diff --git a/.claude/rules/constitution.md b/.claude/rules/constitution.md
index 62dd7df3c56..565dee4b877 100644
--- a/.claude/rules/constitution.md
+++ b/.claude/rules/constitution.md
@@ -1,3 +1,7 @@
+---
+description: Sim product language, positioning, and tone guidelines
+---
+
 # Sim — Language & Positioning
 
 When editing user-facing copy (landing pages, docs, metadata, marketing), follow these rules.
diff --git a/.claude/rules/emcn-components.md b/.claude/rules/emcn-components.md
index cab88b47f67..f02ff3946e5 100644
--- a/.claude/rules/emcn-components.md
+++ b/.claude/rules/emcn-components.md
@@ -1,4 +1,5 @@
 ---
+description: EMCN component library patterns
 paths:
   - "packages/emcn/**"
 ---
diff --git a/.claude/rules/global.md b/.claude/rules/global.md
index 8ae6e0e874c..90852e76206 100644
--- a/.claude/rules/global.md
+++ b/.claude/rules/global.md
@@ -1,3 +1,7 @@
+---
+description: Global coding standards that apply to all files
+---
+
 # Global Standards
 
 ## Logging
diff --git a/.claude/rules/landing-seo-geo.md b/.claude/rules/landing-seo-geo.md
index 4f6ec536ad0..51c5402262a 100644
--- a/.claude/rules/landing-seo-geo.md
+++ b/.claude/rules/landing-seo-geo.md
@@ -1,4 +1,5 @@
 ---
+description: SEO and GEO guidelines for the landing page
 paths:
   - "apps/sim/app/(landing)/**/*.tsx"
   - "apps/sim/content/**/*.mdx"
diff --git a/.claude/rules/sim-architecture.md b/.claude/rules/sim-architecture.md
index d950851a3f1..95a59198851 100644
--- a/.claude/rules/sim-architecture.md
+++ b/.claude/rules/sim-architecture.md
@@ -1,4 +1,5 @@
 ---
+description: Core architecture principles for the Sim app
 paths:
   - "apps/sim/**"
 ---
diff --git a/.claude/rules/sim-caching.md b/.claude/rules/sim-caching.md
index fced410b448..28a4f884234 100644
--- a/.claude/rules/sim-caching.md
+++ b/.claude/rules/sim-caching.md
@@ -1,4 +1,5 @@
 ---
+description: In-process caching with lru-cache and a ceiling, never hand-rolled TTL maps
 paths:
   - "apps/sim/lib/**/*.ts"
   - "apps/sim/providers/**/*.ts"
diff --git a/.claude/rules/sim-components.md b/.claude/rules/sim-components.md
index 183fbaac822..f435b20c1a8 100644
--- a/.claude/rules/sim-components.md
+++ b/.claude/rules/sim-components.md
@@ -1,4 +1,5 @@
 ---
+description: Component patterns and structure for React components
 paths:
   - "apps/sim/**/*.tsx"
 ---
diff --git a/.claude/rules/sim-hooks.md b/.claude/rules/sim-hooks.md
index 36b96827c82..a4ff58fdbca 100644
--- a/.claude/rules/sim-hooks.md
+++ b/.claude/rules/sim-hooks.md
@@ -1,4 +1,5 @@
 ---
+description: Custom hook patterns and best practices
 paths:
   - "apps/sim/**/use-*.ts"
   - "apps/sim/**/hooks/**/*.ts"
diff --git a/.claude/rules/sim-imports.md b/.claude/rules/sim-imports.md
index 0449d96e11e..3aeafa0dd2e 100644
--- a/.claude/rules/sim-imports.md
+++ b/.claude/rules/sim-imports.md
@@ -1,4 +1,5 @@
 ---
+description: Import patterns for the Sim application
 paths:
   - "apps/sim/**/*.ts"
   - "apps/sim/**/*.tsx"
diff --git a/.claude/rules/sim-integrations.md b/.claude/rules/sim-integrations.md
index 34231a900b9..c4729747596 100644
--- a/.claude/rules/sim-integrations.md
+++ b/.claude/rules/sim-integrations.md
@@ -1,4 +1,5 @@
 ---
+description: Adding new integrations (tools, blocks, triggers)
 paths:
   - "apps/sim/tools/**"
   - "apps/sim/blocks/**"
diff --git a/.claude/rules/sim-list-ordering.md b/.claude/rules/sim-list-ordering.md
index cad6c2104b3..9b6d6a87147 100644
--- a/.claude/rules/sim-list-ordering.md
+++ b/.claude/rules/sim-list-ordering.md
@@ -1,4 +1,5 @@
 ---
+description: List and menu ordering that mirrors the sidebar or toolbar, with one separator before the destructive action
 paths:
   - "apps/sim/app/**/*.tsx"
   - "apps/sim/ee/**/*.tsx"
diff --git a/.claude/rules/sim-queries.md b/.claude/rules/sim-queries.md
index a71ee448dde..f2600e4e264 100644
--- a/.claude/rules/sim-queries.md
+++ b/.claude/rules/sim-queries.md
@@ -1,4 +1,5 @@
 ---
