactor(credentials): share the owner-scoped service-account secret read Oracle Database's saved-connection lookup now reads its row through one owner-scoped helper, so the saved database connections that follow bind to their owner and provider the same way instead of copying the query. * feat(credentials): saved PostgreSQL, MySQL, and SQL Server connections Adds three service-account providers (postgresql-, mysql-, and mssql-service-account) that store a database connection: host, port, database, login, password, and the SSL mode or SQL Server encrypt and trust-certificate settings. Saving proves the connection with SELECT 1 through each family's own query operation, so host validation and IP pinning match a real run, and only then encrypts it; driver errors are never surfaced. The connection is read back inside the tool operation, bound to the run's workspace or organization, by withSavedDatabaseConnection, which replaces every connection field in the call so a caller or model cannot steer a shared credential. One client-safe descriptor table drives the provider ids, required fields, provider catalog, token resolvers, secret builders, and a shared connect modal. * feat(database-tools): run PostgreSQL, MySQL, and SQL Server tools on a saved connection Every PostgreSQL, MySQL, and SQL Server tool now declares an optional service-account credential policy (required: false), so its inline connection fields keep working unchanged and a saved connection can stand in for them. The executor authorizes the selected credential and passes it through trusted context; the family's operation handler, wrapped by withSavedDatabaseConnection, reads the stored connection bound to the run's owner and replaces every connection field before parsing. The providers resolve inside the operation, like AWS, so they join OPERATION_RESOLVED_CREDENTIAL_PROVIDERS. A real-Postgres integration test saves a connection (SELECT 1 through the guarded path), refuses one the server rejects, runs a query on the saved connection whatever fields the call carries, and refuses it to another workspace and once revoked. * feat(blocks): credential-only PostgreSQL, MySQL, and SQL Server blocks postgresql_v2, mysql_v2, and mssql_v2 spread their legacy blocks and swap the connection fields (host, port, database, username, password, and SSL mode or SQL Server encrypt and trust-certificate settings) for a saved connection picker through withSavedCredential. Their canvas sentences drop the database clause the block no longer holds. The legacy blocks change only by hideFromToolbar and a legacy sunset pointing at the successor, so existing workflows keep their inline connection fields and run exactly as before. Generated block successors, docs, icon maps, and deployment metadata are regenerated. * docs(integrations): set up saved PostgreSQL, MySQL, and SQL Server connections Each page's intro now explains adding a saved connection, how Sim proves it before saving, what every SSL mode or SQL Server TLS setting does in the runtime's drivers, and that existing workflows keep their inline connection fields. * refactor(database-tools): wrap SQL families at registration and derive saved-connection schemas from the operations - Register the PostgreSQL, MySQL, and SQL Server families through registerSavedDatabaseFamily, which applies withSavedDatabaseConnection and records each tool id's service. A registry test now fails when a tool that names a saved database connection runs outside a wrapped family, the case the saved-credential contract skips for operation-resolved providers. - Build the stored connection schemas from each operation's own connection schema (bounds tightened, strict), so the TLS values and defaults have one source. Stored blobs decode exactly as before. - Reuse the SQL Server default connection timeout instead of repeating it, and parse a submitted connection once. - Unit tests prove save-then-run round trips and drive refusals through the run wrapper; the workspace and revocation cases stay in the integration test, which now runs through the registered operation. * fix(credentials): describe saved-connection TLS modes as the drivers apply them - MySQL Required verifies the certificate chain but not the host name (like VERIFY_CA), and both Preferred and Required refuse a server without TLS. - SQL Server Encrypt connection requests TLS; a server that does not support encryption gets an unencrypted session rather than an error. - PostgreSQL