+
+ expect(mockRunCloudReview).toHaveBeenCalledTimes(1)
+ expect(mockRunCloud).not.toHaveBeenCalled()
+ const params = mockRunCloudReview.mock.calls[0][0]
+ expect(params.mode).toBe('cloud_review')
+ expect(params.pullNumber).toBe(7)
+ expect(params.reviewEvent).toBe('REQUEST_CHANGES')
+ expect(params).not.toHaveProperty('skills')
+ expect(params).not.toHaveProperty('initialMessages')
+ expect(mockResolveSkills).not.toHaveBeenCalled()
+ expect(mockLoadMemory).not.toHaveBeenCalled()
+ expect(mockAppendMemory).not.toHaveBeenCalled()
+ expect(output.reviewUrl).toBe('https://github.com/o/r/pull/7#pullrequestreview-1')
+ expect(output.commentsPosted).toBe(2)
+ expect(output.content).toBe('looks good')
+ })
+
+ it('requires SSH fields in Local Dev', async () => {
await expect(
handler.execute(ctx(), block, { mode: 'local', task: 'x', model: 'claude', host: 'h' })
- ).rejects.toThrow(/Local mode requires/)
+ ).rejects.toThrow(/Local Dev requires/)
})
- it('requires repo + token in cloud mode', async () => {
+ it('requires repo + token in Create PR', async () => {
await expect(
handler.execute(ctx(), block, { mode: 'cloud', task: 'x', model: 'claude', owner: 'o' })
- ).rejects.toThrow(/Cloud mode requires/)
+ ).rejects.toThrow(/Create PR requires/)
+ })
+
+ it('requires pullNumber in cloud_review mode', async () => {
+ await expect(
+ handler.execute(ctx(), block, {
+ mode: 'cloud_review',
+ task: 'x',
+ model: 'claude',
+ owner: 'o',
+ repo: 'r',
+ githubToken: 'ghp',
+ })
+ ).rejects.toThrow(/Review Code requires/)
+ })
+
+ it.each(['0', '-1', '1.5'])('rejects invalid pull request number %s', async (pullNumber) => {
+ await expect(
+ handler.execute(ctx(), block, {
+ mode: 'cloud_review',
+ task: 'x',
+ model: 'claude',
+ owner: 'o',
+ repo: 'r',
+ githubToken: 'ghp',
+ pullNumber,
+ })
+ ).rejects.toThrow(/pullNumber/)
+ })
+
+ it('rejects autonomous approval reviews', async () => {
+ await expect(
+ handler.execute(ctx(), block, {
+ mode: 'cloud_review',
+ task: 'x',
+ model: 'claude',
+ owner: 'o',
+ repo: 'r',
+ githubToken: 'ghp',
+ pullNumber: '7',
+ reviewEvent: 'APPROVE',
+ })
+ ).rejects.toThrow(/COMMENT or REQUEST_CHANGES/)
+ expect(mockRunCloudReview).not.toHaveBeenCalled()
})
it('streams text when the block is selected for streaming output', async () => {
diff --git a/apps/sim/executor/handlers/pi/pi-handler.ts b/apps/sim/executor/handlers/pi/pi-handler.ts
index 986ab4a211c..a46637c70bd 100644
--- a/apps/sim/executor/handlers/pi/pi-handler.ts
+++ b/apps/sim/executor/handlers/pi/pi-handler.ts
@@ -12,12 +12,14 @@ import { parseOptionalNumberInput } from '@/blocks/utils'
import { BlockType } from '@/executor/constants'
import type {
PiBackendRun,
+ PiCloudReviewRunParams,
PiCloudRunParams,
PiLocalRunParams,
PiRunParams,
PiRunResult,
} from '@/executor/handlers/pi/backend'
import { runCloudPi } from '@/executor/handlers/pi/cloud-backend'
+import { runCloudReviewPi } from '@/executor/handlers/pi/cloud-review-backend'
import {
appendPiMemory,
loadPiMemory,
@@ -34,10 +36,13 @@ import type {
NormalizedBlockOutput,
StreamingExecution,
} from '@/executor/types'
+import { isPiSupportedProvider, resolvePiModelId } from '@/providers/pi-providers'
+import { getProviderFromModel } from '@/providers/utils'
import type { SerializedBlock } from '@/serializer/types'
const logger = createLogger('PiBlockHandler')
-const DEFAULT_MODEL = 'claude-sonnet-5'
+const DEFAULT_MODEL = 'claude-sonnet-4-6'
+const REVIEW_EVENTS = ['COMMENT', 'REQUEST_CHANGES'] as const
function asOptString(value: unknown): string | undefined {
if (typeof value !== 'string') return undefined
@@ -49,6 +54,15 @@ function asRawString(value: unknown): string | undefined {
return typeof value === 'string' && value !== '' ? value : undefined
}
+function isReviewEvent(value: string): value is PiCloudReviewRunParams['reviewEvent'] {
+ return REVIEW_EVENTS.some((event) => event === value)
+}
+
+function parsePiMode(value: unknown): PiRunParams['mode'] {
+ if (value === 'cloud' || value === 'cloud_review' || value === 'local') return value
+ throw new Error(`Invalid Pi mode: ${String(value)}`)
+}
+
export class PiBlockHandler implements BlockHandler {
canHandle(block: SerializedBlock): boolean {
return block.metadata?.id === BlockType.PI
@@ -62,42 +76,77 @@ export class PiBlockHandler implements BlockHandler {
const task = asOptString(inputs.task)
if (!task) throw new Error('Task is required')
const model = asOptString(inputs.model) ?? DEFAULT_MODEL
+ const mode = parsePiMode(inputs.mode)
- // Validate the mode up front so an invalid value reports a mode error rather
- // than a misattributed credential error from key resolution below.
- if (inputs.mode !== 'cloud' && inputs.mode !== 'local') {
- throw new Error(`Invalid Pi mode: ${String(inputs.mode)}`)
+ const providerId = getProviderFromModel(model)
+ if (!isPiSupportedProvider(providerId)) {
+ throw new Error(`Pi provider "${providerId}" is not supported`)
+ }
+ const piModel = resolvePiModelId(providerId, model)
+ if (!piModel) {
+ throw new Error(
+ `Pi model "${model}" is not available for provider "${providerId}" in the installed Pi catalog`
+ )
}
- const mode: 'cloud' | 'local' = inputs.mode
- const { providerId, apiKey, isBYOK } = await resolvePiModelKey({
+ const { apiKey, isBYOK } = await resolvePiModelKey({
+ providerId,
model,
mode,
workspaceId: ctx.workspaceId,
- userId: ctx.userId,
apiKey: asRawString(inputs.apiKey),
- vertexCredential: asOptString(inputs.vertexCredential),
})
- const skills = await resolvePiSkills(inputs.skills, ctx.workspaceId)
- const memoryConfig: PiMemoryConfig = {
- memoryType: asOptString(inputs.memoryType) as PiMemoryConfig['memoryType'],
- conversationId: asOptString(inputs.conversationId),
- slidingWindowSize: asOptString(inputs.slidingWindowSize),
- slidingWindowTokens: asOptString(inputs.slidingWindowTokens),
- model,
- }
- const initialMessages = await loadPiMemory(ctx, memoryConfig)
-
const base = {
model,
+ piModel,
providerId,
apiKey,
isBYOK,
task,
thinkingLevel: asOptString(inputs.thinkingLevel),
- skills,
- initialMessages,
+ }
+
+ if (mode === 'cloud_review') {
+ const owner = asOptString(inputs.owner)
+ const repo = asOptString(inputs.repo)
+ const githubToken = asRawString(inputs.githubToken)
+ const pullNumber = parseOptionalNumberInput(inputs.pullNumber, 'pullNumber', {
+ integer: true,
+ min: 1,
+ })
+ if (!owner || !repo || !githubToken || pullNumber === undefined) {
+ throw new Error(
+ 'Review Code requires repository owner, name, a GitHub token, and a pull request number'
+ )
+ }
+ const reviewEventRaw = asOptString(inputs.reviewEvent) ?? 'COMMENT'
+ if (!isReviewEvent(reviewEventRaw)) {
+ throw new Error(`Invalid review event: ${reviewEventRaw}. Use COMMENT or REQUEST_CHANGES.`)
+ }
+ const params: PiCloudReviewRunParams = {
+ ...base,
+ mode: 'cloud_review',
+ owner,
+ repo,
+ githubToken,
+ pullNumber,
+ reviewEvent: reviewEventRaw,
+ }
+ return this.runPi(ctx, block, runCloudReviewPi, params)
+ }
+
+ const memoryConfig: PiMemoryConfig = {
+ memoryType: asOptString(inputs.memoryType) as PiMemoryConfig['memoryType'],
+ conversationId: asOptString(inputs.conversationId),
+ slidingWindowSize: asOptString(inputs.slidingWindowSize),
+ slidingWindowTokens: asOptString(inputs.slidingWindowTokens),
+ model,
+ }
+ const contextualBase = {
+ ...base,
+ skills: await resolvePiSkills(inputs.skills, ctx.workspaceId),
+ initialMessages: await loadPiMemory(ctx, memoryConfig),
}
if (mode === 'local') {
@@ -105,13 +154,13 @@ export class PiBlockHandler implements BlockHandler {
const username = asOptString(inputs.username)
const repoPath = asOptString(inputs.repoPath)
if (!host || !username || !repoPath) {
- throw new Error('Local mode requires host, username, and repository path')
+ throw new Error('Local Dev requires host, username, and repository path')
}
const usePrivateKey = inputs.authMethod === 'privateKey'
const port = parseOptionalNumberInput(inputs.port, 'port', { integer: true, min: 1 }) ?? 22
const tools = await buildSimToolSpecs(ctx, inputs.tools)
const params: PiLocalRunParams = {
- ...base,
+ ...contextualBase,
mode: 'local',
repoPath,
tools,
@@ -127,29 +176,25 @@ export class PiBlockHandler implements BlockHandler {
return this.runPi(ctx, block, runLocalPi, params, memoryConfig)
}
- if (mode === 'cloud') {
- const owner = asOptString(inputs.owner)
- const repo = asOptString(inputs.repo)
- const githubToken = asRawString(inputs.githubToken)
- if (!owner || !repo || !githubToken) {
- throw new Error('Cloud mode requires repository owner, name, and a GitHub token')
- }
- const params: PiCloudRunParams = {
- ...base,
- mode: 'cloud',
- owner,
- repo,
- githubToken,
- baseBranch: asOptString(inputs.baseBranch),
- branchName: asOptString(inputs.branchName),
- draft: inputs.draft !== false,
- prTitle: asOptString(inputs.prTitle),
- prBody: asOptString(inputs.prBody),
- }
- return this.runPi(ctx, block, runCloudPi, params, memoryConfig)
+ const owner = asOptString(inputs.owner)
+ const repo = asOptString(inputs.repo)
+ const githubToken = asRawString(inputs.githubToken)
+ if (!owner || !repo || !githubToken) {
+ throw new Error('Create PR requires repository owner, name, and a GitHub token')
}
-
- throw new Error(`Invalid Pi mode: ${String(inputs.mode)}`)
+ const params: PiCloudRunParams = {
+ ...contextualBase,
+ mode: 'cloud',
+ owner,
+ repo,
+ githubToken,
+ baseBranch: asOptString(inputs.baseBranch),
+ branchName: asOptString(inputs.branchName),
+ draft: inputs.draft !== false,
+ prTitle: asOptString(inputs.prTitle),
+ prBody: asOptString(inputs.prBody),
+ }
+ return this.runPi(ctx, block, runCloudPi, params, memoryConfig)
}
private isContentSelectedForStreaming(ctx: ExecutionContext, block: SerializedBlock): boolean {
@@ -178,6 +223,10 @@ export class PiBlockHandler implements BlockHandler {
diff: result.diff ?? '',
...(result.prUrl ? { prUrl: result.prUrl } : {}),
...(result.branch ? { branch: result.branch } : {}),
+ ...(result.reviewUrl ? { reviewUrl: result.reviewUrl } : {}),
+ ...(typeof result.commentsPosted === 'number'
+ ? { commentsPosted: result.commentsPosted }
+ : {}),
tokens: {
input: totals.inputTokens,
output: totals.outputTokens,
@@ -197,7 +246,7 @@ export class PiBlockHandler implements BlockHandler {
block: SerializedBlock,
backend: PiBackendRun,
params: P,
- memoryConfig: PiMemoryConfig
+ memoryConfig?: PiMemoryConfig
): Promise {
const startTime = Date.now()
const startTimeISO = new Date(startTime).toISOString()
@@ -231,7 +280,9 @@ export class PiBlockHandler implements BlockHandler {
output,
this.buildOutput(result, params.model, params.isBYOK, startTime, startTimeISO)
)
- await appendPiMemory(ctx, memoryConfig, params.task, result.totals.finalText)
+ if (memoryConfig) {
+ await appendPiMemory(ctx, memoryConfig, params.task, result.totals.finalText)
+ }
controller.close()
} catch (error) {
controller.error(error)
@@ -256,7 +307,9 @@ export class PiBlockHandler implements BlockHandler {
if (result.totals.errorMessage) {
throw new Error(result.totals.errorMessage)
}
- await appendPiMemory(ctx, memoryConfig, params.task, result.totals.finalText)
+ if (memoryConfig) {
+ await appendPiMemory(ctx, memoryConfig, params.task, result.totals.finalText)
+ }
return this.buildOutput(result, params.model, params.isBYOK, startTime, startTimeISO)
}
}
diff --git a/apps/sim/executor/handlers/pi/pi-sdk.ts b/apps/sim/executor/handlers/pi/pi-sdk.ts
new file mode 100644
index 00000000000..7f6c0146f50
--- /dev/null
+++ b/apps/sim/executor/handlers/pi/pi-sdk.ts
@@ -0,0 +1,56 @@
+import { InMemoryCredentialStore } from '@earendil-works/pi-ai'
+import type { ModelRuntime, ResourceLoader } from '@earendil-works/pi-coding-agent'
+
+/** The Pi SDK module, loaded dynamically so it stays externalized from the bundle. */
+export type PiSdk = typeof import('@earendil-works/pi-coding-agent')
+
+let sdkPromise: Promise | undefined
+
+/** Loads the Pi SDK while preserving Next.js standalone dependency tracing. */
+export function loadPiSdk(): Promise {
+ if (!sdkPromise) {
+ sdkPromise = import('@earendil-works/pi-coding-agent').catch((error) => {
+ sdkPromise = undefined
+ throw error
+ })
+ }
+ return sdkPromise
+}
+
+/** Creates a host-only Pi model runtime without reading credentials or models from disk. */
+export function createPiModelRuntime(sdk: PiSdk): Promise {
+ return sdk.ModelRuntime.create({
+ credentials: new InMemoryCredentialStore(),
+ modelsPath: null,
+ allowModelNetwork: false,
+ })
+}
+
+/** Resolves only model definitions that the installed Pi SDK declares exactly. */
+export function resolvePiSdkModel(modelRuntime: ModelRuntime, provider: string, modelId: string) {
+ return modelRuntime.getModel(provider, modelId)
+}
+
+/**
+ * Creates an isolated resource-discovery boundary for untrusted repositories. No project
+ * files, extensions, skills, prompt templates, themes, or settings are loaded.
+ */
+export function createSealedPiResourceLoader(sdk: PiSdk, systemPrompt: string): ResourceLoader {
+ const extensions = {
+ extensions: [],
+ errors: [],
+ runtime: sdk.createExtensionRuntime(),
+ }
+
+ return {
+ getExtensions: () => extensions,
+ getSkills: () => ({ skills: [], diagnostics: [] }),
+ getPrompts: () => ({ prompts: [], diagnostics: [] }),
+ getThemes: () => ({ themes: [], diagnostics: [] }),
+ getAgentsFiles: () => ({ agentsFiles: [] }),
+ getSystemPrompt: () => systemPrompt,
+ getAppendSystemPrompt: () => [],
+ extendResources: () => {},
+ reload: async () => {},
+ }
+}
diff --git a/apps/sim/executor/handlers/pi/redaction.test.ts b/apps/sim/executor/handlers/pi/redaction.test.ts
new file mode 100644
index 00000000000..529deaf9b2e
--- /dev/null
+++ b/apps/sim/executor/handlers/pi/redaction.test.ts
@@ -0,0 +1,46 @@
+/**
+ * @vitest-environment node
+ */
+import { describe, expect, it } from 'vitest'
+import {
+ createScrubbedPiError,
+ getScrubbedPiErrorMessage,
+ scrubPiEvent,
+ scrubPiSecrets,
+} from '@/executor/handlers/pi/redaction'
+
+describe('Pi secret redaction', () => {
+ it('redacts literal and URL-encoded secret representations', () => {
+ expect(
+ scrubPiSecrets('literal sk-hosted/secret encoded sk-hosted%2Fsecret', ['sk-hosted/secret'])
+ ).toBe('literal *** encoded ***')
+ })
+
+ it('redacts longer overlapping secrets before their prefixes', () => {
+ expect(scrubPiSecrets('ghp_secret and ghp_', ['ghp_', 'ghp_secret'])).toBe('*** and ***')
+ })
+
+ it('redacts all string-bearing Pi event variants', () => {
+ expect(scrubPiEvent({ type: 'thinking', text: 'saw sk-hosted' }, ['sk-hosted'])).toEqual({
+ type: 'thinking',
+ text: 'saw ***',
+ })
+ expect(
+ scrubPiEvent({ type: 'tool_end', toolName: 'sk-hosted', isError: true }, ['sk-hosted'])
+ ).toEqual({ type: 'tool_end', toolName: '***', isError: true })
+ expect(scrubPiEvent({ type: 'error', message: 'failed sk-hosted' }, ['sk-hosted'])).toEqual({
+ type: 'error',
+ message: 'failed ***',
+ })
+ })
+
+ it('creates sanitized errors without retaining the raw cause', () => {
+ const raw = new Error('provider exposed sk-hosted')
+ const scrubbed = createScrubbedPiError(raw, ['sk-hosted'])
+
+ expect(getScrubbedPiErrorMessage(raw, ['sk-hosted'])).toBe('provider exposed ***')
+ expect(scrubbed.message).toBe('provider exposed ***')
+ expect(scrubbed.cause).toBeUndefined()
+ expect(String(scrubbed.stack)).not.toContain('sk-hosted')
+ })
+})
diff --git a/apps/sim/executor/handlers/pi/redaction.ts b/apps/sim/executor/handlers/pi/redaction.ts
new file mode 100644
index 00000000000..904d9ae9f8d
--- /dev/null
+++ b/apps/sim/executor/handlers/pi/redaction.ts
@@ -0,0 +1,51 @@
+import { getErrorMessage } from '@sim/utils/errors'
+import type { PiEvent } from '@/executor/handlers/pi/events'
+
+/** Redacts exact secret values and their URL-encoded forms from surfaced text. */
+export function scrubPiSecrets(text: string, secrets: readonly string[]): string {
+ let scrubbed = text
+ const representations = new Set(
+ secrets.flatMap((secret) => (secret ? [secret, encodeURIComponent(secret)] : []))
+ )
+ for (const representation of [...representations].sort(
+ (left, right) => right.length - left.length
+ )) {
+ scrubbed = scrubbed.split(representation).join('***')
+ }
+ return scrubbed
+}
+
+/** Redacts secrets from every string-bearing normalized Pi event. */
+export function scrubPiEvent(event: PiEvent | null, secrets: readonly string[]): PiEvent | null {
+ if (!event) return event
+ switch (event.type) {
+ case 'text':
+ case 'thinking':
+ return { ...event, text: scrubPiSecrets(event.text, secrets) }
+ case 'tool_start':
+ case 'tool_end':
+ return { ...event, toolName: scrubPiSecrets(event.toolName, secrets) }
+ case 'error':
+ return { ...event, message: scrubPiSecrets(event.message, secrets) }
+ default:
+ return event
+ }
+}
+
+/** Extracts an unknown error message without allowing exact secrets to escape. */
+export function getScrubbedPiErrorMessage(
+ error: unknown,
+ secrets: readonly string[],
+ fallback = 'Pi run failed'
+): string {
+ return scrubPiSecrets(getErrorMessage(error, fallback), secrets)
+}
+
+/** Creates a boundary-safe error without retaining a potentially secret-bearing cause. */
+export function createScrubbedPiError(
+ error: unknown,
+ secrets: readonly string[],
+ fallback?: string
+): Error {
+ return new Error(getScrubbedPiErrorMessage(error, secrets, fallback))
+}
diff --git a/apps/sim/executor/handlers/pi/sim-tools.ts b/apps/sim/executor/handlers/pi/sim-tools.ts
index 0fb6a3b632e..8956b4a7dcb 100644
--- a/apps/sim/executor/handlers/pi/sim-tools.ts
+++ b/apps/sim/executor/handlers/pi/sim-tools.ts
@@ -1,6 +1,6 @@
/**
* Adapts user-selected Sim tools into backend-neutral {@link PiToolSpec}s that
- * Pi can call in local mode. Each spec carries the tool's JSON-schema parameters
+ * Pi can call in Local Dev. Each spec carries the tool's JSON-schema parameters
* and an `execute` that runs the real Sim tool through `executeTool`, so the
* agent's calls go through the same credential-access checks as any block.
*
diff --git a/apps/sim/executor/handlers/pi/ssh-tools.ts b/apps/sim/executor/handlers/pi/ssh-tools.ts
index c625ba7bcb3..0fa471e2190 100644
--- a/apps/sim/executor/handlers/pi/ssh-tools.ts
+++ b/apps/sim/executor/handlers/pi/ssh-tools.ts
@@ -98,7 +98,7 @@ async function guard(run: () => Promise): Promise {
/**
* Best-effort working-tree snapshot of the repo over the run's SSH session, for
- * the block's `changedFiles`/`diff` outputs — Local mode edits in place rather
+ * the block's `changedFiles`/`diff` outputs — Local Dev edits in place rather
* than opening a PR. `changedFiles` covers both tracked modifications and untracked
* (newly created) files so files the agent created are reported; `diff` reflects
* tracked changes against HEAD. Returns empty on any failure (not a git repo, git
diff --git a/apps/sim/hooks/mcp/use-mcp-oauth-popup.ts b/apps/sim/hooks/mcp/use-mcp-oauth-popup.ts
index b3fd9a6c58a..a7588ba7bac 100644
--- a/apps/sim/hooks/mcp/use-mcp-oauth-popup.ts
+++ b/apps/sim/hooks/mcp/use-mcp-oauth-popup.ts
@@ -37,103 +37,146 @@ interface UseMcpOauthPopupProps {
workspaceId: string
}
+/**
+ * Bounds how long a row shows "Connecting…" without a result. Matches the server-side OAuth
+ * start TTL: once it lapses the authorization state has expired and the flow can no longer
+ * complete, so a still-pending flow is safe to drop.
+ */
+const OAUTH_FLOW_TIMEOUT_MS = 10 * 60 * 1000
+
export function useMcpOauthPopup({ workspaceId }: UseMcpOauthPopupProps) {
const queryClient = useQueryClient()
const { mutateAsync: startOauth } = useStartMcpOauth()
const [connectingServers, setConnectingServers] = useState>(() => new Set())
- const popupIntervalsRef = useRef>(new Map())
+ // OAuth `state` nonce -> { serverId, safety timeout }. The state keys the BroadcastChannel
+ // correlation: the callback echoes it on every result (even failures that can't resolve a
+ // serverId), so the tab that started this exact flow matches it while other same-origin tabs
+ // ignore it. Cleared only when the flow completes or times out, never by popup.closed polling
+ // — COOP can make popup.closed misreport, and clearing early would drop a genuine completion.
+ const pendingFlowsRef = useRef>(new Map())
+ // serverId -> popup.closed poll. Best-effort fast "Connecting…" clear when the user
+ // abandons the popup; never used to correlate a result.
+ const popupPollsRef = useRef>(new Map())
+
+ const stopConnecting = useCallback((serverId: string) => {
+ setConnectingServers((prev) => {
+ if (!prev.has(serverId)) return prev
+ const next = new Set(prev)
+ next.delete(serverId)
+ return next
+ })
+ }, [])
+
+ const stopPopupPoll = useCallback((serverId: string) => {
+ const poll = popupPollsRef.current.get(serverId)
+ if (poll !== undefined) {
+ window.clearInterval(poll)
+ popupPollsRef.current.delete(serverId)
+ }
+ }, [])
+
+ /** End a flow entirely (by its state nonce): stop the spinner, safety timeout, and popup poll. */
+ const settleFlow = useCallback(
+ (state: string) => {
+ const flow = pendingFlowsRef.current.get(state)
+ if (!flow) return
+ window.clearTimeout(flow.timeout)
+ pendingFlowsRef.current.delete(state)
+ stopPopupPoll(flow.serverId)
+ stopConnecting(flow.serverId)
+ },
+ [stopConnecting, stopPopupPoll]
+ )
useEffect(() => {
- const intervals = popupIntervalsRef.current
+ const pending = pendingFlowsRef.current
+ const polls = popupPollsRef.current
return () => {
- for (const id of intervals.values()) window.clearInterval(id)
- intervals.clear()
+ for (const { timeout } of pending.values()) window.clearTimeout(timeout)
+ for (const p of polls.values()) window.clearInterval(p)
+ pending.clear()
+ polls.clear()
}
}, [])
useEffect(() => {
- function onMessage(event: MessageEvent) {
- if (event.origin !== window.location.origin) return
+ // The callback signals over a same-origin BroadcastChannel (see the OAuth callback
+ // route): a provider whose authorize page sets COOP `same-origin` severs
+ // `window.opener`, so a popup `postMessage` can be lost and leave the row stuck on
+ // "Connecting…". A BroadcastChannel is origin-scoped, so it needs no origin check.