+description: React Query patterns for the Sim application
 paths:
   - "apps/sim/hooks/queries/**/*.ts"
 ---
diff --git a/.claude/rules/sim-react-performance.md b/.claude/rules/sim-react-performance.md
index a78c2e984e4..a9bfeaa7f63 100644
--- a/.claude/rules/sim-react-performance.md
+++ b/.claude/rules/sim-react-performance.md
@@ -1,3 +1,7 @@
+---
+description: Behavior-preserving React render-performance idioms
+---
+
 # React & Render Performance
 
 Behavior-preserving performance idioms for components, hooks, and hot render paths. These are safe defaults — apply them freely. For the render-causing *effect/state* anti-patterns (derived state in effects, effect chains, state synced to a prop), use the dedicated skills: `/you-might-not-need-an-effect`, `/you-might-not-need-state`, `/you-might-not-need-a-memo`, `/you-might-not-need-a-callback`. Those refactors change render timing — verify them against the running UI, never mass-apply blind.
diff --git a/.claude/rules/sim-settings-pages.md b/.claude/rules/sim-settings-pages.md
index 9893028c352..aaf692544a1 100644
--- a/.claude/rules/sim-settings-pages.md
+++ b/.claude/rules/sim-settings-pages.md
@@ -1,4 +1,5 @@
 ---
+description: Settings page layout and SettingsPanel design-system compliance
 paths:
   - "apps/sim/app/workspace/*/settings/**"
   - "apps/sim/app/workspace/*/{integrations,skills,upgrade}/**"
diff --git a/.claude/rules/sim-stores.md b/.claude/rules/sim-stores.md
index 273c394fbce..d44078e84bc 100644
--- a/.claude/rules/sim-stores.md
+++ b/.claude/rules/sim-stores.md
@@ -1,4 +1,5 @@
 ---
+description: Zustand store patterns
 paths:
   - "apps/sim/**/store.ts"
   - "apps/sim/**/stores/**/*.ts"
diff --git a/.claude/rules/sim-styling.md b/.claude/rules/sim-styling.md
index 61960c9eb5c..48d9086a481 100644
--- a/.claude/rules/sim-styling.md
+++ b/.claude/rules/sim-styling.md
@@ -1,4 +1,5 @@
 ---
+description: Tailwind CSS and styling conventions
 paths:
   - "apps/sim/**/*.tsx"
   - "apps/sim/**/*.css"
diff --git a/.claude/rules/sim-testing.md b/.claude/rules/sim-testing.md
new file mode 100644
index 00000000000..13c9044e594
--- /dev/null
+++ b/.claude/rules/sim-testing.md
@@ -0,0 +1,258 @@
+---
+description: Testing patterns with Vitest and @sim/testing
+paths:
+  - "apps/sim/**/*.test.ts"
+  - "apps/sim/**/*.test.tsx"
+---
+
+# Testing Patterns
+
+Use Vitest. Test files: `feature.ts` → `feature.test.ts`
+
+## Global Mocks (vitest.setup.ts)
+
+These modules are mocked globally — do NOT re-mock them in test files unless you need to override behavior:
+
+- `@sim/db` → `databaseMock`
+- `@sim/db/schema` → `schemaMock`
+- `drizzle-orm` → `drizzleOrmMock`
+- `@sim/logger` → `loggerMock`
+- `@/lib/auth` → `authMock`
+- `@/lib/auth/hybrid` → `hybridAuthMock` (with default session-delegating behavior)
+- `@/lib/core/utils/request` → `requestUtilsMock`
+- `@/stores/console/store`, `@/stores/terminal`, `@/stores/execution/store`
+- `@/blocks/registry`
+- `@trigger.dev/sdk`
+- `@sim/platform-authz/workflow` → `workflowAuthzMock`
+
+## Structure
+
+```typescript
+/**
+ * @vitest-environment node
+ */
+import { createMockRequest } from '@sim/testing'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { mockGetSession } = vi.hoisted(() => ({
+  mockGetSession: vi.fn(),
+}))
+
+vi.mock('@/lib/auth', () => ({
+  auth: { api: { getSession: vi.fn() } },
+  getSession: mockGetSession,
+}))
+
+import { GET, POST } from '@/app/api/my-route/route'
+
+describe('my route', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockGetSession.mockResolvedValue({ user: { id: 'user-1' } })
+  })
+
+  it('returns data', async () => {
+    const req = createMockRequest('GET')
+    const res = await GET(req)
+    expect(res.status).toBe(200)
+  })
+})
+```
+
+## Performance Rules (Critical)
+
+### NEVER use `vi.resetModules()` + `vi.doMock()` + `await import()`
+
+This is the #1 cause of slow tests. It forces complete module re-evaluation per test.