Preferred can be downgraded by an on-path attacker, so the hint and docs steer to Required when the server supports TLS. - Picker options are keyed by each operation schema's value type, so a mode the operations add or drop fails to compile instead of drifting. * refactor(credentials): derive stored database connection fields and credential-supplied params from one list The stored v1 schema now picks exactly the descriptor's login and TLS fields out of each operation schema instead of extending the whole schema, and the tools' credentialSuppliedParams come from the same list. An operation field added later can no longer change the stored blob, get pinned on every run, or stay visible on the credential-only block. * fix(credentials): validate the saved-connection port in the form and carry TLS tradeoffs into the provider catalog The connection modal now refuses a port that is not a whole number from 1 to 65535 and says so beside the field, instead of a generic verify failure. The v2 provider catalog hint for saved PostgreSQL, MySQL, and SQL Server connections now includes each transport-security field's tradeoff, so API callers see what Preferred, Encrypt, and Trust server certificate give up. The integration fixture decodes the database name from TEST_DATABASE_URL. * docs(credentials): document the database connection provider id helpers * fix(credentials): keep an encryption failure on a verified database connection a server error * docs(credentials): document the database connection descriptor and id types * docs(databases): describe the PostgreSQL, MySQL and SQL Server connection setting types
…r-period metering tally (#9921)
… and Staying Power Compared (#9941) Co-authored-by: Sim Pi Agent <pi@sim.ai>
…CLI, Apollo OAuth people search, and one short SailPoint throttle wait (#9943) * fix(credentials): Splunk password sign-in, Snowflake key pair in the CLI, Apollo OAuth people search, and one short SailPoint throttle wait * fix(credentials): keep a Splunk password's surrounding spaces, and report page 1 when Apollo is asked for page 0
…y second (#9945) * fix(mothership): back off the transport poll instead of retrying every second * fix(mothership): end a transport outage only after the whole poll iteration succeeds
…nd expose missing params (#9947) * fix(google): validate Workspace integrations, return dropped fields and expose missing params Gmail read/search/thread/draft and the Gmail trigger now return Cc, Bcc, Reply-To, Message-ID, In-Reply-To, References, snippet, and internalDate. Sweeps Calendar, Meet, Drive, Docs, Sheets, Slides, Forms, Contacts, Tasks, Groups, and Vault against the Google API references. All changes are additive: no param, subBlock, operation, tool id, or output is removed or retyped. * fix(google): address review findings and CI audits - Vault shared drives use sharedDrivesOption; reject unprocessed scope outside Mail/Groups - Sheets: reject COLUMNS reads with a row filter, guard v1 spreadsheet ids, expose includeValuesInResponse on v2 writes - Groups list sends userKey exclusive of customer; Drive caps the metadata error body - Slides reads WordArt text and marks nullable outputs; Calendar validates raw reminder minutes and exposes the list time zone - Contacts rejects year 0000; Gmail labels output typed as json; audit and baseline fixes * chore(google): regenerate tool metadata after rebase * fix(google): tighten Docs tab/number parsing, normalize Slides soft breaks, reuse jsonResponse helper
…mission-group restriction (#9944) * feat(computer-use): enable computer use by default, governed by a permission-group restriction Removes the mothership-computer-use feature flag. Each device still opts in under Settings > Desktop > Computer Use; enterprise admins can withhold it with the new Computer Use permission-group restriction (computer_use.use, which also follows Chat). * fix(computer-use): hide device settings until the permission group is known Also gives the local-files e2e settings fixture a QueryClient now that the Desktop page reads the permission config. * fix(computer-use): read the permission group with the lightweight query hook usePermissionConfig pulls the block and provider registries into the Desktop settings bundle; the settings gate only needs the user's resolved config. * fix(computer-use): mount the device controls only once the permission group allows them Their effects no longer call the native helper for loading or restricted members.