+ const channel = new BroadcastChannel('mcp-oauth')
+ channel.onmessage = (event) => {
const data = event.data as Partial | null
if (data?.type !== 'mcp-oauth') return
- if (data.serverId) {
- const serverId = data.serverId
- const interval = popupIntervalsRef.current.get(serverId)
- if (interval !== undefined) {
- window.clearInterval(interval)
- popupIntervalsRef.current.delete(serverId)
- }
- setConnectingServers((prev) => {
- if (!prev.has(serverId)) return prev
- const next = new Set(prev)
- next.delete(serverId)
- return next
- })
- } else if (!data.ok) {
- // Early callback failures (missing params, invalid state) post back
- // without a serverId, so we can't target a specific row — clear all
- // in-flight popups instead of leaving the UI stuck on "Connecting…".
- for (const id of popupIntervalsRef.current.values()) window.clearInterval(id)
- popupIntervalsRef.current.clear()
- setConnectingServers((prev) => (prev.size === 0 ? prev : new Set()))
- }
+ // A BroadcastChannel reaches every same-origin tab, so react only to a result for a flow
+ // THIS tab started, matched on the OAuth `state` nonce. Every result (success or failure)
+ // carries it, so unrelated tabs — and unrelated flows in this tab — ignore the broadcast.
+ if (!data.state) return
+ const flow = pendingFlowsRef.current.get(data.state)
+ if (!flow) return
+ const { serverId } = flow
+ settleFlow(data.state)
if (data.ok) {
queryClient.invalidateQueries({ queryKey: mcpKeys.serversList(workspaceId) })
- if (data.serverId) {
- queryClient.invalidateQueries({
- queryKey: mcpKeys.serverToolsList(workspaceId, data.serverId),
- })
- } else {
- queryClient.invalidateQueries({
- queryKey: mcpKeys.serverToolsWorkspace(workspaceId),
- })
- }
+ queryClient.invalidateQueries({
+ queryKey: mcpKeys.serverToolsList(workspaceId, serverId),
+ })
queryClient.invalidateQueries({ queryKey: mcpKeys.storedToolsList(workspaceId) })
toast.success('Server authorized')
} else {
toast.error(reasonToMessage(data.reason))
}
}
- window.addEventListener('message', onMessage)
- return () => window.removeEventListener('message', onMessage)
- }, [queryClient, workspaceId])
+ return () => channel.close()
+ }, [queryClient, workspaceId, settleFlow])
const startOauthForServer = useCallback(
async (serverId: string) => {
setConnectingServers((prev) => new Set(prev).add(serverId))
- const clear = () => {
- const existing = popupIntervalsRef.current.get(serverId)
- if (existing !== undefined) {
- window.clearInterval(existing)
- popupIntervalsRef.current.delete(serverId)
- }
- setConnectingServers((prev) => {
- const next = new Set(prev)
- next.delete(serverId)
- return next
- })
- }
try {
const result = await startOauth({ serverId, workspaceId })
if (result.status === 'already_authorized') {
- clear()
+ stopConnecting(serverId)
return
}
- const { popup } = result
- const existing = popupIntervalsRef.current.get(serverId)
- if (existing !== undefined) window.clearInterval(existing)
- const interval = window.setInterval(() => {
- if (popup.closed) clear()
- }, 500)
- popupIntervalsRef.current.set(serverId, interval)
+ const { popup, state } = result
+ // Drop any prior in-flight flow for this server (e.g. an abandoned attempt now being
+ // retried) so its stale safety timeout can't later clear this new flow's state.
+ for (const [prevState, flow] of pendingFlowsRef.current) {
+ if (flow.serverId === serverId) {
+ window.clearTimeout(flow.timeout)
+ pendingFlowsRef.current.delete(prevState)
+ }
+ }
+ // Track this in-flight flow keyed by its `state` nonce for the BroadcastChannel gate,
+ // bounded by a safety timeout in case no result ever arrives (popup abandoned, or a
+ // callback failure the client can't otherwise clear).
+ pendingFlowsRef.current.set(state, {
+ serverId,
+ timeout: window.setTimeout(() => settleFlow(state), OAUTH_FLOW_TIMEOUT_MS),
+ })
+ // Best-effort: clear "Connecting…" quickly when the user closes the popup without
+ // finishing. popup.closed can misreport under COOP, so this only stops the spinner —
+ // it never touches `pendingFlowsRef`, so it can't drop a real result.
+ stopPopupPoll(serverId)
+ popupPollsRef.current.set(
+ serverId,
+ window.setInterval(() => {
+ if (popup.closed) {
+ stopPopupPoll(serverId)
+ stopConnecting(serverId)
+ }
+ }, 500)
+ )
} catch (e) {
- clear()
+ stopPopupPoll(serverId)
+ stopConnecting(serverId)
logger.error('Failed to start MCP OAuth', e)
toast.error(toError(e).message || 'Failed to start authorization')
}
},
- [startOauth, workspaceId]
+ [startOauth, workspaceId, settleFlow, stopConnecting, stopPopupPoll]
)
return { connectingServers, startOauthForServer }
diff --git a/apps/sim/hooks/queries/mcp.ts b/apps/sim/hooks/queries/mcp.ts
index 21ce5202682..36e47c2d382 100644
--- a/apps/sim/hooks/queries/mcp.ts
+++ b/apps/sim/hooks/queries/mcp.ts
@@ -304,9 +304,13 @@ export function useCreateMcpServer() {
})
}
-/** On `redirect`, the caller must wait for `popup.closed` or the `mcp-oauth` postMessage. */
+/**
+ * On `redirect`, the caller waits for the `mcp-oauth` BroadcastChannel signal (matched on
+ * `state`) or `popup.closed`. `state` is the per-flow OAuth nonce the callback echoes, used to
+ * correlate the eventual result back to this exact flow.
+ */
export type StartMcpOauthMutationResult =
- | { status: 'redirect'; popup: Window }
+ | { status: 'redirect'; popup: Window; state: string }
| { status: 'already_authorized' }
export function useStartMcpOauth() {
@@ -324,6 +328,10 @@ export function useStartMcpOauth() {
if (parsedUrl.protocol !== 'https:' && !isLoopbackHttp) {
throw new Error('Authorization URL must use HTTPS')
}
+ const state = parsedUrl.searchParams.get('state')
+ if (!state) {
+ throw new Error('Authorization URL is missing the OAuth state parameter')
+ }
const popup = window.open(
result.authorizationUrl,
`mcp-oauth-${serverId}`,
@@ -332,7 +340,7 @@ export function useStartMcpOauth() {
if (!popup) {
throw new Error('Popup blocked. Please allow popups for this site and retry.')
}
- return { status: 'redirect', popup }
+ return { status: 'redirect', popup, state }
},
}
)
diff --git a/apps/sim/lib/api/contracts/index.ts b/apps/sim/lib/api/contracts/index.ts
index ef339965c5b..259878e0935 100644
--- a/apps/sim/lib/api/contracts/index.ts
+++ b/apps/sim/lib/api/contracts/index.ts
@@ -13,6 +13,7 @@ export * from './file-uploads'
export * from './folders'
export * from './hotspots'
export * from './inbox'
+export * from './managed-agents'
export * from './media'
export * from './permission-groups'
export * from './primitives'
diff --git a/apps/sim/lib/api/contracts/managed-agents.ts b/apps/sim/lib/api/contracts/managed-agents.ts
new file mode 100644
index 00000000000..eef276b3de4
--- /dev/null
+++ b/apps/sim/lib/api/contracts/managed-agents.ts
@@ -0,0 +1,42 @@
+import { z } from 'zod'
+import { type ContractJsonResponse, defineRouteContract } from '@/lib/api/contracts/types'
+
+/**
+ * Contract for the Managed Agent block-editor dropdowns. The `list` route
+ * resolves agents / environments / vaults / memory stores against a selected
+ * Claude Platform credential, decrypting its API key server-side — the key
+ * never crosses the client boundary.
+ */
+
+/** A dropdown option resolved from the linked Claude Platform workspace. */
+export const managedAgentOptionSchema = z.object({
+ id: z.string(),
+ label: z.string(),
+ /** Environment execution model — only set for the `environments` resource, used to filter by mode. */
+ type: z.enum(['cloud', 'self_hosted']).optional(),
+})
+export type ManagedAgentOption = z.output
+
+export const managedAgentResourceSchema = z.enum([
+ 'agents',
+ 'environments',
+ 'vaults',
+ 'memory-stores',
+])
+export type ManagedAgentResource = z.output
+
+export const listManagedAgentOptionsQuerySchema = z.object({
+ credentialId: z.string().min(1, 'A Claude Platform credential is required'),
+ resource: managedAgentResourceSchema,
+})
+
+export const listManagedAgentOptionsContract = defineRouteContract({
+ method: 'GET',
+ path: '/api/tools/managed-agent/list',
+ query: listManagedAgentOptionsQuerySchema,
+ response: {
+ mode: 'json',
+ schema: z.object({ options: z.array(managedAgentOptionSchema) }),
+ },
+})
+export type ListManagedAgentOptions = ContractJsonResponse
diff --git a/apps/sim/lib/api/contracts/mcp.ts b/apps/sim/lib/api/contracts/mcp.ts
index b41cff74d95..a8fed5369ee 100644
--- a/apps/sim/lib/api/contracts/mcp.ts
+++ b/apps/sim/lib/api/contracts/mcp.ts
@@ -26,7 +26,12 @@ const optionalNumberFromNullableSchema = z.preprocess(
const optionalConnectionStatusFromNullableSchema = z.preprocess(
(value) => (value === null ? undefined : value),
- z.enum(['connected', 'disconnected', 'error']).optional()
+ // `connection_status` is a free-text column; tolerate an off-enum value as undefined
+ // rather than failing the whole list's validation.
+ z
+ .enum(['connected', 'disconnected', 'error'])
+ .optional()
+ .catch(undefined)
)
const optionalHeadersFromNullableSchema = z.preprocess(
@@ -36,6 +41,16 @@ const optionalHeadersFromNullableSchema = z.preprocess(
export const mcpTransportSchema = z.enum(['streamable-http'])
+/**
+ * Transport as read back from storage. The `transport` column is free text, and
+ * rows predating the Streamable HTTP consolidation (or copied verbatim by an
+ * older fork) may still hold legacy `http`/`sse` values. Every server is operated
+ * over Streamable HTTP regardless, so any non-canonical value normalizes to the
+ * supported transport — this stops a single legacy row from failing the entire
+ * server list's response validation.
+ */
+const mcpTransportResponseSchema = mcpTransportSchema.catch('streamable-http')
+
export const mcpAuthTypeSchema = z.enum(['none', 'headers', 'oauth'])
const consecutiveFailuresSchema = z.preprocess(
@@ -98,8 +113,10 @@ export const mcpServerSchema = z
workspaceId: z.string(),
name: z.string(),
description: optionalStringFromNullableSchema,
- transport: mcpTransportSchema,
- authType: mcpAuthTypeSchema.optional(),
+ transport: mcpTransportResponseSchema,
+ // Response-side tolerance: `auth_type` is a free-text column, so a value outside
+ // the enum normalizes to undefined rather than failing the whole list's validation.
+ authType: mcpAuthTypeSchema.optional().catch(undefined),
url: optionalStringFromNullableSchema,
timeout: optionalNumberFromNullableSchema,
retries: optionalNumberFromNullableSchema,
diff --git a/apps/sim/lib/api/contracts/tiktok-tools.test.ts b/apps/sim/lib/api/contracts/tiktok-tools.test.ts
index ee24ba93bd3..5edd2a7cb63 100644
--- a/apps/sim/lib/api/contracts/tiktok-tools.test.ts
+++ b/apps/sim/lib/api/contracts/tiktok-tools.test.ts
@@ -1,5 +1,5 @@
import { describe, expect, it } from 'vitest'
-import { tiktokPublishVideoBodySchema } from '@/lib/api/contracts/tiktok-tools'
+import { tiktokUploadVideoDraftBodySchema } from '@/lib/api/contracts/tiktok-tools'
const file = {
key: 'workspace/test/video.mp4',
@@ -8,78 +8,30 @@ const file = {
type: 'video/mp4',
}
-describe('tiktokPublishVideoBodySchema', () => {
- it('accepts a draft without direct-post metadata', () => {
- expect(
- tiktokPublishVideoBodySchema.safeParse({
- accessToken: 'token',
- mode: 'draft',
- file,
- }).success
- ).toBe(true)
+describe('tiktokUploadVideoDraftBodySchema', () => {
+ it('accepts a draft upload body', () => {
+ const parsed = tiktokUploadVideoDraftBodySchema.safeParse({
+ accessToken: 'token',
+ file,
+ })
+ expect(parsed.success).toBe(true)
+ if (parsed.success) {
+ expect(parsed.data).toEqual({ accessToken: 'token', file })
+ }
})
- it('requires direct-post privacy and commercial-content disclosure', () => {
+ it('rejects a body without an access token', () => {
expect(
- tiktokPublishVideoBodySchema.safeParse({
- accessToken: 'token',
- mode: 'direct',
+ tiktokUploadVideoDraftBodySchema.safeParse({
file,
- postInfo: { privacy_level: 'SELF_ONLY' },
}).success
).toBe(false)
})
- it('accepts documented direct-post metadata', () => {
+ it('rejects a body without a file', () => {
expect(
- tiktokPublishVideoBodySchema.safeParse({
+ tiktokUploadVideoDraftBodySchema.safeParse({
accessToken: 'token',
- mode: 'direct',
- file,
- musicUsageConsent: 'accepted',
- postInfo: {
- title: 'A test video',
- privacy_level: 'SELF_ONLY',
- disable_duet: true,
- disable_stitch: true,
- disable_comment: true,
- brand_content_toggle: false,
- },
- }).success
- ).toBe(true)
- })
-
- it('rejects direct posting without explicit music usage consent', () => {
- expect(
- tiktokPublishVideoBodySchema.safeParse({
- accessToken: 'token',
- mode: 'direct',
- file,
- postInfo: {
- privacy_level: 'SELF_ONLY',
- disable_duet: true,
- disable_stitch: true,
- disable_comment: true,
- brand_content_toggle: false,
- },
- }).success
- ).toBe(false)
- })
-
- it('rejects an undocumented privacy value', () => {
- expect(
- tiktokPublishVideoBodySchema.safeParse({
- accessToken: 'token',
- mode: 'direct',
- file,
- musicUsageConsent: 'accepted',
- postInfo: {
- privacy_level: 'PRIVATE',
- disable_duet: true,
- disable_stitch: true,
- disable_comment: true,
- brand_content_toggle: false,
- },
}).success
).toBe(false)
})
diff --git a/apps/sim/lib/api/contracts/tiktok-tools.ts b/apps/sim/lib/api/contracts/tiktok-tools.ts
index 2023b29de6b..b14c5eda42c 100644
--- a/apps/sim/lib/api/contracts/tiktok-tools.ts
+++ b/apps/sim/lib/api/contracts/tiktok-tools.ts
@@ -6,51 +6,25 @@ import {
} from '@/lib/api/contracts/types'
import { RawFileInputSchema } from '@/lib/uploads/utils/file-schemas'
-const tiktokPublishVideoPostInfoSchema = z.object({
- title: z.string().max(2200).optional(),
- privacy_level: z.enum([
- 'PUBLIC_TO_EVERYONE',
- 'MUTUAL_FOLLOW_FRIENDS',
- 'FOLLOWER_OF_CREATOR',
- 'SELF_ONLY',
- ]),
- disable_duet: z.boolean(),
- disable_stitch: z.boolean(),
- disable_comment: z.boolean(),
- video_cover_timestamp_ms: z.number().int().nonnegative().optional(),
- is_aigc: z.boolean().optional(),
- brand_content_toggle: z.boolean(),
- brand_organic_toggle: z.boolean().optional(),
-})
-
-const tiktokPublishVideoBaseSchema = z.object({
+export const tiktokUploadVideoDraftBodySchema = z.object({
accessToken: z.string().min(1, 'Access token is required'),
file: RawFileInputSchema,
})
-export const tiktokPublishVideoBodySchema = z.discriminatedUnion('mode', [
- tiktokPublishVideoBaseSchema.extend({
- mode: z.literal('direct'),
- postInfo: tiktokPublishVideoPostInfoSchema,
- musicUsageConsent: z.literal('accepted'),
- }),
- tiktokPublishVideoBaseSchema.extend({
- mode: z.literal('draft'),
- }),
-])
-
-export const tiktokPublishVideoResponseSchema = z.object({
+export const tiktokUploadVideoDraftResponseSchema = z.object({
success: z.boolean(),
output: z.object({ publishId: z.string() }).optional(),
error: z.string().optional(),
})
-export const tiktokPublishVideoContract = defineRouteContract({
+export const tiktokUploadVideoDraftContract = defineRouteContract({
method: 'POST',
- path: '/api/tools/tiktok/publish-video',
- body: tiktokPublishVideoBodySchema,
- response: { mode: 'json', schema: tiktokPublishVideoResponseSchema },
+ path: '/api/tools/tiktok/upload-video-draft',
+ body: tiktokUploadVideoDraftBodySchema,
+ response: { mode: 'json', schema: tiktokUploadVideoDraftResponseSchema },
})
-export type TikTokPublishVideoBody = ContractBodyInput
-export type TikTokPublishVideoResponse = ContractJsonResponse
+export type TikTokUploadVideoDraftBody = ContractBodyInput
+export type TikTokUploadVideoDraftResponse = ContractJsonResponse<
+ typeof tiktokUploadVideoDraftContract
+>
diff --git a/apps/sim/lib/copilot/chat/payload.ts b/apps/sim/lib/copilot/chat/payload.ts
index 5afe545ab87..1ca42814edf 100644
--- a/apps/sim/lib/copilot/chat/payload.ts
+++ b/apps/sim/lib/copilot/chat/payload.ts
@@ -16,6 +16,7 @@ import { encodeVfsSegment } from '@/lib/copilot/vfs/path-utils'
import type { BlockVisibilityState } from '@/lib/core/config/block-visibility'
import { isE2BDocEnabled, isHosted } from '@/lib/core/config/env-flags'
import { trackChatUpload } from '@/lib/uploads/contexts/workspace/workspace-file-manager'
+import { buildArchiveExtractGuidance, isArchiveFileName } from '@/lib/uploads/utils/file-utils'
import { stripVersionSuffix } from '@/tools/utils'
const logger = createLogger('CopilotChatPayload')
@@ -343,15 +344,25 @@ export async function buildCopilotRequestPayload(
} catch {
encodedUploadName = displayName
}
- const lines = [
- `File "${displayName}" (${mediaType}, ${f.size} bytes) uploaded.`,
- `Read with: read("uploads/${encodedUploadName}")`,
- `To save permanently: materialize_file(fileName: "${displayName}")`,
- ]
- if (displayName.endsWith('.json')) {
- lines.push(
- `To import as a workflow: materialize_file(fileName: "${displayName}", operation: "import")`
- )
+ let lines: string[]
+ if (isArchiveFileName(displayName)) {
+ // A .zip is stored in uploads/ but its contents aren't readable until
+ // the agent extracts it once into workspace files/ (explicit step).