+
+```typescript
+// BAD — forces module re-evaluation every test (~50-100ms each)
+beforeEach(() => {
+  vi.resetModules()
+  vi.doMock('@/lib/auth', () => ({ getSession: vi.fn() }))
+})
+it('test', async () => {
+  const { GET } = await import('./route')  // slow dynamic import
+})
+
+// GOOD — module loaded once, mocks reconfigured per test (~1ms each)
+const { mockGetSession } = vi.hoisted(() => ({
+  mockGetSession: vi.fn(),
+}))
+vi.mock('@/lib/auth', () => ({ getSession: mockGetSession }))
+import { GET } from '@/app/api/my-route/route'
+
+beforeEach(() => { vi.clearAllMocks() })
+it('test', () => {
+  mockGetSession.mockResolvedValue({ user: { id: '1' } })
+})
+```
+
+**Only exception:** Singleton modules that cache state at module scope (e.g., Redis clients, connection pools). These genuinely need `vi.resetModules()` + dynamic import to get a fresh instance per test.
+
+### NEVER use `vi.importActual()`
+
+This defeats the purpose of mocking by loading the real module and all its dependencies.
+
+```typescript
+// BAD — loads real module + all transitive deps
+vi.mock('@/lib/workspaces/utils', async () => {
+  const actual = await vi.importActual('@/lib/workspaces/utils')
+  return { ...actual, myFn: vi.fn() }
+})
+
+// GOOD — mock everything, only implement what tests need
+vi.mock('@/lib/workspaces/utils', () => ({
+  myFn: vi.fn(),
+  otherFn: vi.fn(),
+}))
+```
+
+### Mock heavy transitive dependencies
+
+If a module under test imports `@/blocks` (200+ files), `@/tools/registry`, or other heavy modules, mock them:
+
+```typescript
+vi.mock('@/blocks', () => ({
+  getBlock: () => null,
+  getAllBlocks: () => ({}),
+  getAllBlockTypes: () => [],
+  registry: {},
+}))
+```
+
+### Use `@vitest-environment node` unless DOM is needed
+
+Only use `@vitest-environment jsdom` if the test uses `window`, `document`, `FormData`, or other browser APIs. Node environment is significantly faster.
+
+### Avoid real timers in tests
+
+```typescript
+// BAD
+await new Promise(r => setTimeout(r, 500))
+
+// GOOD — use minimal delays or fake timers
+await new Promise(r => setTimeout(r, 1))
+// or
+vi.useFakeTimers()
+```
+
+## Centralized Mocks (prefer over local declarations)
+
+`@sim/testing` exports ready-to-use mock modules for common dependencies. Import and pass directly to `vi.mock()` — no `vi.hoisted()` boilerplate needed. Each paired `*MockFns` object exposes the underlying `vi.fn()`s for per-test overrides.