…ense write paths (#9946) * improvement(aws-marketplace): close billing gaps and simplify the license write paths - Refuse linking a Marketplace license to an organization already paying Stripe for a self-serve plan, so it is never billed twice - Count only listings this deployment sells when blocking Stripe checkout - Never add to a usage record after it is frozen for sending, even under a lock taken for another organization - Container license: require a grant the account may use, and stagger replica restarts on a license change - CloudFormation prerequisites: a fixed URL-safe database password instead of RDS's rotating one; placeholder product ID in the example values - One insert path, one claim invariant, and one once-only notice helper in the repository; shared claim lookup, lock recheck, and audit entry in the use cases * fix(aws-marketplace): treat any live bound Stripe subscription as billing the organization - A trialing or incomplete self-serve subscription becomes a charge, so linking refuses any bound subscription that is not finished; an abandoned checkout with no Stripe subscription stays linkable - Example values name the CloudFormation outputs as secret ARNs and mark the product ID as editable * chore(helm): bump chart to 1.11.16 for the Marketplace example changes
… and fewer false refusals (#9953) * fix(desktop-browser): keep a ref whose name grew when its own menu opened * fix(desktop-browser): give text lines the identity name the resolver recomputes * improvement(desktop-browser): keep an element on the same ref across snapshots * improvement(desktop-browser): show the page at the end of every browser_wait_for * improvement(desktop-browser): resolve refs from earlier snapshots while their element lives * chore(desktop-browser): compare issued-ref frames by identity instead of a string key * fix(desktop-browser): type into a top-page field that a non-modal overlay covers * chore(desktop-browser): one bounded ref store per page and driver, shared frame and observe helpers * fix(desktop-browser): tighten ref reuse, name growth, and covered typing per review * fix(desktop-browser): bound remembered refs per page above the page's own store
…eep (#9954) * fix(google): close post-merge verification gaps from the Workspace sweep - Sheets V2 Append gets its own Value Input Option field so a value stored for Write/Update no longer reaches Append - Sheets legacy read guards the spreadsheet id; the COLUMNS check only fires when a filter actually runs - Calendar reminders accept the API's {overrides} object; updatedMin notes deleted events are included - Drive search skips orderBy for fullText queries, which Drive rejects - Docs number parsing ignores booleans; Tasks trims a blank task list id to @default - Forms trigger respondentEmail marked optional; Slides block exposes layout/notes/master properties * fix(google): keep reminder useDefault, detect fullText outside quoted values, accept numeric task list ids * fix(google): require a boolean useDefault in reminder objects
…s and expose missing params (#9949) * fix(microsoft): validate Microsoft integrations, return dropped fields and expose missing params Sweeps Outlook, Teams, OneDrive, Word, SharePoint, Excel, Planner, Intune, Entra ID, Power BI, Dataverse, Dynamics 365, Azure DevOps, and Azure Data Explorer against the Microsoft API references. Outlook read/search and the Outlook trigger now return Bcc, Reply-To, internetMessageId, flags, and categories. All changes are additive: no param, subBlock, operation, tool id, or output is removed or retyped. * fix(microsoft): address review — Outlook poller retries, SharePoint filter guard, opt-in Entra manager * fix(microsoft): address review round 2 — Dataverse nextLink table binding, offboarding roles, SharePoint hidden filters * fix(microsoft): Teams Get Message sender falls back to bot name; clarify SharePoint site search scope * fix(microsoft): zero-drift fixes from verification — dedicated subBlock ids, restored legacy outputs and caps * fix(microsoft): reserve ADX table envelopes up front, log skipped Outlook attachments, tighten SharePoint upload path * fix(microsoft): shared toStringOrNull in AzDO mapper, null relations when unexpanded, per-file SharePoint name errors
…ls the whole target (#9956) * improvement(desktop-browser): click through a nested control that fills the whole target * fix(desktop-browser): click through only a native top-page click onto a control that covers the whole target * test(desktop-browser): exercise the form-field click-through guard directly
* fix(aws): validate AWS integrations against SDK and API docs
Fixes DynamoDB items failing or serializing as {} (BigInt, sets, binary), RDS
SELECT rowCount always 0, Athena dropping the first row of DDL results, SES
templated/bulk sends missing Reply-To and bulk Cc/Bcc, Lambda dropdowns forcing
values on update, and binary Secrets Manager secrets. Adds missing documented
params and dropped response fields across the suite. All changes are additive.
* fix(aws): keep stale and empty subBlock values out of tool input
The executor merges raw block inputs under the mapped params, so new params
named like an existing subBlock picked up values from other operations or
empty table rows. Always assign those keys in the block mappers (DynamoDB,
SES, CloudFormation, IAM, STS), tolerate string booleans and blank values in
the affected tools, add the remaining SDK partition SQS hosts, split long
non-ASCII SES From names into RFC 2047 words, and address review findings.