+ lines = [
+ `Archive "${displayName}" (${mediaType}, ${f.size} bytes) uploaded.`,
+ buildArchiveExtractGuidance(displayName),
+ ]
+ } else {
+ lines = [
+ `File "${displayName}" (${mediaType}, ${f.size} bytes) uploaded.`,
+ `Read with: read("uploads/${encodedUploadName}")`,
+ `To save permanently: materialize_file(fileName: "${displayName}")`,
+ ]
+ if (displayName.endsWith('.json')) {
+ lines.push(
+ `To import as a workflow: materialize_file(fileName: "${displayName}", operation: "import")`
+ )
+ }
}
uploadContexts.push({
type: 'uploaded_file',
diff --git a/apps/sim/lib/copilot/generated/tool-catalog-v1.ts b/apps/sim/lib/copilot/generated/tool-catalog-v1.ts
index 8c188e04b99..77fa9e44091 100644
--- a/apps/sim/lib/copilot/generated/tool-catalog-v1.ts
+++ b/apps/sim/lib/copilot/generated/tool-catalog-v1.ts
@@ -94,6 +94,7 @@ export interface ToolCatalogEntry {
| 'set_block_enabled'
| 'set_environment_variables'
| 'set_global_workflow_variables'
+ | 'share_file'
| 'table'
| 'update_deployment_version'
| 'update_scheduled_task_history'
@@ -191,6 +192,7 @@ export interface ToolCatalogEntry {
| 'set_block_enabled'
| 'set_environment_variables'
| 'set_global_workflow_variables'
+ | 'share_file'
| 'table'
| 'update_deployment_version'
| 'update_scheduled_task_history'
@@ -2841,8 +2843,8 @@ export const MaterializeFile: ToolCatalogEntry = {
operation: {
type: 'string',
description:
- 'What to do with the file. "save" promotes it to a permanent files/ path. "import" imports a workflow JSON as a workspace workflow. Defaults to "save".',
- enum: ['save', 'import'],
+ 'What to do with the file. "save" promotes it to a permanent files/ path. "import" imports a workflow JSON as a workspace workflow. "extract" decompresses a .zip upload into files//. Defaults to "save".',
+ enum: ['save', 'import', 'extract'],
default: 'save',
},
},
@@ -3925,6 +3927,60 @@ export const SetGlobalWorkflowVariables: ToolCatalogEntry = {
requiredPermission: 'write',
}
+export const ShareFile: ToolCatalogEntry = {
+ id: 'share_file',
+ name: 'share_file',
+ route: 'sim',
+ mode: 'async',
+ parameters: {
+ type: 'object',
+ properties: {
+ action: {
+ type: 'string',
+ description: 'Whether to create/update the share link or deactivate it.',
+ enum: ['share', 'unshare'],
+ default: 'share',
+ },
+ allowedEmails: {
+ type: 'array',
+ description:
+ 'Allowed emails or "@domain" patterns for authType "email" or "sso". Ignored for other auth types.',
+ items: { type: 'string' },
+ },
+ authType: {
+ type: 'string',
+ description: 'How viewers authenticate to open the link. Ignored for unshare.',
+ enum: ['public', 'password', 'email', 'sso'],
+ default: 'public',
+ },
+ password: {
+ type: 'string',
+ description:
+ 'Password for authType "password". Leave empty to keep the file\'s existing password when re-sharing an already password-protected file. Ignored for other auth types.',
+ },
+ path: {
+ type: 'string',
+ description: 'Canonical workspace file VFS path to share, e.g. "files/Reports/Q4.md".',
+ },
+ },
+ required: ['path'],
+ },
+ resultSchema: {
+ type: 'object',
+ properties: {
+ data: {
+ type: 'object',
+ description:
+ 'Share state. Contains url (the {baseUrl}/f/{token} link), token, authType, hasPassword, and isActive.',
+ },
+ message: { type: 'string', description: 'Human-readable outcome.' },
+ success: { type: 'boolean', description: 'Whether the share action succeeded.' },
+ },
+ required: ['success', 'message'],
+ },
+ requiredPermission: 'write',
+}
+
export const Table: ToolCatalogEntry = {
id: 'table',
name: 'table',
@@ -4664,6 +4720,7 @@ export const ManageSkillOperationValues = [
export const MaterializeFileOperation = {
save: 'save',
import: 'import',
+ extract: 'extract',
} as const
export type MaterializeFileOperation =
@@ -4672,6 +4729,7 @@ export type MaterializeFileOperation =
export const MaterializeFileOperationValues = [
MaterializeFileOperation.save,
MaterializeFileOperation.import,
+ MaterializeFileOperation.extract,
] as const
export const QueryUserTableOperation = {
@@ -4879,6 +4937,7 @@ export const TOOL_CATALOG: Record = {
[SetBlockEnabled.id]: SetBlockEnabled,
[SetEnvironmentVariables.id]: SetEnvironmentVariables,
[SetGlobalWorkflowVariables.id]: SetGlobalWorkflowVariables,
+ [ShareFile.id]: ShareFile,
[Table.id]: Table,
[UpdateDeploymentVersion.id]: UpdateDeploymentVersion,
[UpdateScheduledTaskHistory.id]: UpdateScheduledTaskHistory,
diff --git a/apps/sim/lib/copilot/generated/tool-schemas-v1.ts b/apps/sim/lib/copilot/generated/tool-schemas-v1.ts
index e8d9f1221f2..00646f08622 100644
--- a/apps/sim/lib/copilot/generated/tool-schemas-v1.ts
+++ b/apps/sim/lib/copilot/generated/tool-schemas-v1.ts
@@ -2656,8 +2656,8 @@ export const TOOL_RUNTIME_SCHEMAS: Record = {
operation: {
type: 'string',
description:
- 'What to do with the file. "save" promotes it to a permanent files/ path. "import" imports a workflow JSON as a workspace workflow. Defaults to "save".',
- enum: ['save', 'import'],
+ 'What to do with the file. "save" promotes it to a permanent files/ path. "import" imports a workflow JSON as a workspace workflow. "extract" decompresses a .zip upload into files//. Defaults to "save".',
+ enum: ['save', 'import', 'extract'],
default: 'save',
},
},
@@ -3715,6 +3715,62 @@ export const TOOL_RUNTIME_SCHEMAS: Record = {
},
resultSchema: undefined,
},
+ share_file: {
+ parameters: {
+ type: 'object',
+ properties: {
+ action: {
+ type: 'string',
+ description: 'Whether to create/update the share link or deactivate it.',
+ enum: ['share', 'unshare'],
+ default: 'share',
+ },
+ allowedEmails: {
+ type: 'array',
+ description:
+ 'Allowed emails or "@domain" patterns for authType "email" or "sso". Ignored for other auth types.',
+ items: {
+ type: 'string',
+ },
+ },
+ authType: {
+ type: 'string',
+ description: 'How viewers authenticate to open the link. Ignored for unshare.',
+ enum: ['public', 'password', 'email', 'sso'],
+ default: 'public',
+ },
+ password: {
+ type: 'string',
+ description:
+ 'Password for authType "password". Leave empty to keep the file\'s existing password when re-sharing an already password-protected file. Ignored for other auth types.',
+ },
+ path: {
+ type: 'string',
+ description: 'Canonical workspace file VFS path to share, e.g. "files/Reports/Q4.md".',
+ },
+ },
+ required: ['path'],
+ },
+ resultSchema: {
+ type: 'object',
+ properties: {
+ data: {
+ type: 'object',
+ description:
+ 'Share state. Contains url (the {baseUrl}/f/{token} link), token, authType, hasPassword, and isActive.',
+ },
+ message: {
+ type: 'string',
+ description: 'Human-readable outcome.',
+ },
+ success: {
+ type: 'boolean',
+ description: 'Whether the share action succeeded.',
+ },
+ },
+ required: ['success', 'message'],
+ },
+ },
table: {
parameters: {
properties: {
diff --git a/apps/sim/lib/copilot/tools/handlers/materialize-file.test.ts b/apps/sim/lib/copilot/tools/handlers/materialize-file.test.ts
index 6671ddc33ec..d81b81bc17c 100644
--- a/apps/sim/lib/copilot/tools/handlers/materialize-file.test.ts
+++ b/apps/sim/lib/copilot/tools/handlers/materialize-file.test.ts
@@ -6,6 +6,9 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
const {
mockCheckStorageQuotaForBillingContext,
+ mockDecompress,
+ mockFetchBuffer,
+ mockFindFolder,
mockFindUpload,
mockHasCloudStorage,
mockHeadObject,
@@ -14,6 +17,9 @@ const {
mockResolveStorageBillingContext,
} = vi.hoisted(() => ({
mockCheckStorageQuotaForBillingContext: vi.fn(),
+ mockDecompress: vi.fn(),
+ mockFetchBuffer: vi.fn(),
+ mockFindFolder: vi.fn(),
mockFindUpload: vi.fn(),
mockHasCloudStorage: vi.fn(),
mockHeadObject: vi.fn(),
@@ -33,7 +39,26 @@ vi.mock('@/lib/uploads', () => ({
}))
vi.mock('@/lib/uploads/contexts/workspace/workspace-file-manager', () => ({
- fetchWorkspaceFileBuffer: vi.fn(),
+ fetchWorkspaceFileBuffer: mockFetchBuffer,
+}))
+
+vi.mock('@/lib/uploads/contexts/workspace/workspace-file-folder-manager', () => ({
+ findWorkspaceFileFolderIdByPath: mockFindFolder,
+}))
+
+vi.mock('@/lib/uploads/archive', () => ({
+ decompressArchiveBufferToWorkspaceFiles: mockDecompress,
+ ArchiveError: class ArchiveError extends Error {
+ reason: string
+ entryName?: string
+ constructor(reason: string, message: string, entryName?: string) {
+ super(message)
+ this.name = 'ArchiveError'
+ this.reason = reason
+ this.entryName = entryName
+ }
+ },
+ MAX_ARCHIVE_BYTES: 100 * 1024 * 1024,
}))
vi.mock('@/lib/uploads/core/storage-service', () => ({
@@ -50,6 +75,8 @@ vi.mock('@/lib/billing/storage', () => ({
vi.mock('@/lib/copilot/vfs/path-utils', () => ({
canonicalWorkspaceFilePath: vi.fn(() => 'files/report.txt'),
+ encodeVfsPathSegments: (segments: string[]) =>
+ segments.map((s) => encodeURIComponent(s)).join('/'),
}))
vi.mock('@/lib/workflows/operations/import-export', () => ({ parseWorkflowJson: vi.fn() }))
@@ -293,3 +320,210 @@ describe('executeMaterializeFile - save storage transition', () => {
expect(mockMaybeNotifyStorageLimitForBillingContext).not.toHaveBeenCalled()
})
})
+
+describe('executeMaterializeFile - extract operation', () => {
+ beforeEach(() => {
+ vi.clearAllMocks()
+ mockFindFolder.mockResolvedValue(null)
+ })
+
+ function zipRow(overrides: Record = {}) {
+ return {
+ id: 'wf_zip',
+ key: 'mothership/abc/bundle.zip',
+ userId: 'user-1',
+ workspaceId: 'ws-1',
+ context: 'mothership',
+ chatId: 'chat-1',
+ originalName: 'bundle.zip',
+ displayName: 'bundle.zip',
+ contentType: 'application/zip',
+ size: 2048,
+ deletedAt: null,
+ uploadedAt: new Date(),
+ updatedAt: new Date(),
+ ...overrides,
+ }
+ }
+
+ it('dispatches to the archive extractor and returns the unpacked files', async () => {
+ mockFindUpload.mockResolvedValue(zipRow())
+ mockFetchBuffer.mockResolvedValue(Buffer.from('zip-bytes'))
+ mockDecompress.mockResolvedValue({
+ extracted: [
+ { id: 'f1', name: 'a.txt', url: '/x', size: 1, type: 'text/plain', key: 'k1' },
+ { id: 'f2', name: 'b.txt', url: '/y', size: 2, type: 'text/plain', key: 'k2' },
+ ],
+ skipped: 0,
+ skippedUnsafePaths: [],
+ })
+
+ const result = await executeMaterializeFile(
+ { fileNames: ['bundle.zip'], operation: 'extract' },
+ context
+ )
+
+ expect(result.success).toBe(true)
+ expect(mockDecompress).toHaveBeenCalledTimes(1)
+ expect(mockDecompress).toHaveBeenCalledWith(
+ expect.any(Buffer),
+ expect.objectContaining({
+ workspaceId: 'ws-1',
+ userId: 'user-1',
+ rootFolderSegments: ['bundle'],
+ skipNoiseEntries: true,
+ })
+ )
+ expect(result.output).toMatchObject({ succeeded: ['bundle.zip'], failed: [] })
+ expect(result.resources).toEqual([
+ { type: 'file', id: 'f1', title: 'a.txt' },
+ { type: 'file', id: 'f2', title: 'b.txt' },
+ ])
+ })
+
+ it('refuses to extract an upload that belongs to a different workspace', async () => {
+ mockFindUpload.mockResolvedValue(zipRow({ workspaceId: 'other-ws' }))
+
+ const result = await executeMaterializeFile(
+ { fileNames: ['bundle.zip'], operation: 'extract' },
+ context
+ )
+
+ expect(result.success).toBe(false)
+ const output = result.output as { failed: Array<{ fileName: string; error: string }> }
+ expect(output.failed[0].error).toContain('does not belong to this workspace')
+ expect(mockDecompress).not.toHaveBeenCalled()
+ })
+
+ it('reports an already-extracted archive instead of duplicating the tree', async () => {
+ mockFindUpload.mockResolvedValue(zipRow())
+ mockFindFolder.mockResolvedValue('folder-existing')
+ dbChainMockFns.limit.mockResolvedValueOnce([{ id: 'f-old' }])
+
+ const result = await executeMaterializeFile(
+ { fileNames: ['bundle.zip'], operation: 'extract' },
+ context
+ )
+
+ expect(result.success).toBe(false)
+ const output = result.output as { failed: Array<{ fileName: string; error: string }> }
+ expect(output.failed[0].error).toContain('already extracted')
+ expect(mockDecompress).not.toHaveBeenCalled()
+ })
+
+ it('detects a prior nested-only extraction via subfolders, not just direct files', async () => {
+ // A zip containing only nested entries (src/index.ts) leaves NO direct files
+ // under the archive root — only subfolders. The guard must still refuse.
+ mockFindUpload.mockResolvedValue(zipRow())
+ mockFindFolder.mockResolvedValue('folder-existing')
+ dbChainMockFns.limit.mockResolvedValueOnce([]) // no direct files
+ dbChainMockFns.limit.mockResolvedValueOnce([{ id: 'subfolder-1' }]) // but a subfolder tree
+
+ const result = await executeMaterializeFile(
+ { fileNames: ['bundle.zip'], operation: 'extract' },
+ context
+ )
+
+ expect(result.success).toBe(false)
+ const output = result.output as { failed: Array<{ fileName: string; error: string }> }
+ expect(output.failed[0].error).toContain('already extracted')
+ expect(mockDecompress).not.toHaveBeenCalled()
+ })
+
+ it('dedupes repeated fileNames so one call cannot double-extract', async () => {
+ mockFindUpload.mockResolvedValue(zipRow())
+ mockFetchBuffer.mockResolvedValue(Buffer.from('zip-bytes'))
+ mockDecompress.mockResolvedValue({
+ extracted: [{ id: 'f1', name: 'a.txt', url: '/x', size: 1, type: 'text/plain', key: 'k1' }],
+ skipped: 0,
+ skippedUnsafePaths: [],
+ })
+
+ const result = await executeMaterializeFile(
+ { fileNames: ['bundle.zip', 'bundle.zip'], operation: 'extract' },
+ context
+ )
+
+ expect(result.success).toBe(true)
+ expect(mockDecompress).toHaveBeenCalledTimes(1)
+ })
+
+ it('folds reserved system folder names into the "archive" fallback folder', async () => {
+ // '.changelogs' / '.plans' back workflow changelog/plan aliases; extraction
+ // must never write into them (and the already-extracted lookup hides them,
+ // so a second extract would silently duplicate).
+ mockFindUpload.mockResolvedValue(
+ zipRow({ displayName: '.changelogs.zip', originalName: '.changelogs.zip' })
+ )
+ mockFetchBuffer.mockResolvedValue(Buffer.from('zip-bytes'))
+ mockDecompress.mockResolvedValue({
+ extracted: [{ id: 'f1', name: 'a.txt', url: '/x', size: 1, type: 'text/plain', key: 'k1' }],
+ skipped: 0,
+ skippedUnsafePaths: [],
+ })
+
+ const result = await executeMaterializeFile(
+ { fileNames: ['.changelogs.zip'], operation: 'extract' },
+ context
+ )
+
+ expect(result.success).toBe(true)
+ expect(mockDecompress).toHaveBeenCalledWith(
+ expect.any(Buffer),
+ expect.objectContaining({ rootFolderSegments: ['archive'] })
+ )
+ })
+
+ it('folds degenerate archive names into the "archive" fallback folder', async () => {
+ mockFindUpload.mockResolvedValue(zipRow({ displayName: '..zip', originalName: '..zip' }))
+ mockFetchBuffer.mockResolvedValue(Buffer.from('zip-bytes'))
+ mockDecompress.mockResolvedValue({
+ extracted: [{ id: 'f1', name: 'a.txt', url: '/x', size: 1, type: 'text/plain', key: 'k1' }],
+ skipped: 0,
+ skippedUnsafePaths: [],
+ })
+
+ const result = await executeMaterializeFile(
+ { fileNames: ['..zip'], operation: 'extract' },
+ context
+ )
+
+ expect(result.success).toBe(true)
+ expect(mockDecompress).toHaveBeenCalledWith(
+ expect.any(Buffer),
+ expect.objectContaining({ rootFolderSegments: ['archive'] })
+ )
+ })
+})
+
+describe('executeMaterializeFile - save operation on archives', () => {
+ beforeEach(() => {
+ vi.clearAllMocks()
+ mockFindFolder.mockResolvedValue(null)
+ })
+
+ it('refuses to save a .zip upload and points at extract instead', async () => {
+ mockFindUpload.mockResolvedValue({
+ id: 'wf_zip',
+ key: 'mothership/abc/bundle.zip',
+ userId: 'user-1',
+ workspaceId: 'ws-1',
+ context: 'mothership',
+ chatId: 'chat-1',
+ originalName: 'bundle.zip',
+ displayName: 'bundle.zip',
+ contentType: 'application/zip',
+ size: 2048,
+ deletedAt: null,
+ uploadedAt: new Date(),
+ updatedAt: new Date(),
+ })
+
+ const result = await executeMaterializeFile({ fileNames: ['bundle.zip'] }, context)
+
+ expect(result.success).toBe(false)
+ const output = result.output as { failed: Array<{ fileName: string; error: string }> }
+ expect(output.failed[0].error).toContain('operation: "extract"')
+ expect(mockDecompress).not.toHaveBeenCalled()
+ })
+})
diff --git a/apps/sim/lib/copilot/tools/handlers/materialize-file.ts b/apps/sim/lib/copilot/tools/handlers/materialize-file.ts
index 407e41b58ab..7c47c0105ac 100644
--- a/apps/sim/lib/copilot/tools/handlers/materialize-file.ts
+++ b/apps/sim/lib/copilot/tools/handlers/materialize-file.ts
@@ -1,6 +1,6 @@
import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
import { db } from '@sim/db'
-import { workflow, workspaceFiles } from '@sim/db/schema'
+import { workflow, workspaceFileFolder, workspaceFiles } from '@sim/db/schema'
import { createLogger } from '@sim/logger'
import { getErrorMessage, toError } from '@sim/utils/errors'
import { generateId } from '@sim/utils/id'
@@ -13,10 +13,19 @@ import {
} from '@/lib/billing/storage'
import type { ExecutionContext, ToolCallResult } from '@/lib/copilot/request/types'
import { findMothershipUploadRowByChatAndName } from '@/lib/copilot/tools/handlers/upload-file-reader'
-import { canonicalWorkspaceFilePath } from '@/lib/copilot/vfs/path-utils'
+import { canonicalWorkspaceFilePath, encodeVfsPathSegments } from '@/lib/copilot/vfs/path-utils'
+import { isReservedWorkflowAliasBackingDisplayPath } from '@/lib/copilot/vfs/workflow-aliases'
import { getServePathPrefix } from '@/lib/uploads'
+import {
+ ArchiveError,
+ type DecompressResult,
+ decompressArchiveBufferToWorkspaceFiles,
+ MAX_ARCHIVE_BYTES,
+} from '@/lib/uploads/archive'
+import { findWorkspaceFileFolderIdByPath } from '@/lib/uploads/contexts/workspace/workspace-file-folder-manager'
import { fetchWorkspaceFileBuffer } from '@/lib/uploads/contexts/workspace/workspace-file-manager'
import { hasCloudStorage, headObject } from '@/lib/uploads/core/storage-service'
+import { isArchiveFileName } from '@/lib/uploads/utils/file-utils'
import { parseWorkflowJson } from '@/lib/workflows/operations/import-export'
import { saveWorkflowToNormalizedTables } from '@/lib/workflows/persistence/utils'
import { deduplicateWorkflowName } from '@/lib/workflows/utils'
@@ -42,6 +51,20 @@ function toFileRecord(row: typeof workspaceFiles.$inferSelect) {
}
}
+/**
+ * Cross-workspace ownership guard shared by every operation. The resolver is
+ * chat-scoped and current write paths always stamp matching workspaceIds, so
+ * this is defense in depth — but it must hold uniformly: without it, save would
+ * flip a foreign-workspace row into this workspace and import would read its
+ * bytes, the exact leak extract blocks.
+ */
+function uploadBelongsToWorkspace(
+ row: { workspaceId: string | null },
+ workspaceId: string
+): boolean {
+ return row.workspaceId === workspaceId
+}
+
async function executeSave(
fileName: string,
chatId: string,
@@ -54,10 +77,18 @@ async function executeSave(
error: `Upload not found: "${fileName}". Use glob("uploads/*") to list available uploads.`,
}
}
- if (row.workspaceId !== workspaceId) {
+ if (!uploadBelongsToWorkspace(row, workspaceId)) {
return { success: false, error: `Upload not found: "${fileName}".` }
}
+ const displayName = row.displayName ?? row.originalName
+ if (isArchiveFileName(displayName)) {
+ return {
+ success: false,
+ error: `"${fileName}" is a .zip archive — save it by extracting instead: materialize_file(fileNames: ["${fileName}"], operation: "extract") unpacks it into files/ where the contents stay readable. The raw .zip remains in uploads/ for this chat.`,
+ }
+ }
+
const head = await headObject(row.key, 'mothership')
if (!head && hasCloudStorage()) {
return { success: false, error: `Upload object not found: "${fileName}".` }
@@ -158,6 +189,18 @@ async function executeImport(
error: `Upload not found: "${fileName}". Use glob("uploads/*") to list available uploads.`,
}
}
+ if (!uploadBelongsToWorkspace(row, workspaceId)) {
+ return {
+ success: false,
+ error: `Upload "${fileName}" does not belong to this workspace.`,
+ }
+ }
+ if (isArchiveFileName(row.displayName ?? row.originalName)) {
+ return {
+ success: false,
+ error: `"${fileName}" is a .zip archive, not a workflow JSON. Extract it first: materialize_file(fileNames: ["${fileName}"], operation: "extract").`,
+ }
+ }
const buffer = await fetchWorkspaceFileBuffer(toFileRecord(row))
const content = buffer.toString('utf-8')
@@ -254,13 +297,198 @@ async function executeImport(
}
}
+/**
+ * Fold a zip display name into a safe extraction folder name. Mirrors the VFS
+ * segment normalization (NFC, control-char strip) and rejects the degenerate
+ * names the folder layer throws plain Errors for (dot segments, separators,
+ * empty), so a hostile upload name like `..zip` or `\x01.zip` lands in the
+ * `archive` fallback instead of surfacing a raw internal error — and so the
+ * VFS-encoded destination path can be computed before anything is extracted.
+ * Reserved system backing folders (`.changelogs`, `.plans`) also fall back:
+ * extraction must never write into — or hide behind — those namespaces (the
+ * already-extracted lookup skips them, so they'd also duplicate silently).
+ */
+function archiveFolderBaseName(displayName: string): string {
+ const stripped = displayName
+ .replace(/\.zip$/i, '')
+ .normalize('NFC')
+ .replace(/[\x00-\x1f\x7f]/g, '')
+ .replace(/[/\\]/g, '-')
+ .trim()
+ if (
+ !stripped ||
+ stripped === '.' ||
+ stripped === '..' ||
+ isReservedWorkflowAliasBackingDisplayPath(stripped)
+ ) {
+ return 'archive'
+ }
+ return stripped
+}
+
+/**
+ * Decompress an uploaded `.zip` into the workspace `files//` folder tree
+ * (reusing the shared, capped, zip-slip/bomb-safe extractor). The raw archive
+ * stays in uploads/; the extracted files persist in the workspace so the agent
+ * can read them with the normal files/ tooling. This is the explicit "extract
+ * before reading a zip" step.
+ */
+async function executeExtract(
+ fileName: string,
+ chatId: string,
+ workspaceId: string,
+ userId: string
+): Promise {
+ const row = await findMothershipUploadRowByChatAndName(chatId, fileName)
+ if (!row) {
+ return {
+ success: false,
+ error: `Upload not found: "${fileName}". Use glob("uploads/*") to list available uploads.`,
+ }
+ }
+
+ if (!uploadBelongsToWorkspace(row, workspaceId)) {
+ return {
+ success: false,
+ error: `Upload "${fileName}" does not belong to this workspace.`,
+ }
+ }
+
+ const displayName = row.displayName ?? row.originalName
+ if (!isArchiveFileName(displayName)) {
+ return {
+ success: false,
+ error: `"${fileName}" is not a .zip archive — only .zip uploads can be extracted. Read it directly with read("uploads/${fileName}").`,
+ }
+ }
+
+ const record = toFileRecord(row)
+ if (record.size > MAX_ARCHIVE_BYTES) {
+ return {
+ success: false,
+ error: `Archive too large to extract: "${fileName}" (${Math.round(
+ record.size / 1024 / 1024
+ )}MB, limit ${MAX_ARCHIVE_BYTES / 1024 / 1024}MB).`,
+ }
+ }
+
+ // Resolve the destination up front (the encoded path is a pure function of the
+ // hardened base name), so nothing can throw after files have been written.
+ const baseName = archiveFolderBaseName(displayName)
+ const folderPath = `files/${encodeVfsPathSegments([baseName])}`
+
+ // Re-running extract must not silently duplicate the tree with " (1)"-suffixed
+ // copies: when the destination folder already holds content, report it as
+ // already extracted instead of extracting beside the previous run. Direct
+ // files AND direct subfolders both count — extraction roots its whole tree
+ // here, so a prior run of a nested-only zip (e.g. src/index.ts) leaves a
+ // subfolder even when no file sits at the top level.
+ const existingFolderId = await findWorkspaceFileFolderIdByPath(workspaceId, [baseName])
+ if (existingFolderId) {
+ const [[existingFile], [existingSubfolder]] = await Promise.all([
+ db
+ .select({ id: workspaceFiles.id })
+ .from(workspaceFiles)
+ .where(
+ and(
+ eq(workspaceFiles.folderId, existingFolderId),
+ eq(workspaceFiles.context, 'workspace'),
+ isNull(workspaceFiles.deletedAt)
+ )
+ )
+ .limit(1),
+ db
+ .select({ id: workspaceFileFolder.id })
+ .from(workspaceFileFolder)
+ .where(
+ and(
+ eq(workspaceFileFolder.parentId, existingFolderId),
+ isNull(workspaceFileFolder.deletedAt)
+ )
+ )
+ .limit(1),
+ ])
+ if (existingFile || existingSubfolder) {
+ return {
+ success: false,
+ error: `"${fileName}" appears to be already extracted — ${folderPath}/ exists and contains content. List it with glob("${folderPath}/**"). To re-extract, delete that folder first.`,
+ }
+ }
+ }
+
+ let result: DecompressResult
+ try {
+ const buffer = await fetchWorkspaceFileBuffer(record, { maxBytes: MAX_ARCHIVE_BYTES })
+ result = await decompressArchiveBufferToWorkspaceFiles(buffer, {
+ workspaceId,
+ userId,
+ rootFolderSegments: [baseName],
+ // The agent-facing extract drops macOS/Windows filesystem cruft so the
+ // unpacked files/ tree only contains meaningful entries.
+ skipNoiseEntries: true,
+ })
+ } catch (err) {
+ if (err instanceof ArchiveError) {
+ // Reads sniff small uploads' magic bytes, so a mislabeled ".zip" that
+ // fails to parse here is genuinely readable via read() — say so instead
+ // of bouncing the model between extract and read forever.
+ const mislabeledHint =
+ err.reason === 'invalid'
+ ? ` If the file is not actually a zip archive, read it directly with read("uploads/${fileName}").`
+ : ''
+ return {
+ success: false,
+ error: `Cannot extract "${fileName}": ${err.message}${mislabeledHint}`,
+ }
+ }
+ throw err
+ }
+
+ if (result.extracted.length === 0) {
+ return { success: false, error: `No files could be extracted from "${fileName}".` }
+ }
+
+ const count = result.extracted.length
+
+ if (result.skippedUnsafePaths.length > 0) {
+ logger.warn('Skipped unsafe archive entries during extract', {
+ fileName,
+ chatId,
+ entryNames: result.skippedUnsafePaths,
+ })
+ }
+
+ logger.info('Extracted archive into workspace files', {
+ fileName,
+ chatId,
+ folder: baseName,
+ extractedCount: count,
+ skipped: result.skipped,
+ })
+
+ return {
+ success: true,
+ output: {
+ message: `Extracted ${count} file${count === 1 ? '' : 's'} from "${fileName}" into ${folderPath}/. They now persist in the workspace — list them with glob("${folderPath}/**") and read one with read("${folderPath}//content").`,
+ fileCount: count,
+ path: folderPath,
+ },
+ resources: result.extracted.map((f) => ({ type: 'file' as const, id: f.id, title: f.name })),
+ }
+}
+
export async function executeMaterializeFile(
params: Record,
context: ExecutionContext
): Promise {
- const fileNames: string[] =
- (params.fileNames as string[] | undefined) ??
- ([params.fileName as string | undefined].filter(Boolean) as string[])
+ // Dedupe: a repeated name in one call would re-run the operation against the
+ // same upload (for extract, duplicating the unpacked tree with " (1)" copies).
+ const fileNames: string[] = Array.from(
+ new Set(
+ (params.fileNames as string[] | undefined) ??
+ ([params.fileName as string | undefined].filter(Boolean) as string[])
+ )
+ )
if (fileNames.length === 0) {
return { success: false, error: "Missing required parameter 'fileNames'" }
@@ -275,12 +503,13 @@ export async function executeMaterializeFile(
}
const operation = (params.operation as string | undefined) || 'save'
- // Only save/import are implemented. Reject anything else with guidance instead of
- // silently falling back to save (table/knowledge_base are handled by their subagents).
- if (operation !== 'save' && operation !== 'import') {
+ // save (promote upload → workspace file), import (JSON → workflow), and extract
+ // (decompress a .zip upload → workspace files/) are implemented. Reject anything
+ // else with guidance instead of silently falling back to save.