+
+| Module mocked | Import | Factory form |
+|---|---|---|
+| `@/app/api/auth/oauth/utils` | `authOAuthUtilsMock`, `authOAuthUtilsMockFns` | `vi.mock('@/app/api/auth/oauth/utils', () => authOAuthUtilsMock)` |
+| `@/app/api/knowledge/utils` | `knowledgeApiUtilsMock`, `knowledgeApiUtilsMockFns` | `vi.mock('@/app/api/knowledge/utils', () => knowledgeApiUtilsMock)` |
+| `@/app/api/workflows/utils` | `workflowsApiUtilsMock`, `workflowsApiUtilsMockFns` | `vi.mock('@/app/api/workflows/utils', () => workflowsApiUtilsMock)` |
+| `@sim/audit` | `auditMock`, `auditMockFns` | `vi.mock('@sim/audit', () => auditMock)` |
+| `@/lib/auth` | `authMock`, `authMockFns` | `vi.mock('@/lib/auth', () => authMock)` |
+| `@/lib/auth/hybrid` | `hybridAuthMock`, `hybridAuthMockFns` | `vi.mock('@/lib/auth/hybrid', () => hybridAuthMock)` |
+| `@/lib/copilot/request/http` | `copilotHttpMock`, `copilotHttpMockFns` | `vi.mock('@/lib/copilot/request/http', () => copilotHttpMock)` |
+| `@/lib/core/config/env` | `envMock`, `createEnvMock(overrides)` | `vi.mock('@/lib/core/config/env', () => envMock)` |
+| `@/lib/core/config/env-flags` | `featureFlagsMock` | `vi.mock('@/lib/core/config/env-flags', () => featureFlagsMock)` |
+| `@/lib/core/config/redis` | `redisConfigMock`, `redisConfigMockFns` | `vi.mock('@/lib/core/config/redis', () => redisConfigMock)` |
+| `@/lib/core/security/encryption` | `encryptionMock`, `encryptionMockFns` | `vi.mock('@/lib/core/security/encryption', () => encryptionMock)` |
+| `@/lib/core/security/input-validation.server` | `inputValidationMock`, `inputValidationMockFns` | `vi.mock('@/lib/core/security/input-validation.server', () => inputValidationMock)` |
+| `@/lib/core/utils/request` | `requestUtilsMock`, `requestUtilsMockFns` | `vi.mock('@/lib/core/utils/request', () => requestUtilsMock)` |
+| `@/lib/core/utils/urls` | `urlsMock`, `urlsMockFns` | `vi.mock('@/lib/core/utils/urls', () => urlsMock)` |
+| `@/lib/execution/preprocessing` | `executionPreprocessingMock`, `executionPreprocessingMockFns` | `vi.mock('@/lib/execution/preprocessing', () => executionPreprocessingMock)` |
+| `@/lib/logs/execution/logging-session` | `loggingSessionMock`, `loggingSessionMockFns`, `LoggingSessionMock` | `vi.mock('@/lib/logs/execution/logging-session', () => loggingSessionMock)` |
+| `@/lib/workflows/orchestration` | `workflowsOrchestrationMock`, `workflowsOrchestrationMockFns` | `vi.mock('@/lib/workflows/orchestration', () => workflowsOrchestrationMock)` |
+| `@/lib/workflows/persistence/utils` | `workflowsPersistenceUtilsMock`, `workflowsPersistenceUtilsMockFns` | `vi.mock('@/lib/workflows/persistence/utils', () => workflowsPersistenceUtilsMock)` |
+| `@/lib/workflows/utils` | `workflowsUtilsMock`, `workflowsUtilsMockFns` | `vi.mock('@/lib/workflows/utils', () => workflowsUtilsMock)` |
+| `@/lib/workspaces/permissions/utils` | `permissionsMock`, `permissionsMockFns` | `vi.mock('@/lib/workspaces/permissions/utils', () => permissionsMock)` |
+| `@sim/db/schema` | `schemaMock` | `vi.mock('@sim/db/schema', () => schemaMock)` |
+
+### Auth mocking (API routes)
+
+```typescript
+import { authMock, authMockFns } from '@sim/testing'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+vi.mock('@/lib/auth', () => authMock)
+
+import { GET } from '@/app/api/my-route/route'
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  authMockFns.mockGetSession.mockResolvedValue({ user: { id: 'user-1' } })
+})
+```
+
+Only define a local `vi.mock('@/lib/auth', ...)` if the module under test consumes exports outside the centralized shape (e.g., `auth.api.verifyOneTimeToken`, `auth.api.resetPassword`).
+
+### Hybrid auth mocking
+
+```typescript
+import { hybridAuthMock, hybridAuthMockFns } from '@sim/testing'
+
+vi.mock('@/lib/auth/hybrid', () => hybridAuthMock)
+
+// In tests:
+hybridAuthMockFns.mockCheckSessionOrInternalAuth.mockResolvedValue({
+  success: true, userId: 'user-1', authType: 'session',
+})
+```
+
+### Database chain mocking
+
+Use the centralized `dbChainMock` + `dbChainMockFns` helpers — no `vi.hoisted()` or chain-wiring boilerplate needed.