* fix(aws): address review round and close remaining empty-value leaks
Send no IAM usage filter for All, assign Secrets Manager create/update KMS
key and tags explicitly, accept object or key/value IAM tag rows, reject
non-array SES email tags, require DynamoDB parallel-scan segments together
and below the total, restrict string scanIndexForward to true/false, and fix
SES test typing.
* fix(aws): restrict string consistentRead to true/false and validate SES tag parts
* fix(identity-center): always assign the list_account_assignments account filter
* fix(ses): drop the new email attachments path from this sweep
Attachment authorization goes through context.userId, the same shared
boundary other integrations use; adding a new file-egress path is out of
scope for a compatibility-first validation sweep.
…ncommitted ref reuse (#9959) * fix(desktop-browser): refuse reissued earlier refs and recover from uncommitted ref reuse * fix(desktop-browser): keep new markers and frame checks across a recapture
…and Microsoft sweeps (#9960) * fix(integrations): close stale and empty value leaks from the Google and Microsoft sweeps Final staging-to-main review of #9947, #9954 and #9949. The executor merges raw subBlock values under the block mapper's output, so a value stored for another operation (or an empty default the serializer fills in) reached tools whenever the mapper skipped that key. - Outlook: reply, reply-all and forward always set cc/bcc, so a Send cc never reaches them; send and draft always set importance; the new Importance dropdown defaults to unset - Google Groups Update Settings assigns every setting, so unchanged settings are never sent as '' - Google Tasks List assigns its tri-state filters and the tool skips empty values - OneDrive "If File Exists" defaults to unset so opening an old upload block sends nothing new - Google Sheets clears a Batch Get major dimension for every other operation - Azure DevOps: List Pipelines and Get Comments keep main's Max Results fallback, each paged operation has its own continuation token, and multi-item reads omit the raw field bag - SharePoint upload drops "." folder segments as before and still rejects ".." - Entra transitive and includeManager use one strict flag check; Dataverse treats a cleared page size as unset - Behaviour-neutral cleanups: shared header lookup (Gmail), settings mapper (Groups), identity and metadata outputs (Word), isSet (Dataverse), graphPathSegment (SharePoint), typed identity reads (Azure DevOps), Teams fallback payload nulls * fix(integrations): render Azure DevOps list outputs in docs, clear stale Outlook importance on replies
…#9961) * fix(atlassian): address final review Make Jira search heavy fields (ADF description, custom fields, attachments, links, subtasks) opt-in through fields, move transformIssueData into jira/utils, keep AQL order by splitting at parenthesis depth 0, let the object-types /flat fallback never add a failure, send next=true with Confluence search cursors, and harden Trello ID lists, Jira parent, and Confluence comment ids for agent calls. * fix(aws): address final review Share the optional-boolean parse through @sim/utils/coerce toBooleanFromInput, the IAM tags schema through iam-shared, and the SES message-tag schema through ses-shared. Accept SES email tags as a JSON string from agent calls, name the field on Secrets Manager JSON errors, accept JSON-array IAM tag strings and skip null tag values, and reject a JSON-object Textract query string. * fix(integrations): address review on the final pass Treat only a leading [ as a JSON Textract query list, reject JSON-array IAM tag strings and SES email-tag strings that do not parse to valid entries, name Secrets Manager tag JSON errors, restore the JSM list TSDoc placement, and shrink the explicit-any baseline after the Jira mapper move. * fix(integrations): reject JSON-object Textract queries only when they parse, keep null IAM tag values as empty * fix(textract): use isRecordLike for the JSON-object query check
… Snowflake, Microsoft, and Google credentials (#9962) * feat(credentials): configurable audience for keyless AWS, Databricks, Snowflake, Microsoft, and Google credentials * fix(credentials): check the audience in the connect dialog before showing setup commands * fix(credentials): name Google's default audience in the keyless catalog hint
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
| GitGuardian id | GitGuardian status | Secret | Commit | Filename | |
|---|---|---|---|---|---|
| 40009848 | Triggered | Generic Password | 8fbc750 | helm/sim/examples/aws-marketplace-prerequisites.yaml | View secret |
🛠 Guidelines to remediate hardcoded secrets
- Understand the implications of revoking this secret by investigating where it is used in your code.