+ if (operation !== 'save' && operation !== 'import' && operation !== 'extract') {
return {
success: false,
- error: `Unsupported materialize_file operation "${operation}". Use "save" or "import". For CSV/TSV/JSON → use the table subagent; for documents → use the knowledge subagent.`,
+ error: `Unsupported materialize_file operation "${operation}". Use "save", "import", or "extract". For CSV/TSV/JSON → use the table subagent; for documents → use the knowledge subagent.`,
}
}
const succeeded: string[] = []
@@ -292,6 +521,8 @@ export async function executeMaterializeFile(
let result: ToolCallResult
if (operation === 'import') {
result = await executeImport(fileName, context.chatId, context.workspaceId, context.userId)
+ } else if (operation === 'extract') {
+ result = await executeExtract(fileName, context.chatId, context.workspaceId, context.userId)
} else {
result = await executeSave(fileName, context.chatId, context.workspaceId)
}
diff --git a/apps/sim/lib/copilot/tools/handlers/upload-file-reader.test.ts b/apps/sim/lib/copilot/tools/handlers/upload-file-reader.test.ts
index 065b287b99e..2f78577deef 100644
--- a/apps/sim/lib/copilot/tools/handlers/upload-file-reader.test.ts
+++ b/apps/sim/lib/copilot/tools/handlers/upload-file-reader.test.ts
@@ -7,16 +7,27 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
vi.mock('@sim/db', () => dbChainMock)
-const { mockReadFileRecord } = vi.hoisted(() => ({
+const { mockReadFileRecord, mockFetchBuffer } = vi.hoisted(() => ({
mockReadFileRecord: vi.fn(),
+ mockFetchBuffer: vi.fn(),
}))
vi.mock('@/lib/copilot/vfs/file-reader', () => ({
readFileRecord: mockReadFileRecord,
+ MAX_TEXT_READ_BYTES: 5 * 1024 * 1024,
}))
+vi.mock('@/lib/uploads/contexts/workspace/workspace-file-manager', () => ({
+ fetchWorkspaceFileBuffer: mockFetchBuffer,
+}))
+
+/** A buffer beginning with the ZIP local-file-header magic (PK\x03\x04). */
+const ZIP_SHAPED = Buffer.from([0x50, 0x4b, 0x03, 0x04, 0x14, 0x00, 0x00, 0x00])
+
+import { WorkspaceFileGrepError } from '@/lib/copilot/vfs/operations'
import {
findMothershipUploadRowByChatAndName,
+ grepChatUpload,
listChatUploads,
readChatUpload,
} from './upload-file-reader'
@@ -167,6 +178,46 @@ describe('readChatUpload', () => {
)
})
+ it('returns extract-first guidance for a .zip upload instead of reading bytes', async () => {
+ const row = makeRow({ id: 'wf_z', displayName: 'bundle.zip', contentType: 'application/zip' })
+ mockOrderByThenLimit([row])
+ mockFetchBuffer.mockResolvedValueOnce(ZIP_SHAPED)
+
+ const result = await readChatUpload('bundle.zip', CHAT_ID)
+
+ expect(result?.content).toContain('materialize_file')
+ expect(result?.content).toContain('extract')
+ expect(mockReadFileRecord).not.toHaveBeenCalled()
+ })
+
+ it('returns extract-first guidance for a large .zip without downloading it', async () => {
+ const row = makeRow({
+ id: 'wf_z',
+ displayName: 'huge.zip',
+ contentType: 'application/zip',
+ size: 50 * 1024 * 1024,
+ })
+ mockOrderByThenLimit([row])
+
+ const result = await readChatUpload('huge.zip', CHAT_ID)
+
+ expect(result?.content).toContain('materialize_file')
+ expect(mockFetchBuffer).not.toHaveBeenCalled()
+ expect(mockReadFileRecord).not.toHaveBeenCalled()
+ })
+
+ it('reads a small mislabeled ".zip" (non-zip bytes) normally instead of dead-ending it', async () => {
+ const row = makeRow({ id: 'wf_m', displayName: 'data.zip', contentType: 'text/csv' })
+ mockOrderByThenLimit([row])
+ mockFetchBuffer.mockResolvedValueOnce(Buffer.from('a,b,c\n1,2,3\n'))
+ mockReadFileRecord.mockResolvedValueOnce({ content: 'a,b,c\n1,2,3', totalLines: 2 })
+
+ const result = await readChatUpload('data.zip', CHAT_ID)
+
+ expect(result).toEqual({ content: 'a,b,c\n1,2,3', totalLines: 2 })
+ expect(mockReadFileRecord).toHaveBeenCalledTimes(1)
+ })
+
it('returns null when no row matches', async () => {
mockOrderByThenLimit([])
dbChainMockFns.orderBy.mockResolvedValueOnce([] as never)
@@ -177,3 +228,24 @@ describe('readChatUpload', () => {
expect(mockReadFileRecord).not.toHaveBeenCalled()
})
})
+
+describe('grepChatUpload', () => {
+ beforeEach(() => {
+ vi.clearAllMocks()
+ resetDbChainMock()
+ mockReadFileRecord.mockReset()
+ })
+
+ it('throws WorkspaceFileGrepError with extract-first guidance for a .zip upload', async () => {
+ const row = makeRow({ id: 'wf_z', displayName: 'bundle.zip', contentType: 'application/zip' })
+ mockOrderByThenLimit([row])
+ mockFetchBuffer.mockResolvedValueOnce(ZIP_SHAPED)
+
+ const error = await grepChatUpload('bundle.zip', CHAT_ID, 'foo').catch((e) => e)
+
+ expect(error).toBeInstanceOf(WorkspaceFileGrepError)
+ expect(error.message).toContain('materialize_file')
+ expect(error.message).toContain('extract')
+ expect(mockReadFileRecord).not.toHaveBeenCalled()
+ })
+})
diff --git a/apps/sim/lib/copilot/tools/handlers/upload-file-reader.ts b/apps/sim/lib/copilot/tools/handlers/upload-file-reader.ts
index 0e914229c8a..171a1589a25 100644
--- a/apps/sim/lib/copilot/tools/handlers/upload-file-reader.ts
+++ b/apps/sim/lib/copilot/tools/handlers/upload-file-reader.ts
@@ -3,7 +3,11 @@ import { workspaceFiles } from '@sim/db/schema'
import { createLogger } from '@sim/logger'
import { toError } from '@sim/utils/errors'
import { and, asc, desc, eq, isNull, or } from 'drizzle-orm'
-import { type FileReadResult, readFileRecord } from '@/lib/copilot/vfs/file-reader'
+import {
+ type FileReadResult,
+ MAX_TEXT_READ_BYTES,
+ readFileRecord,
+} from '@/lib/copilot/vfs/file-reader'
import {
type GrepCountEntry,
type GrepMatch,
@@ -12,11 +16,42 @@ import {
WorkspaceFileGrepError,
} from '@/lib/copilot/vfs/operations'
import { decodeVfsSegment, encodeVfsSegment } from '@/lib/copilot/vfs/path-utils'
+import { isZipShaped } from '@/lib/file-parsers/zip-guard'
import { getServePathPrefix } from '@/lib/uploads'
-import type { WorkspaceFileRecord } from '@/lib/uploads/contexts/workspace/workspace-file-manager'
+import {
+ fetchWorkspaceFileBuffer,
+ type WorkspaceFileRecord,
+} from '@/lib/uploads/contexts/workspace/workspace-file-manager'
+import { buildArchiveExtractGuidance, isArchiveFileName } from '@/lib/uploads/utils/file-utils'
const logger = createLogger('UploadFileReader')
+/**
+ * Sniff budget for uploads whose NAME says archive: below this size the actual
+ * bytes decide (a mislabeled text file named `data.zip` stays readable instead
+ * of being trapped between read-says-extract and extract-says-invalid); above
+ * it the extension is trusted so a real 100MB zip is never downloaded just to
+ * refuse it. Aligned with the read path's inline text cap — any mislabeled
+ * file too big to sniff would be rejected by read() as too large anyway, so
+ * nothing readable is ever dead-ended.
+ */
+const ARCHIVE_SNIFF_MAX_BYTES = MAX_TEXT_READ_BYTES
+
+/**
+ * True when the upload should get extract-first guidance: named like an archive
+ * and — for small files — actually shaped like one.
+ */
+async function isActualArchiveUpload(record: WorkspaceFileRecord): Promise {
+ if (!isArchiveFileName(record.name)) return false
+ if (record.size > ARCHIVE_SNIFF_MAX_BYTES) return true
+ try {
+ const buffer = await fetchWorkspaceFileBuffer(record, { maxBytes: ARCHIVE_SNIFF_MAX_BYTES })
+ return isZipShaped(buffer)
+ } catch {
+ return true
+ }
+}
+
/**
* Canonical comparison key for an upload's VFS name. Accepts both the raw display
* name and a percent-encoded segment (decode first — a no-op for raw names —
@@ -142,7 +177,8 @@ export async function listChatUploads(chatId: string): Promise
+}
+
+interface ShareFileResult {
+ success: boolean
+ message: string
+ data?: {
+ url: string
+ token: string
+ authType: ShareAuthType
+ hasPassword: boolean
+ isActive: boolean
+ }
+}
+
+export const shareFileServerTool: BaseServerTool = {
+ name: ShareFile.id,
+ async execute(params: ShareFileArgs, context?: ServerToolContext): Promise {
+ if (!context?.userId) {
+ throw new Error('Authentication required')
+ }
+ const workspaceId = context.workspaceId
+ if (!workspaceId) {
+ return { success: false, message: 'Workspace ID is required' }
+ }
+ await ensureWorkspaceAccess(workspaceId, context.userId, 'write')
+
+ const nested = params.args
+ const path = params.path || (nested?.path as string) || ''
+ const legacyFileId = params.fileId || (nested?.fileId as string) || ''
+ const action = (params.action || (nested?.action as string) || 'share') as 'share' | 'unshare'
+ const authType = (params.authType || (nested?.authType as ShareAuthType | undefined)) as
+ | ShareAuthType
+ | undefined
+ const password = params.password || (nested?.password as string) || undefined
+ const allowedEmails =
+ params.allowedEmails || (nested?.allowedEmails as string[] | undefined) || undefined
+
+ const targetRef = path || legacyFileId
+ if (!targetRef) return { success: false, message: 'path is required' }
+
+ const existingFile = path
+ ? await resolveWorkspaceFileReference(workspaceId, path)
+ : await getWorkspaceFile(workspaceId, legacyFileId)
+ if (!existingFile) {
+ return { success: false, message: `File not found: ${targetRef}` }
+ }
+ const fileId = existingFile.id
+ const isActive = action !== 'unshare'
+ const existingShare = await getShareForResource('file', fileId)
+
+ // Unsharing a file that was never shared (or is already disabled) is a no-op:
+ // never insert an inactive row, emit a FILE_SHARE_DISABLED audit, or return a
+ // link claiming a share was revoked when none existed.
+ if (!isActive && !existingShare?.isActive) {
+ return {
+ success: true,
+ message: `"${existingFile.name}" isn't shared — nothing to unshare.`,
+ }
+ }
+
+ // Enabling a share is gated by the org's access-control policy (both the
+ // master on/off and the per-auth-type allow-list); disabling is always
+ // allowed so users can still un-share after the policy is turned on.
+ if (isActive) {
+ // Validate the auth type that will ACTUALLY be persisted. upsertFileShare
+ // falls back to the existing share's authType when none is passed, so a bare
+ // re-enable must be checked against that stored mode — not 'public' — or a
+ // now-disallowed password/email/sso share could be silently reactivated.
+ const effectiveAuthType = authType ?? existingShare?.authType ?? 'public'
+ try {
+ await validatePublicFileSharing(context.userId, workspaceId, effectiveAuthType)
+ } catch (error) {
+ if (error instanceof PublicFileSharingNotAllowedError) {
+ return { success: false, message: error.message }
+ }
+ throw error
+ }
+ }
+
+ assertServerToolNotAborted(context)
+
+ let share
+ try {
+ share = await upsertFileShare({
+ workspaceId,
+ fileId,
+ userId: context.userId,
+ isActive,
+ authType,
+ password,
+ allowedEmails,
+ })
+ } catch (error) {
+ if (error instanceof ShareValidationError) {
+ return { success: false, message: error.message }
+ }
+ throw error
+ }
+
+ logger.info(`${isActive ? 'Enabled' : 'Disabled'} share for file via share_file`, {
+ fileId,
+ workspaceId,
+ authType: share.authType,
+ userId: context.userId,
+ })
+
+ recordAudit({
+ workspaceId,
+ actorId: context.userId,
+ action: isActive ? AuditAction.FILE_SHARED : AuditAction.FILE_SHARE_DISABLED,
+ resourceType: AuditResourceType.FILE,
+ resourceId: fileId,
+ resourceName: existingFile.name,
+ description: `${isActive ? 'Enabled' : 'Disabled'} public share for "${existingFile.name}"`,
+ })
+
+ if (!isActive) {
+ return {
+ success: true,
+ message: `Stopped sharing "${existingFile.name}". The previous link no longer works.`,
+ data: {
+ url: share.url,
+ token: share.token,
+ authType: share.authType,
+ hasPassword: share.hasPassword,
+ isActive: share.isActive,
+ },
+ }
+ }
+
+ const authNote =
+ share.authType === 'password'
+ ? ' (password-protected — share the password separately)'
+ : share.authType === 'email'
+ ? ' (restricted to allowed emails via one-time code)'
+ : share.authType === 'sso'
+ ? ' (restricted to allowed emails via SSO)'
+ : ''
+
+ return {
+ success: true,
+ message: `Shared "${existingFile.name}"${authNote}: ${share.url}`,
+ data: {
+ url: share.url,
+ token: share.token,
+ authType: share.authType,
+ hasPassword: share.hasPassword,
+ isActive: share.isActive,
+ },
+ }
+ },
+}
diff --git a/apps/sim/lib/copilot/tools/server/router.ts b/apps/sim/lib/copilot/tools/server/router.ts
index 14afe0f80fe..fbd1dcbdac2 100644
--- a/apps/sim/lib/copilot/tools/server/router.ts
+++ b/apps/sim/lib/copilot/tools/server/router.ts
@@ -40,6 +40,7 @@ import {
renameFileFolderServerTool,
} from '@/lib/copilot/tools/server/files/file-folders'
import { renameFileServerTool } from '@/lib/copilot/tools/server/files/rename-file'
+import { shareFileServerTool } from '@/lib/copilot/tools/server/files/share-file'
import { workspaceFileServerTool } from '@/lib/copilot/tools/server/files/workspace-file'
import { validateGeneratedToolPayload } from '@/lib/copilot/tools/server/generated-schema'
import { generateImageServerTool } from '@/lib/copilot/tools/server/image/generate-image'
@@ -129,6 +130,7 @@ const WRITE_ACTIONS: Record = {
[CreateFile.id]: ['*'],
rename_file: ['*'],
[DeleteFile.id]: ['*'],
+ [shareFileServerTool.name]: ['*'],
move_file: ['*'],
create_file_folder: ['*'],
rename_file_folder: ['*'],
@@ -176,6 +178,7 @@ const baseServerToolRegistry: Record = {
[createFileServerTool.name]: createFileServerTool,
[renameFileServerTool.name]: renameFileServerTool,
[deleteFileServerTool.name]: deleteFileServerTool,
+ [shareFileServerTool.name]: shareFileServerTool,
[moveFileServerTool.name]: moveFileServerTool,
[listFileFoldersServerTool.name]: listFileFoldersServerTool,
[createFileFolderServerTool.name]: createFileFolderServerTool,
diff --git a/apps/sim/lib/copilot/tools/tool-display.ts b/apps/sim/lib/copilot/tools/tool-display.ts
index 8cc89868cc6..5aee46abeb9 100644
--- a/apps/sim/lib/copilot/tools/tool-display.ts
+++ b/apps/sim/lib/copilot/tools/tool-display.ts
@@ -615,6 +615,12 @@ export function getToolDisplayTitle(name: string, args?: Record
const targets = stringArrayArg(args, 'paths').map(pathLeaf)
return `Deleting ${summarizeTargets(targets, 'folder')}`
}
+ case 'share_file': {
+ const action = stringArg(args, 'action') || 'share'
+ const path = stringArg(args, 'path')
+ const target = firstStringArg(args, 'toolTitle', 'title') || (path ? pathLeaf(path) : 'file')
+ return action === 'unshare' ? `Unsharing ${target}` : `Sharing ${target}`
+ }
case 'create_workflow': {
const target = firstStringArg(args, 'name', 'workflowName', 'title')
return `Creating ${target || 'workflow'}`
@@ -864,11 +870,13 @@ const COMPLETED_VERB_REWRITES: Record = {
Scraping: 'Scraped',
Searching: 'Searched',
Setting: 'Set',
+ Sharing: 'Shared',
Summarizing: 'Summarized',
Syncing: 'Synced',
Toggling: 'Toggled',
Trimming: 'Trimmed',
Undeploying: 'Undeployed',
+ Unsharing: 'Unshared',
Updating: 'Updated',
Validating: 'Validated',
Viewing: 'Viewed',
diff --git a/apps/sim/lib/copilot/vfs/file-reader.ts b/apps/sim/lib/copilot/vfs/file-reader.ts
index 26388d5621a..b8b4ba4768d 100644
--- a/apps/sim/lib/copilot/vfs/file-reader.ts
+++ b/apps/sim/lib/copilot/vfs/file-reader.ts
@@ -26,7 +26,8 @@ function recordSpanError(span: Span, err: unknown) {
const logger = createLogger('FileReader')
-const MAX_TEXT_READ_BYTES = 5 * 1024 * 1024 // 5 MB
+/** Inline text-read cap — exported so callers can align their own byte-sniff budgets with what read() can actually display. */
+export const MAX_TEXT_READ_BYTES = 5 * 1024 * 1024 // 5 MB
const MAX_IMAGE_READ_BYTES = 5 * 1024 * 1024 // 5 MB
// Parseable-document byte cap. Large office/PDF files can still
// produce huge extracted text; reject up front to avoid wasting a
diff --git a/apps/sim/lib/copilot/vfs/serializers.ts b/apps/sim/lib/copilot/vfs/serializers.ts
index c5cd191208f..6e3ff25277c 100644
--- a/apps/sim/lib/copilot/vfs/serializers.ts
+++ b/apps/sim/lib/copilot/vfs/serializers.ts
@@ -1,3 +1,4 @@
+import type { ShareAuthType } from '@/lib/api/contracts/public-shares'
import { getCopilotToolDescription } from '@/lib/copilot/tools/descriptions'
import { isHosted } from '@/lib/core/config/env-flags'
import { type FilterFieldType, getOperatorsForFieldType } from '@/lib/knowledge/filters/types'
@@ -366,6 +367,12 @@ export function serializeFileMeta(file: {
size: number
uploadedAt: Date
updatedAt: Date
+ /** Whether the file has an active public share link. */
+ shared?: boolean
+ /** Auth mode of the active share; only meaningful when `shared` is true. */
+ shareAuthType?: ShareAuthType
+ /** Public share link (`{baseUrl}/f/{token}`); only meaningful when `shared` is true. */
+ shareUrl?: string
}): string {
return JSON.stringify(
{
@@ -379,6 +386,9 @@ export function serializeFileMeta(file: {
uploadedAt: file.uploadedAt.toISOString(),
updatedAt: file.updatedAt.toISOString(),
readContentWith: file.vfsPath ? `${file.vfsPath}/content` : undefined,
+ shared: Boolean(file.shared),
+ shareAuthType: file.shared ? file.shareAuthType : undefined,
+ shareUrl: file.shared ? file.shareUrl : undefined,
note: 'This is file metadata only. To read the file text/bytes, read the readContentWith path (i.e. append /content).',
},
null,
diff --git a/apps/sim/lib/copilot/vfs/workspace-vfs.ts b/apps/sim/lib/copilot/vfs/workspace-vfs.ts
index d2cdf671eb1..fb8e7550199 100644
--- a/apps/sim/lib/copilot/vfs/workspace-vfs.ts
+++ b/apps/sim/lib/copilot/vfs/workspace-vfs.ts
@@ -104,6 +104,7 @@ import { BINARY_DOC_TASKS, MAX_DOCUMENT_PREVIEW_CODE_BYTES } from '@/lib/executi
import { runSandboxTask, SandboxUserCodeError } from '@/lib/execution/sandbox/run-task'
import { getKnowledgeBases } from '@/lib/knowledge/service'
import { validateMermaidSource } from '@/lib/mermaid/validate'
+import { getSharesForResources } from '@/lib/public-shares/share-manager'
import { listTables } from '@/lib/table/service'
import { listWorkspaceFileFolders } from '@/lib/uploads/contexts/workspace/workspace-file-folder-manager'
import {
@@ -1738,6 +1739,23 @@ export class WorkspaceVFS {
includeReservedSystemFiles: true,
throwOnError: true,
})
+ // Batch-load public share state so each file's metadata carries an ambient
+ // `shared` flag (mirrors how the files-list UI enriches rows) — no N+1.
+ // Fail soft: share state is only metadata enrichment, so a lookup failure
+ // must not drop the whole file tree (the outer catch returns []) — fall back
+ // to no shares, and files still materialize with `shared: false`.
+ let shareByFileId: Awaited> = new Map()
+ try {
+ shareByFileId = await getSharesForResources(
+ 'file',
+ files.map((file) => file.id)
+ )
+ } catch (error) {
+ logger.warn('Failed to load file share state; file metadata will show shared: false', {
+ workspaceId,
+ error: toError(error).message,
+ })
+ }
for (const folder of folders) {
if (
!workflowArtifactsEnabled &&
@@ -1756,6 +1774,8 @@ export class WorkspaceVFS {
if (!workflowArtifactsEnabled && isWorkflowAliasBackingPath(filePath)) {
continue
}
+ const share = shareByFileId.get(file.id)
+ const shared = share?.isActive ?? false
this.files.set(
filePath,
serializeFileMeta({
@@ -1768,6 +1788,9 @@ export class WorkspaceVFS {
size: file.size,
uploadedAt: file.uploadedAt,
updatedAt: file.updatedAt,
+ shared,
+ shareAuthType: shared ? share?.authType : undefined,
+ shareUrl: shared ? share?.url : undefined,
})
)
}
diff --git a/apps/sim/lib/core/config/env.ts b/apps/sim/lib/core/config/env.ts
index c86eb9e7ff4..27aa7019f63 100644
--- a/apps/sim/lib/core/config/env.ts
+++ b/apps/sim/lib/core/config/env.ts
@@ -450,7 +450,7 @@ export const env = createEnv({
E2B_API_KEY: z.string().optional(), // E2B API key for sandbox creation
MOTHERSHIP_E2B_TEMPLATE_ID: z.string().optional(), // Custom E2B template with pre-installed CLI tools for shell execution
MOTHERSHIP_E2B_DOC_TEMPLATE_ID: z.string().optional(), // Dedicated E2B template with python-pptx/docx/openpyxl/reportlab for document generation; when set (and E2B enabled), docs compile via Python instead of the JS isolated-vm path
- E2B_PI_TEMPLATE_ID: z.string().optional(), // E2B template ID/alias with the Pi CLI + git baked in (Pi Coding Agent cloud mode)
+ E2B_PI_TEMPLATE_ID: z.string().optional(), // E2B template ID/alias with the Pi CLI + git baked in (Create PR and Review Code)
// Access Control (Permission Groups) - for self-hosted deployments
ACCESS_CONTROL_ENABLED: z.boolean().optional(), // Enable access control on self-hosted (bypasses plan requirements)
diff --git a/apps/sim/lib/core/security/input-validation.server.ts b/apps/sim/lib/core/security/input-validation.server.ts
index 7f81039622c..cfef31a08d2 100644
--- a/apps/sim/lib/core/security/input-validation.server.ts
+++ b/apps/sim/lib/core/security/input-validation.server.ts
@@ -433,9 +433,40 @@ export function createPinnedLookup(resolvedIP: string): LookupFunction {
*
* The `Agent` is captured for the lifetime of the returned function, so repeated
* calls (e.g. a provider tool loop) reuse its keep-alive connections.
+ *
+ * `allowH2` opts the pinned Agent into HTTP/2 (ALPN-negotiated, h1.1 fallback).
+ * It defaults to `false` to leave existing consumers unchanged. Enabling it does
+ * not weaken pinning: the pinned `connect.lookup` forces every connection on the
+ * Agent to `resolvedIP` regardless of authority, so h2 connection coalescing can
+ * never reach an address other than the validated one.
*/
-export function createPinnedFetch(resolvedIP: string): typeof fetch {
- const dispatcher = new Agent({ connect: { lookup: createPinnedLookup(resolvedIP) } })
+export function createPinnedFetch(
+ resolvedIP: string,
+ options?: { allowH2?: boolean }
+): typeof fetch {
+ return createPinnedFetchWithDispatcher(resolvedIP, options).fetch
+}
+
+/**
+ * Same as {@link createPinnedFetch} but also returns the underlying `Agent` so a
+ * caller with a defined connection lifetime (e.g. a long-lived MCP transport) can
+ * tear the Agent down on close instead of waiting for its idle timeout. Closing
+ * the Agent is what releases any pooled keep-alive / HTTP/2 sockets it holds.
+ *
+ * `maxResponseSize` caps the (decoded) response body in bytes and makes undici reject
+ * with `UND_ERR_RES_EXCEEDED_MAX_SIZE` once exceeded — a DoS backstop for one-shot
+ * callers reading from a URL taken from untrusted metadata. Omit it (the default) to
+ * leave the response unbounded, which streaming consumers like the MCP transport need.
+ */
+export function createPinnedFetchWithDispatcher(
+ resolvedIP: string,
+ options?: { allowH2?: boolean; maxResponseSize?: number }
+): { fetch: typeof fetch; dispatcher: Agent } {
+ const dispatcher = new Agent({
+ allowH2: options?.allowH2 ?? false,
+ connect: { lookup: createPinnedLookup(resolvedIP) },
+ ...(options?.maxResponseSize !== undefined ? { maxResponseSize: options.maxResponseSize } : {}),
+ })
const pinned = async (input: RequestInfo | URL, init?: RequestInit): Promise => {
// double-cast-allowed: DOM RequestInfo/URL and undici fetch input types differ but are structurally compatible at runtime (Node's global fetch IS undici)
@@ -447,7 +478,7 @@ export function createPinnedFetch(resolvedIP: string): typeof fetch {
return response as unknown as Response
}
- return pinned
+ return { fetch: pinned, dispatcher }
}
/**
diff --git a/apps/sim/lib/core/security/pinned-fetch.server.test.ts b/apps/sim/lib/core/security/pinned-fetch.server.test.ts
index e07d0d412dd..0ecfa22cb9e 100644
--- a/apps/sim/lib/core/security/pinned-fetch.server.test.ts
+++ b/apps/sim/lib/core/security/pinned-fetch.server.test.ts
@@ -55,6 +55,18 @@ describe('createPinnedFetch', () => {
expect(resolved).toEqual({ address: '203.0.113.10', family: 4 })
})
+ it('defaults allowH2 to false so existing consumers are unchanged', () => {
+ createPinnedFetch('203.0.113.10')
+ const opts = capturedAgentOptions[0] as { allowH2?: boolean }
+ expect(opts.allowH2).toBe(false)
+ })
+
+ it('opts the Agent into HTTP/2 when allowH2 is requested', () => {
+ createPinnedFetch('203.0.113.10', { allowH2: true })
+ const opts = capturedAgentOptions[0] as { allowH2?: boolean }
+ expect(opts.allowH2).toBe(true)
+ })
+
it('uses IPv6 family when the validated IP is IPv6', async () => {
createPinnedFetch('2606:4700:4700::1111')
const { connect } = capturedAgentOptions[0] as { connect: { lookup: PinnedLookup } }
diff --git a/apps/sim/lib/core/utils/stream-limits.ts b/apps/sim/lib/core/utils/stream-limits.ts
index 24d5182a9a8..ebbfe4463f8 100644
--- a/apps/sim/lib/core/utils/stream-limits.ts
+++ b/apps/sim/lib/core/utils/stream-limits.ts
@@ -255,6 +255,7 @@ export async function readResponseToBufferWithLimit(
}
if (
!options.allowNoBodyFallback &&
+ !options.preferTextFallback &&
!response.body &&
contentLength === null &&
(response.arrayBuffer || response.text)
diff --git a/apps/sim/lib/credentials/token-service-accounts/descriptors.ts b/apps/sim/lib/credentials/token-service-accounts/descriptors.ts
index a5939f10575..e60338c3b71 100644
--- a/apps/sim/lib/credentials/token-service-accounts/descriptors.ts
+++ b/apps/sim/lib/credentials/token-service-accounts/descriptors.ts
@@ -69,6 +69,8 @@ export const TRELLO_SERVICE_ACCOUNT_PROVIDER_ID = 'trello-service-account' as co
export const CALCOM_SERVICE_ACCOUNT_PROVIDER_ID = 'calcom-service-account' as const
export const WEALTHBOX_SERVICE_ACCOUNT_PROVIDER_ID = 'wealthbox-service-account' as const
export const PIPEDRIVE_SERVICE_ACCOUNT_PROVIDER_ID = 'pipedrive-service-account' as const
+export const CLAUDE_PLATFORM_SERVICE_ACCOUNT_PROVIDER_ID =
+ 'claude-platform-service-account' as const
const SHOPIFY_DOMAIN_HINT_REGEX = /^[a-z0-9][a-z0-9-]*\.myshopify\.com$/i
@@ -87,6 +89,7 @@ export type TokenServiceAccountProviderId =
| typeof CALCOM_SERVICE_ACCOUNT_PROVIDER_ID
| typeof WEALTHBOX_SERVICE_ACCOUNT_PROVIDER_ID
| typeof PIPEDRIVE_SERVICE_ACCOUNT_PROVIDER_ID
+ | typeof CLAUDE_PLATFORM_SERVICE_ACCOUNT_PROVIDER_ID
export const TOKEN_SERVICE_ACCOUNT_DESCRIPTORS: Record<
TokenServiceAccountProviderId,
@@ -350,6 +353,23 @@ export const TOKEN_SERVICE_ACCOUNT_DESCRIPTORS: Record<
'Each Pipedrive user has one API token per company — regenerating it breaks every integration using the old value, and API-token traffic gets lower rate limits than OAuth.',
authStyle: 'x-api-token',
},
+ [CLAUDE_PLATFORM_SERVICE_ACCOUNT_PROVIDER_ID]: {
+ providerId: CLAUDE_PLATFORM_SERVICE_ACCOUNT_PROVIDER_ID,
+ serviceLabel: 'Claude Platform',
+ tokenNoun: 'API key',
+ connectNoun: 'API key',
+ fields: [
+ {
+ id: 'apiToken',
+ label: 'API key',
+ placeholder: 'sk-ant-...',
+ secret: true,
+ hintPattern: /^sk-ant-/,
+ hintMessage: 'Claude Platform API keys usually start with sk-ant-.',
+ },
+ ],
+ docsUrl: 'https://docs.sim.ai/integrations/managed-agent',
+ },
}
/**
diff --git a/apps/sim/lib/credentials/token-service-accounts/server.ts b/apps/sim/lib/credentials/token-service-accounts/server.ts
index 9f01c3c0027..a7a693b1ca0 100644
--- a/apps/sim/lib/credentials/token-service-accounts/server.ts
+++ b/apps/sim/lib/credentials/token-service-accounts/server.ts
@@ -3,6 +3,7 @@ import {
ASANA_SERVICE_ACCOUNT_PROVIDER_ID,
ATTIO_SERVICE_ACCOUNT_PROVIDER_ID,
CALCOM_SERVICE_ACCOUNT_PROVIDER_ID,
+ CLAUDE_PLATFORM_SERVICE_ACCOUNT_PROVIDER_ID,
CLICKUP_SERVICE_ACCOUNT_PROVIDER_ID,
HUBSPOT_SERVICE_ACCOUNT_PROVIDER_ID,
isTokenServiceAccountProviderId,
@@ -21,6 +22,7 @@ import { validateAirtableServiceAccount } from '@/lib/credentials/token-service-
import { validateAsanaServiceAccount } from '@/lib/credentials/token-service-accounts/validators/asana'
import { validateAttioServiceAccount } from '@/lib/credentials/token-service-accounts/validators/attio'
import { validateCalcomServiceAccount } from '@/lib/credentials/token-service-accounts/validators/calcom'
+import { validateClaudePlatformServiceAccount } from '@/lib/credentials/token-service-accounts/validators/claude-platform'
import { validateClickupServiceAccount } from '@/lib/credentials/token-service-accounts/validators/clickup'
import { validateHubspotServiceAccount } from '@/lib/credentials/token-service-accounts/validators/hubspot'
import { validateLinearServiceAccount } from '@/lib/credentials/token-service-accounts/validators/linear'
@@ -80,6 +82,7 @@ const TOKEN_SERVICE_ACCOUNT_VALIDATORS: Record<
[CALCOM_SERVICE_ACCOUNT_PROVIDER_ID]: validateCalcomServiceAccount,
[WEALTHBOX_SERVICE_ACCOUNT_PROVIDER_ID]: validateWealthboxServiceAccount,
[PIPEDRIVE_SERVICE_ACCOUNT_PROVIDER_ID]: validatePipedriveServiceAccount,
+ [CLAUDE_PLATFORM_SERVICE_ACCOUNT_PROVIDER_ID]: validateClaudePlatformServiceAccount,
}
export function getTokenServiceAccountValidator(
diff --git a/apps/sim/lib/credentials/token-service-accounts/validators/claude-platform.ts b/apps/sim/lib/credentials/token-service-accounts/validators/claude-platform.ts
new file mode 100644
index 00000000000..f457d6be29d
--- /dev/null
+++ b/apps/sim/lib/credentials/token-service-accounts/validators/claude-platform.ts
@@ -0,0 +1,42 @@
+import {
+ fetchProvider,
+ throwForProviderResponse,
+} from '@/lib/credentials/token-service-accounts/errors'
+import type {
+ TokenServiceAccountFields,
+ TokenServiceAccountValidationResult,
+} from '@/lib/credentials/token-service-accounts/server'
+
+const AGENTS_URL = 'https://api.anthropic.com/v1/agents?limit=1'
+const ANTHROPIC_VERSION = '2023-06-01'
+const MANAGED_AGENTS_BETA = 'managed-agents-2026-04-01'
+
+/**
+ * Validates a Claude Platform API key by listing agents on the linked
+ * Anthropic workspace. 401/403 mean the key was rejected; any other non-2xx
+ * means Claude Platform is unavailable. The Managed Agents API has no
+ * "who am I" endpoint, so the key's last four characters are used as a
+ * human-distinguishable display name across multiple linked workspaces.
+ */
+export async function validateClaudePlatformServiceAccount(
+ fields: TokenServiceAccountFields
+): Promise {
+ const res = await fetchProvider(
+ AGENTS_URL,
+ {
+ headers: {
+ 'x-api-key': fields.apiToken,
+ 'anthropic-version': ANTHROPIC_VERSION,
+ 'anthropic-beta': MANAGED_AGENTS_BETA,
+ },
+ },
+ 'agents_list'
+ )
+ await throwForProviderResponse(res, 'agents_list')
+
+ const suffix = fields.apiToken.slice(-4)
+ return {
+ displayName: `Claude Platform (…${suffix})`,
+ auditMetadata: {},
+ }
+}
diff --git a/apps/sim/lib/file-parsers/yaml-parser.test.ts b/apps/sim/lib/file-parsers/yaml-parser.test.ts
new file mode 100644
index 00000000000..68464ece162
--- /dev/null
+++ b/apps/sim/lib/file-parsers/yaml-parser.test.ts
@@ -0,0 +1,127 @@
+/**
+ * @vitest-environment node
+ */
+import { describe, expect, it } from 'vitest'
+import {
+ assertYamlWithinLimits,
+ parseYAMLBuffer,
+ YamlComplexityError,
+} from '@/lib/file-parsers/yaml-parser'
+
+/**
+ * Build a chained alias-expansion ("billion laughs") YAML bomb: each level is
+ * an array that references the previous level `width` times, so the expanded
+ * node count grows as `width ^ levels` while the source stays tiny.
+ */
+function buildAliasBomb(levels: number, width: number): string {
+ const lines: string[] = [`l0: &l0 [${Array(width).fill('"x"').join(',')}]`]
+ for (let i = 1; i <= levels; i++) {
+ const refs = Array(width)
+ .fill(`*l${i - 1}`)
+ .join(',')
+ lines.push(`l${i}: &l${i} [${refs}]`)
+ }
+ lines.push(`root: [${Array(width).fill(`*l${levels}`).join(',')}]`)
+ return lines.join('\n')
+}
+
+describe('parseYAMLBuffer', () => {
+ it('parses a normal YAML document', async () => {
+ const result = await parseYAMLBuffer(
+ Buffer.from('name: sim\nlist:\n - a\n - b\nnested:\n key: value\n')
+ )
+ const parsed = JSON.parse(result.content)
+ expect(parsed).toEqual({ name: 'sim', list: ['a', 'b'], nested: { key: 'value' } })
+ expect(result.metadata.type).toBe('yaml')
+ expect(result.metadata.keys).toEqual(['name', 'list', 'nested'])
+ expect(result.metadata.depth).toBeGreaterThan(0)
+ })
+
+ it('reports depth and array metadata', async () => {
+ const result = await parseYAMLBuffer(Buffer.from('- 1\n- 2\n- 3\n'))
+ expect(result.metadata.isArray).toBe(true)
+ expect(result.metadata.itemCount).toBe(3)
+ expect(result.metadata.depth).toBe(1)
+ })
+
+ it('rejects an alias-expansion bomb before serialization', async () => {
+ const bomb = buildAliasBomb(9, 10)
+ expect(Buffer.byteLength(bomb)).toBeLessThan(2048)
+ await expect(parseYAMLBuffer(Buffer.from(bomb))).rejects.toBeInstanceOf(YamlComplexityError)
+ })
+
+ it('rejects a key-amplification bomb (aliased object with a long key)', async () => {
+ const longKey = 'k'.repeat(2000)
+ const lines: string[] = [`l0: &l0 {${longKey}: 1}`]
+ for (let i = 1; i <= 8; i++) {
+ lines.push(
+ `l${i}: &l${i} [${Array(10)
+ .fill(`*l${i - 1}`)
+ .join(',')}]`
+ )
+ }
+ lines.push(`root: [${Array(10).fill('*l8').join(',')}]`)
+ const bomb = lines.join('\n')
+ expect(Buffer.byteLength(bomb)).toBeLessThan(4096)
+ await expect(parseYAMLBuffer(Buffer.from(bomb))).rejects.toBeInstanceOf(YamlComplexityError)
+ })
+
+ it('surfaces malformed YAML as an Invalid YAML error', async () => {
+ await expect(parseYAMLBuffer(Buffer.from('key: "unterminated\n'))).rejects.toThrow(
+ /Invalid YAML/
+ )
+ })
+})
+
+describe('assertYamlWithinLimits', () => {
+ it('returns the depth of a well-formed structure', () => {
+ expect(assertYamlWithinLimits({ a: { b: { c: 1 } } })).toBe(3)
+ expect(assertYamlWithinLimits([1, 2, 3])).toBe(1)
+ expect(assertYamlWithinLimits('scalar')).toBe(0)
+ })
+
+ it('rejects nesting beyond the depth cap', () => {
+ let deep: unknown = 1
+ for (let i = 0; i < 600; i++) deep = { a: deep }
+ expect(() => assertYamlWithinLimits(deep)).toThrow(YamlComplexityError)
+ })
+
+ it('rejects a cyclic structure via the node cap', () => {
+ const node: Record = {}
+ node.self = node
+ expect(() => assertYamlWithinLimits(node)).toThrow(YamlComplexityError)
+ })
+
+ it('charges object keys, not just values', () => {
+ const hugeKey = 'k'.repeat(70 * 1024 * 1024)
+ expect(() => assertYamlWithinLimits({ [hugeKey]: 1 })).toThrow(YamlComplexityError)
+ })
+
+ it('rejects a large plain-text value only when it truly exceeds the size cap', () => {
+ // ~10 MB of plain ASCII serializes ~1:1 and must be accepted (no false positive).
+ expect(() => assertYamlWithinLimits({ text: 'a'.repeat(10 * 1024 * 1024) })).not.toThrow()
+ // ~70 MB exceeds the 64 MB cap and must be rejected.
+ expect(() => assertYamlWithinLimits({ text: 'a'.repeat(70 * 1024 * 1024) })).toThrow(
+ YamlComplexityError
+ )
+ })
+
+ it('charges the true escaped length of escape-heavy strings', () => {
+ // ~11M control chars each serialize to a six-char \uXXXX escape (~66 MB > 64 MB).
+ const escapeHeavy = ''.repeat(11 * 1024 * 1024)
+ expect(() => assertYamlWithinLimits({ text: escapeHeavy })).toThrow(YamlComplexityError)
+ expect(escapeHeavy.length).toBeLessThan(64 * 1024 * 1024)
+ })
+
+ it('charges lone surrogates at their escaped length', () => {
+ // JSON.stringify escapes a lone surrogate to \uXXXX (six units). ~11M of
+ // them estimate to ~66 MB (> 64 MB) though the raw length is under the cap.
+ const loneSurrogates = String.fromCharCode(0xd800).repeat(11 * 1024 * 1024)
+ expect(loneSurrogates.length).toBeLessThan(64 * 1024 * 1024)
+ expect(() => assertYamlWithinLimits({ text: loneSurrogates })).toThrow(YamlComplexityError)
+ // A valid surrogate pair (astral char) is emitted as-is, so ~10M of them
+ // (~20M code units, ~20 MB) stays well under the cap.
+ const astral = String.fromCodePoint(0x1f600).repeat(10 * 1024 * 1024)
+ expect(() => assertYamlWithinLimits({ text: astral })).not.toThrow()
+ })
+})
diff --git a/apps/sim/lib/file-parsers/yaml-parser.ts b/apps/sim/lib/file-parsers/yaml-parser.ts
index 7af7743a296..a0bd297880e 100644
--- a/apps/sim/lib/file-parsers/yaml-parser.ts
+++ b/apps/sim/lib/file-parsers/yaml-parser.ts
@@ -3,74 +3,226 @@ import * as yaml from 'js-yaml'
import type { FileParseResult } from '@/lib/file-parsers/types'
/**
- * Parse YAML files
+ * Hard cap on the number of expanded nodes visited while validating a parsed
+ * YAML document. `yaml.load` resolves aliases into shared references, so the
+ * in-memory value is a compact DAG, but `JSON.stringify` expands that DAG into
+ * a full tree — duplicating every shared node. A tiny "billion laughs" alias
+ * bomb therefore expands to millions/billions of nodes at serialize time. This
+ * cap (and the byte cap below) bound the traversal so the amplification is
+ * detected and rejected before it ever reaches `JSON.stringify`. It also stops
+ * traversal of self-referential (cyclic) YAML anchors.
*/
-export async function parseYAML(filePath: string): Promise {
- const fs = await import('fs/promises')
- const content = await fs.readFile(filePath, 'utf-8')
+const MAX_YAML_EXPANDED_NODES = 5_000_000
- try {
- // Parse YAML to validate and extract structure
- const yamlData = yaml.load(content)
+/**
+ * Cap on the estimated serialized (pretty-printed JSON) size of the document.
+ * Alias expansion inflates output far beyond the input size — a sub-1 KB input
+ * can serialize to hundreds of MB — so we estimate output bytes during the
+ * bounded traversal and abort past this limit rather than allocating them.
+ */
+const MAX_YAML_SERIALIZED_BYTES = 64 * 1024 * 1024
+
+/**
+ * Cap on nesting depth. Guards the depth computation (previously an unbounded
+ * recursion that also spread large arrays into `Math.max(...array)`, risking a
+ * stack overflow) and rejects pathologically deep documents.
+ */
+const MAX_YAML_DEPTH = 500
- // Convert to JSON for consistent processing
- const jsonContent = JSON.stringify(yamlData, null, 2)
+/**
+ * Raised when a parsed YAML document exceeds the complexity limits above.
+ * Distinct from a syntax error so callers can tell a malformed file apart from
+ * a resource-exhaustion (alias-expansion DoS) attempt.
+ */
+export class YamlComplexityError extends Error {
+ constructor(message: string) {
+ super(message)
+ this.name = 'YamlComplexityError'
+ }
+}
- // Extract metadata about the YAML structure
- const metadata = {
- type: 'yaml',
- isArray: Array.isArray(yamlData),
- keys: Array.isArray(yamlData) ? [] : Object.keys(yamlData || {}),
- itemCount: Array.isArray(yamlData) ? yamlData.length : undefined,
- depth: getYamlDepth(yamlData),
- }
+/**
+ * Type guard for {@link YamlComplexityError}. Callers use this to fail closed on
+ * a complexity-limit rejection instead of falling back to a generic parse.
+ */
+export function isYamlComplexityError(error: unknown): error is YamlComplexityError {
+ return error instanceof YamlComplexityError
+}
- return {
- content: jsonContent,
- metadata,
+/**
+ * Exact serialized length (in UTF-16 code units — the unit V8 allocates for the
+ * resulting string) that `JSON.stringify` produces for a string, accounting for
+ * the escape expansion of quotes, backslashes, control characters, and lone
+ * surrogates. Computed precisely rather than with a flat multiplier so plain
+ * text is charged its true size (no false rejection of large legitimate
+ * documents) while escape-heavy strings are charged their real, larger cost
+ * (no cap bypass).
+ */
+function serializedStringLength(value: string): number {
+ let length = 2 // surrounding quotes
+ for (let i = 0; i < value.length; i++) {
+ const code = value.charCodeAt(i)
+ if (code === 0x22 /* " */ || code === 0x5c /* \ */) {
+ length += 2
+ } else if (code < 0x20) {
+ // \b \t \n \f \r use two-char escapes; other control chars use \uXXXX (six)
+ length +=
+ code === 0x08 || code === 0x09 || code === 0x0a || code === 0x0c || code === 0x0d ? 2 : 6
+ } else if (code >= 0xd800 && code <= 0xdfff) {
+ // Well-formed JSON.stringify emits a valid high+low surrogate pair as-is
+ // (two code units) but escapes a lone surrogate to \uXXXX (six).
+ const next = i + 1 < value.length ? value.charCodeAt(i + 1) : 0
+ if (code <= 0xdbff && next >= 0xdc00 && next <= 0xdfff) {
+ length += 2
+ i++
+ } else {
+ length += 6
+ }
+ } else {
+ length += 1
}
- } catch (error) {
- throw new Error(`Invalid YAML: ${getErrorMessage(error, 'Unknown error')}`)
}
+ return length
}
/**
- * Parse YAML from buffer
+ * Estimate the pretty-printed (`JSON.stringify(value, null, 2)`) size a single
+ * value node contributes, including the indentation/newline overhead that
+ * dominates deeply nested alias bombs and the exact escape expansion of strings.
*/
-export async function parseYAMLBuffer(buffer: Buffer): Promise {
- const content = buffer.toString('utf-8')
+function estimateNodeBytes(value: unknown, depth: number): number {
+ const indentOverhead = depth * 2 + 4
+ if (typeof value === 'string') return indentOverhead + serializedStringLength(value)
+ return indentOverhead + 16
+}
- try {
- const yamlData = yaml.load(content)
- const jsonContent = JSON.stringify(yamlData, null, 2)
-
- const metadata = {
- type: 'yaml',
- isArray: Array.isArray(yamlData),
- keys: Array.isArray(yamlData) ? [] : Object.keys(yamlData || {}),
- itemCount: Array.isArray(yamlData) ? yamlData.length : undefined,
- depth: getYamlDepth(yamlData),
+/**
+ * Estimate the serialized size of an object key (`"key": `). Keys are re-emitted
+ * on every alias expansion of their parent object, so an aliased object with a
+ * long key amplifies just like an aliased value — this must be charged or the
+ * size cap is trivially bypassed.
+ */
+function estimateKeyBytes(key: string): number {
+ return serializedStringLength(key) + 2 // ": "
+}
+
+/**
+ * Iteratively walk the parsed YAML value with strict node-count, output-size,
+ * and depth limits, returning the document depth. Repeated (aliased) references
+ * are intentionally counted each time they are reached, mirroring the way
+ * `JSON.stringify` expands them — this is what makes the alias-expansion bomb
+ * detectable before serialization.
+ *
+ * Each node is charged against the caps as it is *enqueued*, before its own
+ * children are pushed, and only container nodes are pushed onto the traversal
+ * stack. A pathologically wide fan-out (e.g. an array of millions of aliases)
+ * therefore trips a cap during the enqueue loop instead of first materializing
+ * millions of stack entries and exhausting memory inside the guard itself.
+ *
+ * @throws {YamlComplexityError} when any limit is exceeded
+ */
+export function assertYamlWithinLimits(root: unknown): number {
+ let visited = 0
+ let estimatedBytes = 0
+ let maxDepth = 0
+
+ const charge = (bytes: number): void => {
+ if (++visited > MAX_YAML_EXPANDED_NODES) {
+ throw new YamlComplexityError(
+ `YAML document exceeds the maximum of ${MAX_YAML_EXPANDED_NODES} expanded nodes (possible alias-expansion bomb)`
+ )
}
+ estimatedBytes += bytes
+ if (estimatedBytes > MAX_YAML_SERIALIZED_BYTES) {
+ throw new YamlComplexityError(
+ `YAML document expands beyond the maximum serialized size of ${MAX_YAML_SERIALIZED_BYTES} bytes (possible alias-expansion bomb)`
+ )
+ }
+ }
+
+ const isContainer = (value: unknown): value is object =>
+ value !== null && typeof value === 'object'
+
+ charge(estimateNodeBytes(root, 0))
+ const stack: Array<{ value: object; depth: number }> = []
+ if (isContainer(root)) stack.push({ value: root, depth: 0 })
+
+ while (stack.length > 0) {
+ const { value, depth } = stack.pop()!
+ const childDepth = depth + 1
- return {
- content: jsonContent,
- metadata,
+ if (childDepth > maxDepth) maxDepth = childDepth
+ if (childDepth > MAX_YAML_DEPTH) {
+ throw new YamlComplexityError(
+ `YAML document exceeds the maximum nesting depth of ${MAX_YAML_DEPTH}`
+ )
}
+
+ if (Array.isArray(value)) {
+ for (const child of value) {
+ charge(estimateNodeBytes(child, childDepth))
+ if (isContainer(child)) stack.push({ value: child, depth: childDepth })
+ }
+ } else {
+ for (const [key, child] of Object.entries(value as Record)) {
+ charge(estimateKeyBytes(key) + estimateNodeBytes(child, childDepth))
+ if (isContainer(child)) stack.push({ value: child, depth: childDepth })
+ }
+ }
+ }
+
+ return maxDepth
+}
+
+/**
+ * Parse a YAML value into the shared `FileParseResult` shape after validating
+ * that its expanded form stays within safe complexity limits.