- Replace and store your secret safely. Learn here the best practices.
- Revoke and rotate this secret.
- If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.
To avoid such incidents in the future consider
- following these best practices for managing and storing secrets including API keys and other credentials
- install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.
🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.
Contributor
 [Critical impact] The PR reaches credential use, external billing, and desktop access across multiple workflows. The PR is not ready to merge because DynamoDB pagination remains broken for large numeric keys, and the testing requirement remains unmet. Findings
SummaryThis release expands saved credentials and updates integration behavior.
|
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
All reported issues were addressed across 1326 files
Note: This PR contains a large number of files. cubic selects up to 200 of the highest-priority eligible files for this review, so some files may not have been reviewed.
Turn on auto-fix | Re-trigger cubic
5 of 6 tasks
* fix(tests): wait for the job lane's first leg text to persist before killing its process The takeover test aborted the turn as soon as the fake worker had written the first leg, before the dying process had recorded that text in its stream buffer. The re-attach then carried receivedTextChars 0 and the occurrence's summary lost the first leg. Wait for the text event in the buffer first, as the unattended-turn suite already does. * fix(tests): handle the cancelled token-sealing run's rejection before polling for its backend The operator-cancel test started migrate() and only attached a handler after its pg_cancel_backend polling loop. When the cancellation reached the run's connection before the loop broke, Node saw an unhandled rejection and Vitest failed the whole db shard even though every test passed. Attach the rejection assertion when the run starts and await it after the loop. * fix(tests): handle the refused provider expansion before awaiting the concurrent grant The concurrent-grant test started ensureWorkspaceAccountsGroup and awaited the grant transaction before attaching a handler to the refusal. When the refusal resolved first, Node reported an unhandled rejection and Vitest failed the shard although the test passed. Attach the rejection assertion when the call starts and await it after the grant commits. * chore(ci): log lock waits and slow statements in the integration Postgres
Merged
6 tasks done
…s search outputs (#9965) * fix(integrations): return the Dataverse page size and correct Contacts search outputs - Dataverse List Records returns the page size it sent (odata.maxpagesize) so a loop can pass it back with nextLink, since Dataverse requires the same value on every page; the request header and the output share one resolver - Page Size placeholder and input description now say the default applies only without Max Results and that the value must stay the same across Next Page Link pages - Google Contacts metadata description no longer claims search returns nextPageToken/totalItems * fix(integrations): document the null Dataverse page size output
…ttempt in Router and Evaluator (#9968)
…d confirm ref reuse names the same element (#9966) - browser_wait_for's native watchdog adds a standalone snapshot's 20s budget for the snapshot a wait now ends with; the renderer's wait grace widens to 30s to cover it - Ref reuse also requires the stored entry to point at the same element - Rename a local that shadowed elementTarget
… CloudWatch statistics (#9967) * fix(aws): round-trip typed DynamoDB cursors and allow percentile-only CloudWatch statistics Encode large-number and binary keys in lastEvaluatedKey as {N}/{B} and decode them in exclusiveStartKey, so pagination resumes on tables whose keys a JS number or string cannot carry. Item output is unchanged. Let get_metric_statistics take extendedStatistics alone: statistics is optional and the contract requires one of the two. * fix(dynamodb): keep inexact decimal keys exact in pagination cursors Hold every N value a JS number cannot represent exactly as a NumberValue so the cursor encodes it as {N}; item output keeps the same number/string rule. * fix(dynamodb): treat a number as exact only when its string form round-trips A decimal like 1.0000000000000000001 parses to a safe integer, so the safe-integer shortcut dropped its digits. Return a JS number only when String(parsed) equals the DynamoDB value (and it is not an unsafe integer); item output is unchanged.
…quote the docs client ID, and correct a stale comment (#9970)
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.