+ */
+function buildYamlResult(yamlData: unknown): FileParseResult {
+ const depth = assertYamlWithinLimits(yamlData)
+ const jsonContent = JSON.stringify(yamlData, null, 2)
+
+ const metadata = {
+ type: 'yaml',
+ isArray: Array.isArray(yamlData),
+ keys: Array.isArray(yamlData) ? [] : Object.keys((yamlData as Record) || {}),
+ itemCount: Array.isArray(yamlData) ? yamlData.length : undefined,
+ depth,
+ }
+
+ return {
+ content: jsonContent,
+ metadata,
+ }
+}
+
+/**
+ * Parse YAML files
+ */
+export async function parseYAML(filePath: string): Promise {
+ const fs = await import('fs/promises')
+ const content = await fs.readFile(filePath, 'utf-8')
+
+ try {
+ const yamlData = yaml.load(content)
+ return buildYamlResult(yamlData)
} catch (error) {
+ if (error instanceof YamlComplexityError) throw error
throw new Error(`Invalid YAML: ${getErrorMessage(error, 'Unknown error')}`)
}
}
/**
- * Calculate the depth of a YAML/JSON object
+ * Parse YAML from buffer
*/
-function getYamlDepth(obj: any): number {
- if (obj === null || typeof obj !== 'object') return 0
+export async function parseYAMLBuffer(buffer: Buffer): Promise {
+ const content = buffer.toString('utf-8')
- if (Array.isArray(obj)) {
- return obj.length > 0 ? 1 + Math.max(...obj.map(getYamlDepth)) : 1
+ try {
+ const yamlData = yaml.load(content)
+ return buildYamlResult(yamlData)
+ } catch (error) {
+ if (error instanceof YamlComplexityError) throw error
+ throw new Error(`Invalid YAML: ${getErrorMessage(error, 'Unknown error')}`)
}
-
- const depths = Object.values(obj).map(getYamlDepth)
- return depths.length > 0 ? 1 + Math.max(...depths) : 1
}
diff --git a/apps/sim/lib/file-parsers/zip-guard.ts b/apps/sim/lib/file-parsers/zip-guard.ts
index 99aca4f7542..07642b3740c 100644
--- a/apps/sim/lib/file-parsers/zip-guard.ts
+++ b/apps/sim/lib/file-parsers/zip-guard.ts
@@ -66,7 +66,7 @@ export class ZipBombError extends Error {
* closed: a ZIP-shaped buffer the guard cannot parse must be rejected rather
* than handed to a decompression library.
*/
-function isZipShaped(buffer: Buffer): boolean {
+export function isZipShaped(buffer: Buffer): boolean {
if (buffer.length < 4) {
return false
}
@@ -217,6 +217,64 @@ function sumDeclaredUncompressedSize(buffer: Buffer, abortAboveBytes: number): n
return total
}
+/** Parse-time shape of a ZIP central directory, read without decompressing anything. */
+export interface ZipCentralDirectoryStats {
+ /** Records in the contiguous central-directory run — what a per-signature parser allocates. */
+ entryCount: number
+ /** Summed declared extra-field bytes across those records. */
+ totalExtraFieldBytes: number
+}
+
+/**
+ * Walk the real central directory (EOCD-anchored, decoy-resistant, ZIP64-aware —
+ * the same anchoring as {@link assertOoxmlArchiveWithinLimits}) and report its
+ * record count and summed extra-field bytes, so callers can bound a parser's
+ * object graph before handing it the buffer. The walk covers the CONTIGUOUS run
+ * of records at the central-directory offset rather than trusting the EOCD's
+ * declared count, because that run is what JSZip actually allocates one entry
+ * per — a lied count can neither hide records nor inflate the tally. Unlike a
+ * raw whole-buffer signature scan, STORED entry payloads (e.g. a nested `.zip`
+ * archived without recompression) are never miscounted as records. Returns
+ * `null` when the buffer is not a parseable ZIP, so callers can fail closed.
+ */
+export function readZipCentralDirectoryStats(buffer: Buffer): ZipCentralDirectoryStats | null {
+ if (buffer.length < EOCD_MIN_SIZE) {
+ return null
+ }
+
+ const eocdOffset = findEocdOffset(buffer)
+ if (eocdOffset < 0) {
+ return null
+ }
+
+ const location = locateCentralDirectory(buffer, eocdOffset)
+ if (!location) {
+ return null
+ }
+
+ let entryCount = 0
+ let totalExtraFieldBytes = 0
+ let cursor = location.offset
+ while (
+ cursor + CENTRAL_DIRECTORY_HEADER_MIN_SIZE <= buffer.length &&
+ buffer.readUInt32LE(cursor) === CENTRAL_DIRECTORY_HEADER_SIGNATURE
+ ) {
+ const fileNameLength = buffer.readUInt16LE(cursor + 28)
+ const extraFieldLength = buffer.readUInt16LE(cursor + 30)
+ const commentLength = buffer.readUInt16LE(cursor + 32)
+
+ entryCount += 1
+ totalExtraFieldBytes += extraFieldLength
+ cursor += CENTRAL_DIRECTORY_HEADER_MIN_SIZE + fileNameLength + extraFieldLength + commentLength
+ }
+
+ if (entryCount < location.entryCount) {
+ return null
+ }
+
+ return { entryCount, totalExtraFieldBytes }
+}
+
/**
* Reject an OOXML archive whose declared expanded size or compression ratio
* exceeds safe bounds, before any decompression library materializes it.
diff --git a/apps/sim/lib/managed-agents/run-session.test.ts b/apps/sim/lib/managed-agents/run-session.test.ts
new file mode 100644
index 00000000000..52a5c66ba2b
--- /dev/null
+++ b/apps/sim/lib/managed-agents/run-session.test.ts
@@ -0,0 +1,390 @@
+/**
+ * @vitest-environment node
+ */
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { AnthropicSessionEvent } from '@/lib/managed-agents/session-client'
+
+const { mocks } = vi.hoisted(() => ({
+ mocks: {
+ createSession: vi.fn(),
+ sendUserMessage: vi.fn(),
+ sendSessionEvents: vi.fn(),
+ openSessionStream: vi.fn(),
+ listSessionEvents: vi.fn(),
+ getSession: vi.fn(),
+ getEnvironmentType: vi.fn(),
+ interruptSession: vi.fn(),
+ readSSEEvents: vi.fn(),
+ sleep: vi.fn(),
+ },
+}))
+
+vi.mock('@/lib/managed-agents/session-client', () => ({
+ createSession: mocks.createSession,
+ sendUserMessage: mocks.sendUserMessage,
+ sendSessionEvents: mocks.sendSessionEvents,
+ openSessionStream: mocks.openSessionStream,
+ listSessionEvents: mocks.listSessionEvents,
+ getSession: mocks.getSession,
+ getEnvironmentType: mocks.getEnvironmentType,
+ interruptSession: mocks.interruptSession,
+}))
+vi.mock('@/lib/core/utils/sse', () => ({ readSSEEvents: mocks.readSSEEvents }))
+vi.mock('@sim/utils/helpers', () => ({ sleep: mocks.sleep }))
+
+import { runManagedAgentSession } from '@/lib/managed-agents/run-session'
+
+/** Drives `readSSEEvents`: each call replays the next scripted batch of events. */
+function scriptStreamBatches(batches: AnthropicSessionEvent[][]): void {
+ let call = 0
+ mocks.readSSEEvents.mockImplementation(
+ async (_resp: unknown, opts: { onEvent: (e: AnthropicSessionEvent) => Promise }) => {
+ const batch = batches[call++] ?? []
+ for (const event of batch) {
+ const stop = await opts.onEvent(event)
+ if (stop === true) return
+ }
+ }
+ )
+}
+
+const BASE = {
+ apiKey: 'sk-ant-fake',
+ agentId: 'agent_1',
+ environmentId: 'env_1',
+ userMessage: 'do a thing',
+} as const
+
+const msg = (id: string, text: string): AnthropicSessionEvent => ({
+ id,
+ type: 'agent.message',
+ content: [{ type: 'text', text }],
+})
+const idle = (id: string, stop: string): AnthropicSessionEvent => ({
+ id,
+ type: 'session.status_idle',
+ stop_reason: { type: stop },
+})
+
+beforeEach(() => {
+ vi.clearAllMocks()
+ mocks.createSession.mockResolvedValue({ id: 'sess_1' })
+ mocks.sendUserMessage.mockResolvedValue(undefined)
+ mocks.sendSessionEvents.mockResolvedValue(undefined)
+ mocks.openSessionStream.mockResolvedValue({})
+ mocks.listSessionEvents.mockResolvedValue([])
+ mocks.getSession.mockResolvedValue(null)
+ mocks.getEnvironmentType.mockResolvedValue('cloud')
+ mocks.interruptSession.mockResolvedValue(undefined)
+})
+
+const customToolUse = (id: string, name: string): AnthropicSessionEvent => ({
+ id,
+ type: 'agent.custom_tool_use',
+ name,
+})
+
+describe('runManagedAgentSession', () => {
+ it('accumulates agent.message text and completes on end_turn (terminal event)', async () => {
+ scriptStreamBatches([[msg('e1', 'Hello '), msg('e2', 'world'), idle('e3', 'end_turn')]])
+ mocks.getSession.mockResolvedValue({
+ status: 'idle',
+ usage: { inputTokens: 12, outputTokens: 3 },
+ })
+
+ const result = await runManagedAgentSession({ ...BASE })
+
+ expect(result).toEqual({
+ ok: true,
+ content: 'Hello world',
+ sessionId: 'sess_1',
+ inputTokens: 12,
+ outputTokens: 3,
+ })
+ expect(mocks.listSessionEvents).not.toHaveBeenCalled()
+ })
+
+ it('completes via authoritative status when the stream goes quiet after progress', async () => {
+ // Stream: some text, no terminal, then closes. Reconnect: nothing new.
+ scriptStreamBatches([[msg('e1', 'partial')], []])
+ // First getSession (quiet-reconnect check) → idle; final getSession → usage.
+ mocks.getSession
+ .mockResolvedValueOnce({ status: 'idle' })
+ .mockResolvedValue({ status: 'idle', usage: { inputTokens: 5 } })
+
+ const result = await runManagedAgentSession({ ...BASE })
+
+ expect(result.ok).toBe(true)
+ expect(result.content).toBe('partial')
+ expect(result.inputTokens).toBe(5)
+ })
+
+ it('keeps waiting while status is running, then completes on a later terminal event', async () => {
+ // Stream 1: text, closes (no terminal). Reconnect: nothing new, status running → backoff.
+ // Stream 2: end_turn → complete.
+ scriptStreamBatches([[msg('e1', 'thinking')], [idle('e2', 'end_turn')]])
+ mocks.getSession
+ .mockResolvedValueOnce({ status: 'running' })
+ .mockResolvedValue({ status: 'idle' })
+
+ const result = await runManagedAgentSession({ ...BASE })
+
+ expect(result.ok).toBe(true)
+ expect(result.content).toBe('thinking')
+ expect(mocks.sleep).toHaveBeenCalled() // backed off while running
+ })
+
+ it('does not complete on idle status while a requires_action is outstanding', async () => {
+ // Stream 1: text then a requires_action idle (pending), then closes.
+ // Reconnect: nothing new, status idle — but must NOT complete (pending).
+ // Stream 2: end_turn → complete.
+ scriptStreamBatches([
+ [msg('e1', 'partial'), idle('r1', 'requires_action')],
+ [idle('e2', 'end_turn')],
+ ])
+ mocks.getSession.mockResolvedValue({ status: 'idle' })
+
+ const result = await runManagedAgentSession({ ...BASE })
+
+ expect(result.ok).toBe(true)
+ expect(result.content).toBe('partial')
+ expect(mocks.openSessionStream).toHaveBeenCalledTimes(2) // reopened rather than completing early
+ })
+
+ it('does not complete on a fresh idle before the agent has started', async () => {
+ // Stream closes immediately with nothing; catch-up empty; status idle but no
+ // activity yet → must NOT complete. Then it starts and finishes.
+ scriptStreamBatches([[], [idle('e1', 'end_turn')]])
+ mocks.getSession
+ .mockResolvedValueOnce({ status: 'idle' }) // pre-start idle — must be ignored
+ .mockResolvedValue({ status: 'idle' })
+
+ const result = await runManagedAgentSession({ ...BASE })
+
+ expect(result.ok).toBe(true)
+ // Completed via the real end_turn on reopen, not the premature idle.
+ expect(mocks.openSessionStream).toHaveBeenCalledTimes(2)
+ })
+
+ it('surfaces a session.error as a failure with the error message', async () => {
+ scriptStreamBatches([[{ id: 'x1', type: 'session.error', error: { message: 'boom' } }]])
+
+ const result = await runManagedAgentSession({ ...BASE })
+
+ expect(result.ok).toBe(false)
+ expect(result.error).toBe('boom')
+ expect(result.sessionId).toBe('sess_1')
+ })
+
+ it('keeps requires_action pending when catch-up recovers an older message (ordering)', async () => {
+ // Live stream sees a message then a requires_action pause. Catch-up then
+ // recovers an EARLIER, unseen agent.message — processing it would clear the
+ // pending flag, but the history's latest lifecycle event is still
+ // requires_action, so the session must NOT be reported complete.
+ scriptStreamBatches([
+ [msg('e1', 'hi '), idle('r1', 'requires_action')],
+ [idle('e2', 'end_turn')],
+ ])
+ mocks.listSessionEvents.mockResolvedValueOnce([
+ msg('e0', 'earlier'), // unseen, older than r1
+ idle('r1', 'requires_action'), // latest lifecycle event in history
+ ])
+ mocks.getSession.mockResolvedValue({ status: 'idle' })
+
+ const result = await runManagedAgentSession({ ...BASE })
+
+ expect(result.ok).toBe(true)
+ // Reopened rather than completing early on the idle snapshot.
+ expect(mocks.openSessionStream).toHaveBeenCalledTimes(2)
+ })
+
+ it('preserves live requires_action when catch-up has an older message but no lifecycle event', async () => {
+ // Live stream sees a message + requires_action pause. Catch-up recovers an
+ // older, unseen agent.message but NO lifecycle event — processing it clears
+ // the pending flag, and with no lifecycle evidence in history the live
+ // pending state must be restored (not completed on the idle snapshot).
+ scriptStreamBatches([
+ [msg('e1', 'hi '), idle('r1', 'requires_action')],
+ [idle('e2', 'end_turn')],
+ ])
+ mocks.listSessionEvents.mockResolvedValueOnce([msg('e0', 'earlier')]) // no lifecycle event
+ mocks.getSession.mockResolvedValue({ status: 'idle' })
+
+ const result = await runManagedAgentSession({ ...BASE })
+
+ expect(result.ok).toBe(true)
+ expect(mocks.openSessionStream).toHaveBeenCalledTimes(2) // did not complete on the idle snapshot
+ })
+
+ it('completes on an idless terminal event delivered only on the live stream', async () => {
+ // An idless session.status_idle(end_turn) must still register as terminal —
+ // idless events are processed (only text accumulation is id-gated).
+ scriptStreamBatches([[{ type: 'session.status_idle', stop_reason: { type: 'end_turn' } }]])
+ mocks.getSession.mockResolvedValue({ status: 'idle' })
+
+ const result = await runManagedAgentSession({ ...BASE })
+
+ expect(result.ok).toBe(true)
+ expect(mocks.openSessionStream).toHaveBeenCalledTimes(1) // completed, not dropped
+ })
+
+ it('does not double-count text from an idless preview of a persisted message', async () => {
+ scriptStreamBatches([
+ [
+ { type: 'agent.message', content: [{ type: 'text', text: 'hi' }] }, // idless preview
+ msg('e1', 'hi'), // persisted copy of the same text
+ idle('e2', 'end_turn'),
+ ],
+ ])
+ mocks.getSession.mockResolvedValue({ status: 'idle' })
+
+ const result = await runManagedAgentSession({ ...BASE })
+
+ expect(result.content).toBe('hi') // not 'hihi'
+ })
+
+ it('retries a custom-tool reply that failed to send instead of stranding the session', async () => {
+ // Stream 1: a custom tool call whose error reply fails to send — the event
+ // must stay unseen. Reconnect (status running) → reopen. Stream 2: the same
+ // tool call is retried (reply succeeds), then end_turn completes.
+ scriptStreamBatches([
+ [customToolUse('t1', 'foo')],
+ [customToolUse('t1', 'foo'), idle('e2', 'end_turn')],
+ ])
+ mocks.sendSessionEvents.mockRejectedValueOnce(new Error('network')).mockResolvedValue(undefined)
+ mocks.getSession
+ .mockResolvedValueOnce({ status: 'running' })
+ .mockResolvedValue({ status: 'idle' })
+
+ const result = await runManagedAgentSession({ ...BASE })
+
+ expect(result.ok).toBe(true)
+ // Reply attempted twice: the failed send was retried on reconnect.
+ expect(mocks.sendSessionEvents).toHaveBeenCalledTimes(2)
+ })
+
+ it('keeps requires_action pending when lagging history holds only an older lifecycle event', async () => {
+ // Live sees requires_action@:02 (newest). Catch-up history LAGS — it holds
+ // only an older, unseen running@:00. By timestamp that older event must not
+ // clear the newer pause, so the idle snapshot must not complete the run.
+ const runningAt = (id: string, at: string): AnthropicSessionEvent => ({
+ id,
+ type: 'session.status_running',
+ processed_at: at,
+ })
+ const idleAt = (id: string, stop: string, at: string): AnthropicSessionEvent => ({
+ id,
+ type: 'session.status_idle',
+ stop_reason: { type: stop },
+ processed_at: at,
+ })
+ scriptStreamBatches([
+ [msg('e1', 'hi'), idleAt('ra1', 'requires_action', '2026-01-01T00:00:02Z')],
+ [idleAt('e2', 'end_turn', '2026-01-01T00:00:05Z')],
+ ])
+ mocks.listSessionEvents.mockResolvedValueOnce([runningAt('run0', '2026-01-01T00:00:00Z')])
+ mocks.getSession.mockResolvedValue({ status: 'idle' })
+
+ const result = await runManagedAgentSession({ ...BASE })
+
+ expect(result.ok).toBe(true)
+ expect(mocks.openSessionStream).toHaveBeenCalledTimes(2) // older running did not clear the newer pause
+ })
+
+ it('an untimestamped running event does not clear a timestamped requires_action', async () => {
+ // A stray lifecycle event without processed_at must not outrank (clear) a
+ // timestamped requires_action pause, nor poison later timestamped events.
+ const idleAt = (id: string, stop: string, at: string): AnthropicSessionEvent => ({
+ id,
+ type: 'session.status_idle',
+ stop_reason: { type: stop },
+ processed_at: at,
+ })
+ scriptStreamBatches([
+ [
+ msg('e1', 'hi'),
+ idleAt('ra1', 'requires_action', '2026-01-01T00:00:02Z'),
+ { id: 'runX', type: 'session.status_running' }, // no processed_at
+ ],
+ [idleAt('e2', 'end_turn', '2026-01-01T00:00:05Z')],
+ ])
+ mocks.getSession.mockResolvedValue({ status: 'idle' })
+
+ const result = await runManagedAgentSession({ ...BASE })
+
+ expect(result.ok).toBe(true)
+ expect(mocks.openSessionStream).toHaveBeenCalledTimes(2) // stray running did not clear the pause
+ })
+
+ it('does not complete on a session_idle event that carries no stop_reason', async () => {
+ // An idle event with no stop_reason (e.g. pre-first-turn) must NOT be
+ // treated as complete via the event path — defer to the status gate, which
+ // honors sawActivity. Then a real end_turn on reopen completes it.
+ scriptStreamBatches([
+ [{ id: 'i1', type: 'session.status_idle' }],
+ [msg('e2', 'done'), idle('e3', 'end_turn')],
+ ])
+ mocks.getSession.mockResolvedValue({ status: 'idle' })
+
+ const result = await runManagedAgentSession({ ...BASE })
+
+ expect(result.ok).toBe(true)
+ expect(result.content).toBe('done')
+ expect(mocks.openSessionStream).toHaveBeenCalledTimes(2) // reopened, not completed on i1
+ })
+
+ it('backs off (does not hot-loop) when catch-up only surfaces a failing tool reply', async () => {
+ // Stream closes empty; catch-up surfaces an unseen custom-tool call whose
+ // reply fails to send — it stays unseen (retry), so it must NOT count as
+ // progress and reset the backoff. Session still running → we must sleep.
+ scriptStreamBatches([[], [idle('e2', 'end_turn')]])
+ mocks.listSessionEvents
+ .mockResolvedValueOnce([customToolUse('t1', 'foo')])
+ .mockResolvedValue([])
+ mocks.sendSessionEvents.mockRejectedValue(new Error('network'))
+ mocks.getSession
+ .mockResolvedValueOnce({ status: 'running' })
+ .mockResolvedValue({ status: 'idle' })
+
+ const result = await runManagedAgentSession({ ...BASE })
+
+ expect(result.ok).toBe(true)
+ expect(mocks.sleep).toHaveBeenCalled() // backed off instead of resetting on the retry event
+ })
+
+ it('interrupts the session when a mid-run stream failure ends the loop', async () => {
+ mocks.openSessionStream.mockRejectedValue(new Error('stream 502'))
+
+ const result = await runManagedAgentSession({ ...BASE })
+
+ expect(result.ok).toBe(false)
+ expect(mocks.interruptSession).toHaveBeenCalledWith({
+ apiKey: BASE.apiKey,
+ sessionId: 'sess_1',
+ })
+ })
+
+ it('interrupts the session and reports aborted when the workflow is cancelled', async () => {
+ const controller = new AbortController()
+ // Cancel right after the session is created, before the stream loop runs.
+ mocks.sendUserMessage.mockImplementation(async () => {
+ controller.abort()
+ })
+ scriptStreamBatches([[]])
+
+ const result = await runManagedAgentSession({ ...BASE, signal: controller.signal })
+
+ expect(result.ok).toBe(false)
+ expect(result.error).toBe('aborted')
+ expect(mocks.interruptSession).toHaveBeenCalledWith({
+ apiKey: BASE.apiKey,
+ sessionId: 'sess_1',
+ })
+ })
+
+ it('rejects an empty user message before creating a session', async () => {
+ const result = await runManagedAgentSession({ ...BASE, userMessage: ' ' })
+ expect(result.ok).toBe(false)
+ expect(mocks.createSession).not.toHaveBeenCalled()
+ })
+})
diff --git a/apps/sim/lib/managed-agents/run-session.ts b/apps/sim/lib/managed-agents/run-session.ts
new file mode 100644
index 00000000000..0fe2ea472dc
--- /dev/null
+++ b/apps/sim/lib/managed-agents/run-session.ts
@@ -0,0 +1,434 @@
+import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
+import { sleep } from '@sim/utils/helpers'
+import { readSSEEvents } from '@/lib/core/utils/sse'
+import {
+ type AnthropicSessionEvent,
+ type CreateSessionInput,
+ createSession,
+ type EnvironmentType,
+ getEnvironmentType,
+ getSession,
+ interruptSession,
+ listSessionEvents,
+ openSessionStream,
+ sendSessionEvents,
+ sendUserMessage,
+} from '@/lib/managed-agents/session-client'
+
+/**
+ * Runs a Claude Platform Managed Agent session end-to-end and returns the
+ * accumulated assistant text. This is the one genuinely-custom piece of the
+ * integration: the Managed Agents lifecycle is create → send → stream →
+ * catch-up → reconnect, which the single-request tool framework can't model.
+ *
+ * Completion is driven only by real terminal signals — a `session.status_idle`
+ * (`end_turn`) event, or the authoritative session `status` when the event
+ * stream is quiet — never by a heuristic timer. Pure with respect to Sim (no
+ * `@sim/db`, no executor types); the caller supplies the decrypted API key.
+ */
+
+const logger = createLogger('ManagedAgentRunSession')
+
+/** Upper bound on stream-close → catch-up → reopen cycles per invocation. */
+const MAX_RECONNECT_ITERATIONS = 120
+/** Wall-clock backstop for the reconnect loop (not the live-stream duration). */
+const MAX_SESSION_MS = 15 * 60 * 1000
+const RECONNECT_BACKOFF_START_MS = 500
+const RECONNECT_BACKOFF_MAX_MS = 5000
+
+export interface RunManagedAgentInput {
+ apiKey: string
+ agentId: string
+ environmentId: string
+ /** Env-type hint from the block; used only if server-side resolution fails. */
+ environmentType?: EnvironmentType
+ userMessage: string
+ title?: string
+ vaultIds?: string[]
+ memoryStoreId?: string
+ memoryAccess?: 'read_write' | 'read_only'
+ memoryInstructions?: string
+ files?: Array<{ fileId: string; mountPath?: string }>
+ sessionParameters?: Record
+ signal?: AbortSignal
+}
+
+export interface RunManagedAgentResult {
+ ok: boolean
+ content: string
+ sessionId?: string
+ error?: string
+ inputTokens?: number
+ outputTokens?: number
+}
+
+type Terminal = { status: 'complete' | 'error'; reason?: string }
+/** Result of handling one event: an optional terminal signal, plus whether the event must be retried. */
+type HandleResult = { terminal?: Terminal; retry?: boolean }
+
+/** True for session lifecycle events (`session.status_*` / `session.error`). */
+function isLifecycleEvent(type: string | undefined): boolean {
+ return !!type && (type.startsWith('session.status_') || type === 'session.error')
+}
+
+/**
+ * Epoch millis for an event's `processed_at`. A missing/unparseable value
+ * counts as OLDEST (`-Infinity`) so an untimestamped lifecycle event can never
+ * outrank a timestamped one in either direction — a stray untimestamped event
+ * neither poisons the high-water mark (blocking later real events) nor clears a
+ * timestamped pause. Persisted lifecycle events always carry `processed_at`;
+ * this is purely defensive.
+ */
+function eventTime(value: string | null | undefined): number {
+ if (!value) return Number.NEGATIVE_INFINITY
+ const parsed = Date.parse(value)
+ return Number.isNaN(parsed) ? Number.NEGATIVE_INFINITY : parsed
+}
+
+/** Best-effort `user.interrupt` for a session Sim is abandoning (cancel / cap). Never throws. */
+async function interruptQuietly(apiKey: string, sessionId: string): Promise {
+ try {
+ await interruptSession({ apiKey, sessionId })
+ } catch (err) {
+ logger.warn('Failed to interrupt managed agent session on cancel', {
+ sessionId,
+ error: getErrorMessage(err),
+ })
+ }
+}
+
+export async function runManagedAgentSession(
+ input: RunManagedAgentInput
+): Promise {
+ const { apiKey, signal } = input
+ if (signal?.aborted) return { ok: false, content: '', error: 'aborted' }
+
+ const userMessage = input.userMessage.trim()
+ if (!userMessage) return { ok: false, content: '', error: 'User message is required.' }
+
+ // Resolve the environment type up front so the payload routes correctly:
+ // self-hosted environments reject `resources`, so memory must go via metadata
+ // there. The authoritative source is the API; the block's hint is only a
+ // fallback if that lookup fails.
+ const environmentType =
+ (await getEnvironmentType({ apiKey, environmentId: input.environmentId, signal })) ??
+ input.environmentType
+
+ const createInput: CreateSessionInput = {
+ apiKey,
+ agentId: input.agentId,
+ environmentId: input.environmentId,
+ ...(environmentType ? { environmentType } : {}),
+ ...(input.title ? { title: input.title } : {}),
+ ...(input.vaultIds && input.vaultIds.length > 0 ? { vaultIds: input.vaultIds } : {}),
+ ...(input.memoryStoreId ? { memoryStoreId: input.memoryStoreId } : {}),
+ ...(input.memoryStoreId && input.memoryAccess ? { memoryAccess: input.memoryAccess } : {}),
+ ...(input.memoryStoreId && input.memoryInstructions
+ ? { memoryInstructions: input.memoryInstructions }
+ : {}),
+ ...(input.files && input.files.length > 0 ? { files: input.files } : {}),
+ ...(input.sessionParameters && Object.keys(input.sessionParameters).length > 0
+ ? { sessionParameters: input.sessionParameters }
+ : {}),
+ ...(signal ? { signal } : {}),
+ }
+
+ let sessionId: string
+ try {
+ const session = await createSession(createInput)
+ sessionId = session.id
+ } catch (error) {
+ return {
+ ok: false,
+ content: '',
+ error: getErrorMessage(error, 'Failed to create Managed Agent session'),
+ }
+ }
+
+ logger.info('Created managed agent session', {
+ sessionId,
+ agentId: input.agentId,
+ environmentId: input.environmentId,
+ })
+
+ try {
+ await sendUserMessage({ apiKey, sessionId, text: userMessage, signal })
+ } catch (error) {
+ // The session exists but we could not drive it. The message may still have
+ // reached the sandbox (abort/error can race the delivered request), so stop
+ // the session rather than leave it possibly running against the key.
+ await interruptQuietly(apiKey, sessionId)
+ return {
+ ok: false,
+ content: '',
+ sessionId,
+ error: signal?.aborted ? 'aborted' : getErrorMessage(error, 'Failed to send user message'),
+ }
+ }
+
+ const assistantText = { value: '' }
+ const seenIds = new Set()
+ const startedAt = Date.now()
+ let backoffMs = RECONNECT_BACKOFF_START_MS
+ let sawActivity = false
+ // A `requires_action` idle means the session is paused waiting on a tool
+ // result, not finished. We derive it from the NEWEST lifecycle event by
+ // `processed_at` (tracked across the live stream and catch-up), so a lagging
+ // or out-of-order history can never clear a newer pause and let an idle
+ // snapshot report an in-progress session complete.
+ let latestLifecycleAt = Number.NEGATIVE_INFINITY
+ let requiresActionOutstanding = false
+ let terminal: Terminal | null = null
+
+ const process = async (event: AnthropicSessionEvent): Promise => {
+ if (
+ event.type === 'agent.message' ||
+ event.type === 'agent.custom_tool_use' ||
+ event.type === 'session.status_running'
+ ) {
+ sawActivity = true
+ }
+ if (isLifecycleEvent(event.type)) {
+ const at = eventTime(event.processed_at)
+ if (at >= latestLifecycleAt) {
+ latestLifecycleAt = at
+ requiresActionOutstanding =
+ event.type === 'session.status_idle' && event.stop_reason?.type === 'requires_action'
+ }
+ }
+ const outcome = await handleEvent({ event, assistantText, apiKey, sessionId, signal })
+ // Mark the event seen only once fully handled. A custom-tool reply that
+ // failed to send stays unseen so the next catch-up retries it instead of
+ // stranding the session on an unanswered requires_action pause.
+ if (event.id && !outcome.retry) seenIds.add(event.id)
+ if (outcome.terminal) {
+ terminal = outcome.terminal
+ return true
+ }
+ return false
+ }
+
+ try {
+ for (let iteration = 0; iteration < MAX_RECONNECT_ITERATIONS && !terminal; iteration++) {
+ if (signal?.aborted) break
+ if (Date.now() - startedAt > MAX_SESSION_MS) {
+ // Giving up on a session that may still be running — stop it so it
+ // does not keep consuming the workspace key past our cap.
+ await interruptQuietly(apiKey, sessionId)
+ terminal = {
+ status: 'error',
+ reason: `Session did not reach a terminal state within ${Math.floor(MAX_SESSION_MS / 1000)}s.`,
+ }
+ break
+ }
+
+ const streamResp = await openSessionStream({ apiKey, sessionId, signal })
+ await readSSEEvents(streamResp, {
+ signal,
+ onParseError: (raw, err) => {
+ logger.warn('Un-parseable SSE line', {
+ sessionId,
+ preview: raw.slice(0, 200),
+ error: getErrorMessage(err),
+ })
+ },
+ onEvent: async (event) => {
+ if (event.id && seenIds.has(event.id)) return undefined
+ return (await process(event)) ? true : undefined
+ },
+ })
+ if (terminal || signal?.aborted) break
+
+ // Stream closed without a terminal event. Reconcile the full event
+ // history — the terminal event or final text may have landed during the
+ // gap. Events are deduped by id; entries without an id are skipped here
+ // (they are non-persisted stream previews, never history).
+ const history = await listSessionEvents({ apiKey, sessionId, signal })
+ let progressed = false
+ for (const event of history) {
+ if (!event.id || seenIds.has(event.id)) continue
+ const isTerminal = await process(event)
+ // Count as progress only when the event was actually consumed (marked
+ // seen). A custom-tool reply that failed stays unseen for retry — it
+ // must NOT reset the backoff, or a persistently-failing reply would
+ // spin the reconnect loop with no delay.
+ if (seenIds.has(event.id)) progressed = true
+ if (isTerminal) break
+ }
+ if (terminal || signal?.aborted) break
+
+ // Still no terminal event. Consult the authoritative session status: a
+ // finished session reports `idle`/`terminated`; a working one reports
+ // `running`. `idle` counts as complete only once the agent has actually
+ // started (a freshly-created session is `idle` before its first turn).
+ const snapshot = await getSession({ apiKey, sessionId, signal })
+ if (snapshot?.status === 'terminated') {
+ terminal = { status: 'error', reason: 'Session terminated.' }
+ break
+ }
+ if (snapshot?.status === 'idle' && sawActivity && !requiresActionOutstanding) {
+ terminal = { status: 'complete' }
+ break
+ }
+
+ // Working (or not yet started) — back off and reopen, resetting the
+ // backoff whenever catch-up surfaced new events.
+ if (progressed) {
+ backoffMs = RECONNECT_BACKOFF_START_MS
+ } else {
+ await sleep(backoffMs)
+ backoffMs = Math.min(backoffMs * 2, RECONNECT_BACKOFF_MAX_MS)
+ }
+ }
+ } catch (error) {
+ // Any exit from the loop with the session possibly still running must stop
+ // it — a mid-run stream/API failure is no different from an abort or cap.
+ await interruptQuietly(apiKey, sessionId)
+ if (signal?.aborted) {
+ return { ok: false, content: assistantText.value, sessionId, error: 'aborted' }
+ }
+ logger.error('Managed agent stream failed', { sessionId, error: getErrorMessage(error) })
+ return {
+ ok: false,
+ content: assistantText.value,
+ sessionId,
+ error: getErrorMessage(error, 'Managed Agent session failed'),
+ }
+ }
+
+ if (signal?.aborted) {
+ await interruptQuietly(apiKey, sessionId)
+ return { ok: false, content: assistantText.value, sessionId, error: 'aborted' }
+ }
+ if (!terminal) {
+ // Reconnect cap reached while the session may still be running — stop it so
+ // it does not keep consuming the workspace key after we give up.
+ await interruptQuietly(apiKey, sessionId)
+ return {
+ ok: false,
+ content: assistantText.value,
+ sessionId,
+ error: 'Reconnect iteration cap reached without a terminal state.',
+ }
+ }
+ if (terminal.status === 'error') {
+ return {
+ ok: false,
+ content: assistantText.value,
+ sessionId,
+ error: terminal.reason ?? 'Managed Agent session failed.',
+ }
+ }
+
+ // Best-effort cumulative token usage for the block output.
+ const snapshot = await getSession({ apiKey, sessionId, signal })
+ return {
+ ok: true,
+ content: assistantText.value,
+ sessionId,
+ ...(snapshot?.usage?.inputTokens !== undefined
+ ? { inputTokens: snapshot.usage.inputTokens }
+ : {}),
+ ...(snapshot?.usage?.outputTokens !== undefined
+ ? { outputTokens: snapshot.usage.outputTokens }
+ : {}),
+ }
+}
+
+async function handleEvent(args: {
+ event: AnthropicSessionEvent
+ assistantText: { value: string }
+ apiKey: string
+ sessionId: string
+ signal?: AbortSignal
+}): Promise {
+ const { event, assistantText, apiKey, sessionId, signal } = args
+
+ if (event.type === 'agent.message') {
+ // Accumulate text only from persisted (id-bearing) messages. An idless
+ // `agent.message` is a stream-only preview that is never deduped, so
+ // appending it would double the text once the persisted copy arrives.
+ // Idless lifecycle/terminal events still flow through the handlers below.
+ if (event.id && Array.isArray(event.content)) {
+ for (const block of event.content) {
+ if (block?.type === 'text' && typeof block.text === 'string') {
+ assistantText.value += block.text
+ }
+ }
+ }
+ return {}
+ }
+
+ if (event.type === 'agent.custom_tool_use') {
+ // Without an id we cannot correlate a reply; sending an empty id would
+ // strand the session, so log and let it resolve on its own instead.
+ if (!event.id) {
+ logger.warn('Managed Agent custom_tool_use arrived without an id — skipping reply', {
+ sessionId,
+ })
+ return {}
+ }
+ logger.warn(
+ `Managed Agent invoked a custom tool "${event.name ?? ''}" that Sim does not provide — replying with error`
+ )
+ try {
+ await sendSessionEvents({
+ apiKey,
+ signal,
+ sessionId,
+ events: [
+ {
+ type: 'user.custom_tool_result',
+ custom_tool_use_id: event.id,
+ content: [
+ {
+ type: 'text',
+ text: 'This Managed Agent is being invoked from a Sim workflow block. Sim does not provide custom tools here — configure the agent to use only tools available in its Claude Platform workspace.',
+ },
+ ],
+ is_error: true,
+ },
+ ],
+ })
+ } catch (err) {
+ logger.error('Failed to send custom_tool_result error reply', {
+ sessionId,
+ error: getErrorMessage(err),
+ })
+ // Leave the event unseen so the next catch-up retries the reply rather
+ // than stranding the session on this unanswered tool call.
+ return { retry: true }
+ }
+ return {}
+ }
+
+ if (event.type === 'session.status_terminated') {
+ return { terminal: { status: 'error', reason: event.error?.message ?? 'session_terminated' } }
+ }
+
+ if (event.type === 'session.status_idle') {
+ const stop = event.stop_reason?.type
+ if (stop === 'end_turn') return { terminal: { status: 'complete' } }
+ if (stop === 'retries_exhausted') {
+ return { terminal: { status: 'error', reason: 'retries_exhausted' } }
+ }
+ // `requires_action` (paused for a pending tool call) and any unspecified
+ // idle are NOT terminal here. A freshly-created session is `idle` with no
+ // stop reason before its first turn, so completing on an unspecified idle
+ // would report empty content; instead defer to the authoritative-status
+ // gate, which only completes once `sawActivity` is set.
+ return {}
+ }
+
+ if (event.type === 'session.error') {
+ return {
+ terminal: {
+ status: 'error',
+ reason: event.error?.message ?? event.message ?? 'session_error',
+ },
+ }
+ }
+
+ return {}
+}
diff --git a/apps/sim/lib/managed-agents/session-client.test.ts b/apps/sim/lib/managed-agents/session-client.test.ts
new file mode 100644
index 00000000000..8eb870d3f69
--- /dev/null
+++ b/apps/sim/lib/managed-agents/session-client.test.ts
@@ -0,0 +1,191 @@
+/**
+ * @vitest-environment node
+ */
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { buildSessionCreatePayload, listSessionEvents } from '@/lib/managed-agents/session-client'
+
+const BASE = {
+ apiKey: 'sk-ant-fake',
+ agentId: 'agent_01ABC',
+ environmentId: 'env_01XYZ',
+} as const
+
+describe('buildSessionCreatePayload — always-on fields', () => {
+ it('emits `agent` and `environment_id` from the input', () => {
+ expect(buildSessionCreatePayload({ ...BASE })).toEqual({
+ agent: 'agent_01ABC',
+ environment_id: 'env_01XYZ',
+ })
+ })
+
+ it('emits `title` when set', () => {
+ expect(buildSessionCreatePayload({ ...BASE, title: 'my session' }).title).toBe('my session')
+ })
+
+ it('emits `vault_ids` only when non-empty', () => {
+ expect(buildSessionCreatePayload({ ...BASE }).vault_ids).toBeUndefined()
+ expect(buildSessionCreatePayload({ ...BASE, vaultIds: [] }).vault_ids).toBeUndefined()
+ expect(buildSessionCreatePayload({ ...BASE, vaultIds: ['vlt_1', 'vlt_2'] }).vault_ids).toEqual([
+ 'vlt_1',
+ 'vlt_2',
+ ])
+ })
+})
+
+describe('buildSessionCreatePayload — resources', () => {
+ it('attaches a memory store as a `memory_store` resource with default access', () => {
+ const payload = buildSessionCreatePayload({ ...BASE, memoryStoreId: 'memstore_01' })
+ expect(payload.resources).toEqual([
+ { type: 'memory_store', memory_store_id: 'memstore_01', access: 'read_write' },
+ ])
+ })
+
+ it('honors explicit read_only memory access', () => {
+ const payload = buildSessionCreatePayload({
+ ...BASE,
+ memoryStoreId: 'memstore_01',
+ memoryAccess: 'read_only',
+ })
+ expect(payload.resources).toEqual([
+ { type: 'memory_store', memory_store_id: 'memstore_01', access: 'read_only' },
+ ])
+ })
+
+ it('includes memory instructions when provided', () => {
+ const payload = buildSessionCreatePayload({
+ ...BASE,
+ memoryStoreId: 'memstore_01',
+ memoryInstructions: 'check before starting',
+ })
+ expect(payload.resources).toEqual([
+ {
+ type: 'memory_store',
+ memory_store_id: 'memstore_01',
+ access: 'read_write',
+ instructions: 'check before starting',
+ },
+ ])
+ })
+
+ it('attaches file resources with an optional mount path', () => {
+ const payload = buildSessionCreatePayload({
+ ...BASE,
+ files: [{ fileId: 'file_1', mountPath: '/data/one' }, { fileId: 'file_2' }],
+ })
+ expect(payload.resources).toEqual([
+ { type: 'file', file_id: 'file_1', mount_path: '/data/one' },
+ { type: 'file', file_id: 'file_2' },
+ ])
+ })
+
+ it('combines memory and file resources in order', () => {
+ const payload = buildSessionCreatePayload({
+ ...BASE,
+ memoryStoreId: 'memstore_01',
+ files: [{ fileId: 'file_1' }],
+ })
+ expect(payload.resources).toEqual([
+ { type: 'memory_store', memory_store_id: 'memstore_01', access: 'read_write' },
+ { type: 'file', file_id: 'file_1' },
+ ])
+ })
+
+ it('omits `resources` when nothing is attached', () => {
+ expect(buildSessionCreatePayload({ ...BASE }).resources).toBeUndefined()
+ expect(buildSessionCreatePayload({ ...BASE, files: [] }).resources).toBeUndefined()
+ })
+})
+
+describe('buildSessionCreatePayload — metadata', () => {
+ it('emits `metadata` from sessionParameters', () => {
+ const payload = buildSessionCreatePayload({
+ ...BASE,
+ sessionParameters: { foo: 'bar', baz: 'qux' },
+ })
+ expect(payload.metadata).toEqual({ foo: 'bar', baz: 'qux' })
+ })
+
+ it('omits `metadata` when there are no session parameters', () => {
+ expect(buildSessionCreatePayload({ ...BASE }).metadata).toBeUndefined()
+ expect(buildSessionCreatePayload({ ...BASE, sessionParameters: {} }).metadata).toBeUndefined()
+ })
+
+ it('keeps memory on resources and never folds it into metadata (cloud)', () => {
+ const payload = buildSessionCreatePayload({
+ ...BASE,
+ memoryStoreId: 'memstore_01',
+ sessionParameters: { env: 'staging' },
+ })
+ expect(payload.metadata).toEqual({ env: 'staging' })
+ expect(payload.resources).toEqual([
+ { type: 'memory_store', memory_store_id: 'memstore_01', access: 'read_write' },
+ ])
+ })
+})
+
+describe('buildSessionCreatePayload — self-hosted routing', () => {
+ it('never sends resources on self-hosted and does not auto-route memory (no native support)', () => {
+ const payload = buildSessionCreatePayload({
+ ...BASE,
+ environmentType: 'self_hosted',
+ memoryStoreId: 'memstore_01',
+ memoryAccess: 'read_only',
+ memoryInstructions: 'use it',
+ files: [{ fileId: 'file_1' }],
+ sessionParameters: { SOURCE_TYPE: 'git' },
+ })
+ expect(payload.resources).toBeUndefined()
+ // Only the author's explicit metadata is forwarded — memory is NOT injected.
+ expect(payload.metadata).toEqual({ SOURCE_TYPE: 'git' })
+ })
+
+ it('sends no metadata on self-hosted when the author set none', () => {
+ const payload = buildSessionCreatePayload({
+ ...BASE,
+ environmentType: 'self_hosted',
+ memoryStoreId: 'memstore_01',
+ files: [{ fileId: 'file_1' }],
+ })
+ expect(payload.resources).toBeUndefined()
+ expect(payload.metadata).toBeUndefined()
+ })
+
+ it('cloud (default) still attaches memory + files as resources', () => {
+ const payload = buildSessionCreatePayload({
+ ...BASE,
+ environmentType: 'cloud',
+ memoryStoreId: 'memstore_01',
+ files: [{ fileId: 'file_1' }],
+ })
+ expect(payload.resources).toEqual([
+ { type: 'memory_store', memory_store_id: 'memstore_01', access: 'read_write' },
+ { type: 'file', file_id: 'file_1' },
+ ])
+ expect(payload.metadata).toBeUndefined()
+ })
+})
+
+describe('listSessionEvents — ordering', () => {
+ const originalFetch = global.fetch
+ afterEach(() => {
+ global.fetch = originalFetch
+ })
+
+ it('orders events by processed_at ascending, with queued (null) events last', async () => {
+ global.fetch = vi.fn(async () =>
+ Response.json({
+ data: [
+ { id: 'c', type: 'agent.message', processed_at: '2026-01-01T00:00:03Z' },
+ { id: 'a', type: 'agent.message', processed_at: '2026-01-01T00:00:01Z' },
+ { id: 'queued', type: 'agent.message', processed_at: null },
+ { id: 'b', type: 'agent.message', processed_at: '2026-01-01T00:00:02Z' },
+ ],
+ next_page: null,
+ })
+ ) as unknown as typeof fetch
+
+ const events = await listSessionEvents({ apiKey: 'sk-ant-fake', sessionId: 'sess_1' })
+
+ expect(events.map((e) => e.id)).toEqual(['a', 'b', 'c', 'queued'])
+ })
+})
diff --git a/apps/sim/lib/managed-agents/session-client.ts b/apps/sim/lib/managed-agents/session-client.ts
new file mode 100644
index 00000000000..e03a6d3827e
--- /dev/null
+++ b/apps/sim/lib/managed-agents/session-client.ts
@@ -0,0 +1,425 @@
+/**
+ * Provider-neutral HTTP client for the Claude Platform Managed Agents API.
+ *
+ * A thin wrapper around `fetch` that speaks the Managed Agents beta. It has
+ * NO Sim-domain dependencies (no `@sim/db`, no encryption, no executor
+ * types) so it can be unit-tested in isolation and imported from either the
+ * server run route or the block-editor proxy route.
+ *
+ * Shapes are validated against the Claude Platform docs:
+ * https://platform.claude.com/docs/en/managed-agents/
+ */
+
+export const ANTHROPIC_API_BASE = 'https://api.anthropic.com'
+export const ANTHROPIC_VERSION = '2023-06-01'
+/** Beta header for every session/agent/environment/vault endpoint. */
+export const MANAGED_AGENTS_BETA = 'managed-agents-2026-04-01'
+/**
+ * Memory-store endpoints require a DIFFERENT beta header, and combining it
+ * with {@link MANAGED_AGENTS_BETA} on the same request is a documented 400.
+ * https://platform.claude.com/docs/en/managed-agents/memory
+ */
+export const AGENT_MEMORY_BETA = 'agent-memory-2026-07-22'
+
+/**
+ * Minimal shape of a session event as delivered over SSE or the events list.
+ * The run loop only reads these fields, so we model them structurally rather
+ * than exhaustively.
+ */
+export interface AnthropicSessionEvent {
+ id?: string
+ type?: string
+ content?: Array<{ type: string; text?: string }>
+ name?: string
+ stop_reason?: { type?: string }
+ error?: { message?: string }
+ message?: string
+ /** Server-side record time; `null`/absent means still queued (handled after processed events). */
+ processed_at?: string | null
+}
+
+/**
+ * Shared inputs on every managed-agents call. `apiKey` is the caller's
+ * Claude Platform API key (an Anthropic workspace-scoped key); `signal`
+ * propagates cancellation into the outbound fetch.
+ */
+export interface SessionAuth {
+ apiKey: string
+ signal?: AbortSignal
+}
+
+export interface CreateSessionInput extends SessionAuth {
+ agentId: string
+ environmentId: string
+ /**
+ * Environment execution model. Self-hosted environments reject the
+ * `resources` array, so memory is routed via `metadata` and files are
+ * dropped for them. Defaults to cloud behavior when unset.
+ */
+ environmentType?: EnvironmentType
+ /** Optional session title stored on the Anthropic session. */
+ title?: string
+ /** OAuth credential vaults the agent's MCP tools can reference. */
+ vaultIds?: string[]
+ /** Memory-store id (`memstore_...`) attached as a session resource. */
+ memoryStoreId?: string
+ /** Access mode on the attached memory store. Ignored when `memoryStoreId` is unset. */
+ memoryAccess?: 'read_write' | 'read_only'
+ /** Per-attachment guidance rendered into the memory section of the system prompt. */
+ memoryInstructions?: string
+ /** Files-API files (`file_...`) attached as `file` session resources. */
+ files?: Array<{ fileId: string; mountPath?: string }>
+ /** Arbitrary session metadata (wire name: `metadata`). */
+ sessionParameters?: Record
+}
+
+export interface CreateSessionResult {
+ id: string
+}
+
+/** Cumulative token usage returned on the session resource. */
+export interface SessionUsage {
+ inputTokens?: number
+ outputTokens?: number
+}
+
+/** Environment execution model per `GET /v1/environments/{id}` → `config.type`. */
+export type EnvironmentType = 'cloud' | 'self_hosted'
+
+/** Authoritative session status per `GET /v1/sessions/{id}`. */
+export type SessionStatus = 'idle' | 'running' | 'rescheduling' | 'terminated'
+
+export interface SessionSnapshot {
+ status?: SessionStatus
+ usage?: SessionUsage
+}
+
+/**
+ * Standard header set for Managed Agents calls. `beta` overrides the default
+ * managed-agents beta for memory-store endpoints. Only ONE beta value is ever
+ * sent — combining the two is a documented 400.
+ */
+function managedAgentsHeaders(
+ apiKey: string,
+ options: { json?: boolean; accept?: string; beta?: string } = {}
+): Record {
+ const headers: Record = {
+ 'x-api-key': apiKey,
+ 'anthropic-version': ANTHROPIC_VERSION,
+ 'anthropic-beta': options.beta ?? MANAGED_AGENTS_BETA,
+ }
+ if (options.json) headers['content-type'] = 'application/json'
+ if (options.accept) headers.accept = options.accept
+ return headers
+}
+
+/**
+ * Builds the request body for `POST /v1/sessions`.
+ *
+ * Cloud environments attach memory stores and files via the `resources[]`
+ * array. Self-hosted environments REJECT `resources` (a documented 400 —
+ * "resources are not supported with self-hosted environments") and have no
+ * native memory/file attach, so those are omitted there; the block hides the
+ * fields accordingly. Session parameters always go on `metadata` for both — a
+ * self-hosted worker that consumes a memory store reads it from a metadata key
+ * the author sets explicitly.
+ */
+export function buildSessionCreatePayload(input: CreateSessionInput): Record {
+ const payload: Record = {
+ agent: input.agentId,
+ environment_id: input.environmentId,
+ }
+ if (input.title) payload.title = input.title
+ if (input.vaultIds && input.vaultIds.length > 0) payload.vault_ids = input.vaultIds
+
+ // `resources` (memory stores + files) are cloud-only. Self-hosted rejects them.
+ if (input.environmentType !== 'self_hosted') {
+ const resources: Array> = []
+ if (input.memoryStoreId) {
+ const memory: Record = {
+ type: 'memory_store',
+ memory_store_id: input.memoryStoreId,
+ access: input.memoryAccess ?? 'read_write',
+ }
+ if (input.memoryInstructions) memory.instructions = input.memoryInstructions
+ resources.push(memory)
+ }
+ if (input.files && input.files.length > 0) {
+ for (const file of input.files) {
+ if (!file.fileId) continue
+ const entry: Record = { type: 'file', file_id: file.fileId }
+ if (file.mountPath) entry.mount_path = file.mountPath
+ resources.push(entry)
+ }
+ }
+ if (resources.length > 0) payload.resources = resources
+ }
+
+ if (input.sessionParameters && Object.keys(input.sessionParameters).length > 0) {
+ payload.metadata = { ...input.sessionParameters }
+ }
+ return payload
+}
+
+/**
+ * POST /v1/sessions — provisions a session sandbox. Does NOT start work; a
+ * subsequent `sendUserMessage` is what causes the agent to run.
+ */
+export async function createSession(input: CreateSessionInput): Promise {
+ const resp = await fetch(`${ANTHROPIC_API_BASE}/v1/sessions`, {
+ method: 'POST',
+ headers: managedAgentsHeaders(input.apiKey, { json: true }),
+ body: JSON.stringify(buildSessionCreatePayload(input)),
+ signal: input.signal,
+ })
+ if (!resp.ok) {
+ const detail = await resp.text().catch(() => '')
+ throw new Error(`Anthropic sessions.create failed (${resp.status}): ${detail.slice(0, 400)}`)
+ }
+ const body = (await resp.json()) as { id?: unknown }
+ if (typeof body.id !== 'string' || body.id.length === 0) {
+ throw new Error('Anthropic sessions.create returned no id')
+ }
+ return { id: body.id }
+}
+
+interface UserMessageEvent {
+ type: 'user.message'
+ content: Array<{ type: 'text'; text: string }>
+}
+
+interface UserCustomToolResultEvent {
+ type: 'user.custom_tool_result'
+ custom_tool_use_id: string
+ content: Array<{ type: 'text'; text: string }>
+ is_error: boolean
+}
+
+/** Stops a running session mid-execution; the session stays usable afterward. */
+interface UserInterruptEvent {
+ type: 'user.interrupt'
+}
+
+export type OutboundSessionEvent = UserMessageEvent | UserCustomToolResultEvent | UserInterruptEvent
+
+/** POST /v1/sessions/{id}/events with a single `user.message`. */
+export async function sendUserMessage(
+ input: SessionAuth & { sessionId: string; text: string }
+): Promise {
+ await sendSessionEvents({
+ apiKey: input.apiKey,
+ signal: input.signal,
+ sessionId: input.sessionId,
+ events: [{ type: 'user.message', content: [{ type: 'text', text: input.text }] }],
+ })
+}
+
+/** Generic events-send used for both `user.message` and `user.custom_tool_result`. */
+export async function sendSessionEvents(
+ input: SessionAuth & { sessionId: string; events: OutboundSessionEvent[] }
+): Promise {
+ if (input.events.length === 0) return
+ const resp = await fetch(`${ANTHROPIC_API_BASE}/v1/sessions/${input.sessionId}/events`, {
+ method: 'POST',
+ headers: managedAgentsHeaders(input.apiKey, { json: true }),
+ body: JSON.stringify({ events: input.events }),
+ signal: input.signal,
+ })
+ if (!resp.ok) {
+ const detail = await resp.text().catch(() => '')
+ throw new Error(`Anthropic events.send failed (${resp.status}): ${detail.slice(0, 400)}`)
+ }
+}
+
+/** Best-effort timeout for the fire-on-cancel interrupt (its own, since the run signal is already aborted). */
+const INTERRUPT_TIMEOUT_MS = 5000
+
+/**
+ * POST /v1/sessions/{id}/events with a `user.interrupt` — stops a session that
+ * is still running so it stops consuming the workspace API key once Sim has
+ * given up on it (workflow cancelled or wall-clock cap hit). Deliberately uses
+ * its OWN short timeout rather than the run's abort signal, which is already
+ * aborted by the time this fires.
+ */
+export async function interruptSession(input: {
+ apiKey: string
+ sessionId: string
+}): Promise {
+ await sendSessionEvents({
+ apiKey: input.apiKey,
+ sessionId: input.sessionId,
+ events: [{ type: 'user.interrupt' }],
+ signal: AbortSignal.timeout(INTERRUPT_TIMEOUT_MS),
+ })
+}
+
+/** GET /v1/sessions/{id}/events/stream — opens the SSE response. */
+export async function openSessionStream(
+ input: SessionAuth & { sessionId: string }
+): Promise {
+ const resp = await fetch(`${ANTHROPIC_API_BASE}/v1/sessions/${input.sessionId}/events/stream`, {
+ method: 'GET',
+ headers: managedAgentsHeaders(input.apiKey, { accept: 'text/event-stream' }),
+ signal: input.signal,
+ })
+ if (!resp.ok) {
+ const detail = await resp.text().catch(() => '')
+ throw new Error(`Anthropic events.stream failed (${resp.status}): ${detail.slice(0, 400)}`)
+ }
+ if (!resp.body) throw new Error('Anthropic events.stream returned no body')
+ return resp
+}
+
+/** A single page of a Managed Agents list endpoint (page-cursor pagination). */
+interface AnthropicListPage {
+ data?: T[]
+ next_page?: string | null
+}
+
+/**
+ * Drains a page-cursor-paginated list endpoint (`?limit=&page=` following
+ * `next_page` until null). Used for both the block-editor dropdowns and the
+ * session-event catch-up. `beta` overrides the default header for memory
+ * stores.
+ */
+const MAX_LIST_PAGES = 1000
+
+async function listPaginated(
+ input: SessionAuth & { path: string; beta?: string; maxItems?: number }
+): Promise {
+ const collected: T[] = []
+ const maxItems = input.maxItems ?? 2000
+ let page: string | null = null
+ // `MAX_LIST_PAGES` bounds a misbehaving cursor that never returns `next_page:
+ // null`; real histories terminate well before it.
+ for (let pageCount = 0; pageCount < MAX_LIST_PAGES && collected.length < maxItems; pageCount++) {
+ const url = new URL(`${ANTHROPIC_API_BASE}${input.path}`)
+ url.searchParams.set('limit', '100')
+ if (page) url.searchParams.set('page', page)
+ const resp = await fetch(url.toString(), {
+ method: 'GET',
+ headers: managedAgentsHeaders(input.apiKey, { beta: input.beta }),
+ signal: input.signal,
+ })
+ if (!resp.ok) {
+ const detail = await resp.text().catch(() => '')
+ throw new Error(`Anthropic ${input.path} failed (${resp.status}): ${detail.slice(0, 400)}`)
+ }
+ const body = (await resp.json()) as AnthropicListPage
+ const items = Array.isArray(body.data) ? body.data : []
+ collected.push(...items)
+ if (!body.next_page || items.length === 0) break
+ page = body.next_page
+ }
+ return collected
+}
+
+/**
+ * Full event history for a session (`GET /v1/sessions/{id}/events`), used by
+ * the reconnect/catch-up loop to recover events missed while the SSE stream
+ * was closed. The caller dedups against already-seen event ids. Drains every
+ * page so the tail (terminal status / final assistant text) is never cut off
+ * by a page cap.
+ */
+export async function listSessionEvents(
+ input: SessionAuth & { sessionId: string }
+): Promise {
+ const events = await listPaginated({
+ apiKey: input.apiKey,
+ signal: input.signal,
+ path: `/v1/sessions/${input.sessionId}/events`,
+ maxItems: Number.POSITIVE_INFINITY,
+ })
+ // The list endpoint's page order is not guaranteed chronological, so order by
+ // the server-side `processed_at` timestamp before returning. The catch-up
+ // loop depends on ascending order both to accumulate assistant text in order
+ // and to read the latest lifecycle event. Still-queued events (null
+ // `processed_at`) are processed after everything else, so they sort last.
+ return events.sort((a, b) => parseProcessedAt(a.processed_at) - parseProcessedAt(b.processed_at))
+}
+
+/** Epoch millis for a `processed_at`, or +Infinity when absent/queued/unparseable (sorts last). */
+function parseProcessedAt(value: string | null | undefined): number {
+ if (!value) return Number.POSITIVE_INFINITY
+ const parsed = Date.parse(value)
+ return Number.isNaN(parsed) ? Number.POSITIVE_INFINITY : parsed
+}
+
+/**
+ * Lists a Managed Agents resource collection for the block-editor dropdowns.
+ * Memory stores require the agent-memory beta header; everything else uses the
+ * managed-agents beta.
+ */
+export async function managedAgentsList(
+ input: SessionAuth & { path: string; beta?: string }
+): Promise {
+ return listPaginated({
+ apiKey: input.apiKey,
+ signal: input.signal,
+ path: input.path,
+ beta: input.beta,
+ })
+}
+
+/**
+ * GET /v1/environments/{id} — resolves the environment's execution model from
+ * `config.type`. Drives session-payload routing: self-hosted rejects
+ * `resources`. Returns `undefined` on any error so the caller can fall back to
+ * cloud behavior.
+ */
+export async function getEnvironmentType(
+ input: SessionAuth & { environmentId: string }
+): Promise {
+ try {
+ const resp = await fetch(`${ANTHROPIC_API_BASE}/v1/environments/${input.environmentId}`, {
+ method: 'GET',
+ headers: managedAgentsHeaders(input.apiKey),
+ signal: input.signal,
+ })
+ if (!resp.ok) return undefined
+ const body = (await resp.json()) as { config?: { type?: unknown } }
+ const type = body.config?.type
+ return type === 'cloud' || type === 'self_hosted' ? type : undefined
+ } catch {
+ return undefined
+ }
+}
+
+/**
+ * GET /v1/sessions/{id} — retrieves the session resource. Returns the
+ * authoritative `status` (used to decide completion when the event stream is
+ * quiet) and cumulative token `usage` (surfaced as block output). Returns
+ * `null` on any error so callers can treat it as best-effort.
+ */
+export async function getSession(
+ input: SessionAuth & { sessionId: string }
+): Promise {
+ try {
+ const resp = await fetch(`${ANTHROPIC_API_BASE}/v1/sessions/${input.sessionId}`, {
+ method: 'GET',
+ headers: managedAgentsHeaders(input.apiKey),
+ signal: input.signal,
+ })
+ if (!resp.ok) return null
+ const body = (await resp.json()) as {
+ status?: unknown
+ usage?: { input_tokens?: unknown; output_tokens?: unknown }
+ }
+ const snapshot: SessionSnapshot = {}
+ if (
+ body.status === 'idle' ||
+ body.status === 'running' ||
+ body.status === 'rescheduling' ||
+ body.status === 'terminated'
+ ) {
+ snapshot.status = body.status
+ }
+ const usage: SessionUsage = {}
+ if (typeof body.usage?.input_tokens === 'number') usage.inputTokens = body.usage.input_tokens
+ if (typeof body.usage?.output_tokens === 'number') usage.outputTokens = body.usage.output_tokens
+ if (usage.inputTokens !== undefined || usage.outputTokens !== undefined) snapshot.usage = usage
+ return snapshot
+ } catch {
+ return null
+ }
+}
diff --git a/apps/sim/lib/managed-agents/subblock-options.ts b/apps/sim/lib/managed-agents/subblock-options.ts
new file mode 100644
index 00000000000..ca25119ef56
--- /dev/null
+++ b/apps/sim/lib/managed-agents/subblock-options.ts
@@ -0,0 +1,64 @@
+import { requestJson } from '@/lib/api/client/request'
+import {
+ listManagedAgentOptionsContract,
+ type ManagedAgentOption,
+ type ManagedAgentResource,
+} from '@/lib/api/contracts/managed-agents'
+import { useWorkflowRegistry } from '@/stores/workflows/registry/store'
+import { useSubBlockStore } from '@/stores/workflows/subblock/store'
+
+/**
+ * `fetchOptions` helpers for the Managed Agent block's dropdowns. Each reads
+ * the block's selected Claude Platform `credential` and calls the list route,
+ * which decrypts the credential's key server-side — the API key never touches
+ * the browser.
+ */
+
+function readSubBlockValue(blockId: string, key: string): string | null {
+ const activeWorkflowId = useWorkflowRegistry.getState().activeWorkflowId
+ if (!activeWorkflowId) return null
+ const value = useSubBlockStore.getState().workflowValues[activeWorkflowId]?.[blockId]?.[key]
+ return typeof value === 'string' && value.length > 0 ? value : null
+}
+
+async function fetchOptions(
+ blockId: string,
+ resource: ManagedAgentResource
+): Promise {
+ const credentialId = readSubBlockValue(blockId, 'credential')
+ if (!credentialId) return []
+ try {
+ const { options } = await requestJson(listManagedAgentOptionsContract, {
+ query: { credentialId, resource },
+ })
+ return options
+ } catch {
+ return []
+ }
+}
+
+export function fetchManagedAgentAgentOptions(blockId: string): Promise {
+ return fetchOptions(blockId, 'agents')
+}
+
+export async function fetchManagedAgentEnvironmentOptions(
+ blockId: string
+): Promise {
+ const options = await fetchOptions(blockId, 'environments')
+ // Filter to the selected environment type so cloud/self-hosted stay separate
+ // (self-hosted rejects `resources`, so the two modes expose different fields).
+ // Options with an unknown type are kept as a safety net.
+ const mode = readSubBlockValue(blockId, 'environmentType')
+ if (mode !== 'cloud' && mode !== 'self_hosted') return options
+ return options.filter((option) => option.type === undefined || option.type === mode)
+}
+
+export function fetchManagedAgentVaultOptions(blockId: string): Promise {
+ return fetchOptions(blockId, 'vaults')
+}
+
+export function fetchManagedAgentMemoryStoreOptions(
+ blockId: string
+): Promise {
+ return fetchOptions(blockId, 'memory-stores')
+}
diff --git a/apps/sim/lib/mcp/client.test.ts b/apps/sim/lib/mcp/client.test.ts
index c568f425d61..dda637bbe88 100644
--- a/apps/sim/lib/mcp/client.test.ts
+++ b/apps/sim/lib/mcp/client.test.ts
@@ -1,9 +1,10 @@
/**
* @vitest-environment node
*/
+import { UnauthorizedError } from '@modelcontextprotocol/sdk/client/auth.js'
import { beforeEach, describe, expect, it, vi } from 'vitest'
-const { mockLogger, mockSdkConnect, mockSdkListTools } = vi.hoisted(() => ({
+const { mockLogger, mockSdkConnect, mockSdkListTools, mockPinnedClose } = vi.hoisted(() => ({
mockLogger: {
debug: vi.fn(),
error: vi.fn(),
@@ -12,12 +13,17 @@ const { mockLogger, mockSdkConnect, mockSdkListTools } = vi.hoisted(() => ({
},
mockSdkConnect: vi.fn().mockResolvedValue(undefined),
mockSdkListTools: vi.fn().mockResolvedValue({ tools: [] }),
+ mockPinnedClose: vi.fn().mockResolvedValue(undefined),
}))
vi.mock('@sim/logger', () => ({
createLogger: () => mockLogger,
}))
+vi.mock('@/lib/mcp/pinned-fetch', () => ({
+ createPinnedMcpFetch: vi.fn(() => ({ fetch: vi.fn(), close: mockPinnedClose })),
+}))
+
/**
* Capture the notification handler registered via `client.setNotificationHandler()`.
* This lets us simulate the MCP SDK delivering a `tools/list_changed` notification.
@@ -265,6 +271,99 @@ describe('McpClient notification handler', () => {
expect(JSON.stringify(mockLogger.error.mock.calls)).not.toContain(secret)
})
+ it('closes the pinned transport Agent when connect fails', async () => {
+ mockSdkConnect.mockRejectedValueOnce(new Error('connect boom'))
+ const client = new McpClient({
+ config: createConfig(),
+ securityPolicy: { requireConsent: false, auditLevel: 'basic' },
+ resolvedIP: '203.0.113.10',
+ })
+
+ // A failed connect discards the client without a disconnect(), so the Agent
+ // must be released on the failure path or its h2 sockets leak.
+ await expect(client.connect()).rejects.toThrow()
+
+ expect(mockPinnedClose).toHaveBeenCalledTimes(1)
+ })
+
+ it('closes the pinned transport Agent on disconnect', async () => {
+ const client = new McpClient({
+ config: createConfig(),
+ securityPolicy: { requireConsent: false, auditLevel: 'basic' },
+ resolvedIP: '203.0.113.10',
+ })
+
+ await client.connect()
+ await client.disconnect()
+
+ expect(mockPinnedClose).toHaveBeenCalledTimes(1)
+ })
+
+ it('does not destroy the pinned transport Agent twice when a failed connect is followed by disconnect', async () => {
+ mockSdkConnect.mockRejectedValueOnce(new Error('connect boom'))
+ const client = new McpClient({
+ config: createConfig(),
+ securityPolicy: { requireConsent: false, auditLevel: 'basic' },
+ resolvedIP: '203.0.113.10',
+ })
+
+ await expect(client.connect()).rejects.toThrow()
+ // The caller (e.g. withConnectTimeout) may still call disconnect() afterward;
+ // teardown must be idempotent so the Agent is destroyed exactly once.
+ await client.disconnect()
+
+ expect(mockPinnedClose).toHaveBeenCalledTimes(1)
+ })
+
+ it('does not misclassify rejected static headers as an OAuth authorization flow', async () => {
+ mockSdkConnect.mockRejectedValueOnce(new UnauthorizedError('Static token rejected'))
+ const client = new McpClient({
+ config: {
+ ...createConfig(),
+ authType: 'headers',
+ headers: { Authorization: 'Bearer rejected-static-token' },
+ },
+ securityPolicy: { requireConsent: false, auditLevel: 'basic' },
+ })
+
+ await expect(client.connect()).rejects.toBeInstanceOf(UnauthorizedError)
+
+ expect(mockLogger.error).toHaveBeenCalledWith(
+ expect.stringContaining('Failed to connect'),
+ expect.objectContaining({ outcome: 'unauthorized' })
+ )
+ expect(client.getStatus().lastError).toBe('Authentication failed')
+ })
+
+ it('logs tools/list failures without echoed credentials or session identifiers', async () => {
+ const secret = 'opaque-tools-list-credential'
+ mockSdkListTools.mockRejectedValueOnce(new Error(`Upstream rejected ${secret}`))
+ const client = new McpClient({
+ config: {
+ ...createConfig(),
+ authType: 'headers',
+ headers: { 'X-Custom-Credential': secret },
+ },
+ securityPolicy: { requireConsent: false, auditLevel: 'basic' },
+ })
+
+ await client.connect()
+ await expect(client.listTools()).rejects.toThrow(secret)
+
+ expect(mockLogger.error).toHaveBeenCalledWith(
+ expect.stringContaining('Failed to list tools'),
+ expect.objectContaining({
+ phase: 'tools/list',
+ serverId: 'server-1',
+ sessionIdPresent: true,
+ error: expect.objectContaining({ name: 'Error' }),
+ })
+ )
+ const logged = JSON.stringify(mockLogger.error.mock.calls)
+ expect(logged).not.toContain(secret)
+ expect(logged).not.toContain('test-session')
+ })
+
it('passes configured headers for OAuth transports as well as header auth transports', () => {
const authProvider = {} as unknown as NonNullable
new McpClient({
diff --git a/apps/sim/lib/mcp/client.ts b/apps/sim/lib/mcp/client.ts
index 50a90355c14..80931413320 100644
--- a/apps/sim/lib/mcp/client.ts
+++ b/apps/sim/lib/mcp/client.ts
@@ -9,11 +9,11 @@ import {
ToolListChangedNotificationSchema,
} from '@modelcontextprotocol/sdk/types.js'
import { createLogger } from '@sim/logger'
-import { describeError, getErrorMessage } from '@sim/utils/errors'
+import { getErrorMessage } from '@sim/utils/errors'
import { getMaxExecutionTimeout } from '@/lib/core/execution-limits'
-import { createPinnedFetch } from '@/lib/core/security/input-validation.server'
-import { sanitizeForLogging } from '@/lib/core/security/redaction'
+import { getMcpSafeErrorDiagnostics } from '@/lib/mcp/error-diagnostics'
import { McpOauthRedirectRequired } from '@/lib/mcp/oauth'
+import { createPinnedMcpFetch } from '@/lib/mcp/pinned-fetch'
import {
type McpClientOptions,
McpConnectionError,
@@ -43,10 +43,16 @@ type ConnectionOutcome =
| 'cancelled'
| 'error'
-function classifyConnectionOutcome(error: unknown): ConnectionOutcome {
- if (error instanceof McpOauthRedirectRequired || error instanceof UnauthorizedError) {
+function classifyConnectionOutcome(
+ error: unknown,
+ authType: McpServerConfig['authType']
+): ConnectionOutcome {
+ if (error instanceof McpOauthRedirectRequired) {
return 'authorization_required'
}
+ if (error instanceof UnauthorizedError) {
+ return authType === 'oauth' ? 'authorization_required' : 'unauthorized'
+ }
const message = getErrorMessage(error, '').toLowerCase()
if (message.includes('connection attempt cancelled')) return 'cancelled'
if (message.includes('timeout') || message.includes('timed out')) return 'timeout'
@@ -67,6 +73,7 @@ export class McpClient {
private onToolsChanged?: McpToolsChangedCallback
private authProvider?: McpClientOptions['authProvider']
private isConnected = false
+ private closePinnedTransport?: () => Promise
constructor(options: McpClientOptions) {
this.config = options.config
@@ -89,10 +96,12 @@ export class McpClient {
throw new McpError('OAuth MCP server requires an authProvider')
}
const useOauth = this.config.authType === 'oauth'
+ const pinned = resolvedIP ? createPinnedMcpFetch(resolvedIP) : undefined
+ this.closePinnedTransport = pinned?.close
this.transport = new StreamableHTTPClientTransport(new URL(this.config.url), {
authProvider: useOauth ? this.authProvider : undefined,
requestInit: { headers: this.config.headers },
- ...(resolvedIP ? { fetch: createPinnedFetch(resolvedIP) } : {}),
+ ...(pinned ? { fetch: pinned.fetch } : {}),
})
this.client = new Client(
@@ -105,11 +114,12 @@ export class McpClient {
}
)
- // Observe out-of-band transport errors the SDK would otherwise drop silently.
this.client.onerror = (error) => {
logger.warn(`MCP transport error for ${this.config.name}`, {
serverId: this.config.id,
- error: sanitizeForLogging(getErrorMessage(error, 'Unknown transport error'), 200),
+ phase: 'transport',
+ sessionIdPresent: Boolean(this.transport.sessionId),
+ error: getMcpSafeErrorDiagnostics(error),
})
}
}
@@ -152,6 +162,7 @@ export class McpClient {
await this.client.close().catch((error) => {
logger.warn(`Error closing cancelled connection to ${this.config.name}:`, error)
})
+ // The Agent is released by the shared catch below, which this throw enters.
throw new McpConnectionError('Connection attempt cancelled', this.config.name)
}
@@ -177,26 +188,24 @@ export class McpClient {
})
} catch (error) {
this.isConnected = false
+ // A failed connect discards this client without a disconnect(), so release the Agent here.
+ await this.closeTransportAgent()
const errorMessage = getErrorMessage(error, 'Unknown error')
- const describedError = describeError(error)
- const outcome = classifyConnectionOutcome(error)
+ const outcome = classifyConnectionOutcome(error, this.config.authType)
logger.error(`Failed to connect to MCP server ${this.config.name}`, {
...diagnostics,
durationMs: Date.now() - startedAt,
- error: {
- name: sanitizeForLogging(describedError.name, 100),
- code: describedError.code ? sanitizeForLogging(describedError.code, 100) : undefined,
- errno: describedError.errno ? sanitizeForLogging(describedError.errno, 100) : undefined,
- syscall: describedError.syscall
- ? sanitizeForLogging(describedError.syscall, 100)
- : undefined,
- },
+ error: getMcpSafeErrorDiagnostics(error),
outcome,
})
if (outcome === 'authorization_required') {
this.connectionStatus.lastError = undefined
throw error
}
+ if (error instanceof UnauthorizedError) {
+ this.connectionStatus.lastError = 'Authentication failed'
+ throw error
+ }
this.connectionStatus.lastError = errorMessage
throw new McpConnectionError(errorMessage, this.config.name)
}
@@ -211,11 +220,31 @@ export class McpClient {
logger.warn(`Error during disconnect from ${this.config.name}:`, error)
}
+ await this.closeTransportAgent()
+
this.isConnected = false
this.connectionStatus.connected = false
logger.info(`Disconnected from MCP server: ${this.config.name}`)
}
+ /**
+ * Tears down the pinned transport's HTTP/2 Agent, releasing its sockets. Must run
+ * on every terminal path — successful disconnect, and failed or cancelled connect —
+ * since a failed `connect()` discards this client without a `disconnect()` call.
+ * Idempotent: the handle is cleared before use so repeat calls (a failed connect
+ * followed by the caller's `disconnect()`) never destroy the same Agent twice.
+ */
+ private async closeTransportAgent(): Promise