+
+```typescript
+import { dbChainMock, dbChainMockFns, resetDbChainMock } from '@sim/testing'
+
+vi.mock('@sim/db', () => dbChainMock)
+// Spread for custom exports: vi.mock('@sim/db', () => ({ ...dbChainMock, myTable: {...} }))
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  resetDbChainMock() // only needed if tests use permanent (non-`Once`) overrides
+})
+
+it('reads a row', async () => {
+  dbChainMockFns.limit.mockResolvedValueOnce([{ id: '1', name: 'test' }])
+  // exercise code that hits db.select().from().where().limit()
+  expect(dbChainMockFns.where).toHaveBeenCalled()
+})
+```
+
+**Default chains supported:**
+- `select()/selectDistinct()/selectDistinctOn() → from() → where()/innerJoin()/leftJoin() → where() → limit()/orderBy()/returning()/groupBy()/for()`
+- `insert() → values() → returning()/onConflictDoUpdate()/onConflictDoNothing()`
+- `update() → set() → where() → limit()/orderBy()/returning()/for()`
+- `delete() → where() → limit()/orderBy()/returning()/for()`
+- `db.execute()` resolves `[]`
+- `db.transaction(cb)` calls cb with `dbChainMock.db`
+
+`.for('update')` (Postgres row-level locking) is supported on `where` builders. It returns a thenable with `.limit` / `.orderBy` / `.returning` / `.groupBy` attached, so both `await .where().for('update')` (terminal) and `await .where().for('update').limit(1)` (chained) work. Override the terminal result with `dbChainMockFns.for.mockResolvedValueOnce([...])`; for the chained form, mock the downstream terminal (e.g. `dbChainMockFns.limit.mockResolvedValueOnce([...])`).
+
+All terminals default to `Promise.resolve([])`. Override per-test with `dbChainMockFns.<terminal>.mockResolvedValueOnce(...)`. Use `resetDbChainMock()` in `beforeEach` only when tests replace wiring with `.mockReturnValue` / `.mockResolvedValue` (permanent); tests using only `...Once` variants don't need it.
+
+## @sim/testing Package
+
+Always prefer over local test data.
+
+| Category | Utilities |
+|----------|-----------|
+| **Module mocks** | See "Centralized Mocks" table above |
+| **Logger helpers** | `loggerMock`, `createMockLogger()`, `getLoggerCalls()`, `clearLoggerMocks()` |
+| **Database helpers** | `databaseMock`, `drizzleOrmMock`, `createMockDb()`, `createMockSql()`, `createMockSqlOperators()` |
+| **Fetch helpers** | `setupGlobalFetchMock()`, `createMockFetch()`, `createMockResponse()`, `mockFetchError()` |
+| **Factories** | `createSession()`, `createWorkflowRecord()`, `createBlock()`, `createExecutionContext()` |
+| **Builders** | `WorkflowBuilder`, `ExecutionContextBuilder` |
+| **Assertions** | `expectWorkflowAccessGranted()`, `expectBlockExecuted()` |
+| **Requests** | `createMockRequest()`, `createMockFormDataRequest()` |
+
+## Rules Summary
+
+1. `@vitest-environment node` unless DOM is required
+2. Prefer centralized mocks from `@sim/testing` (see table above) over local `vi.hoisted()` + `vi.mock()` boilerplate
+3. `vi.hoisted()` + `vi.mock()` + static imports — never `vi.resetModules()` + `vi.doMock()` + dynamic imports
+4. `vi.mock()` calls before importing mocked modules
+5. `beforeEach(() => vi.clearAllMocks())` to reset state — no redundant `afterEach`
+6. No `vi.importActual()` — mock everything explicitly
+7. Mock heavy deps (`@/blocks`, `@/tools/registry`, `@/triggers`) in tests that don't need them
+8. Use absolute imports in test files
+9. Avoid real timers — use 1ms delays or `vi.useFakeTimers()`
diff --git a/.claude/rules/sim-typescript.md b/.claude/rules/sim-typescript.md
index 526eefd6499..e381c7d1bbf 100644
--- a/.claude/rules/sim-typescript.md
+++ b/.claude/rules/sim-typescript.md
@@ -1,4 +1,5 @@
 ---
+description: TypeScript conventions and type safety
 paths:
   - "apps/sim/**/*.ts"
   - "apps/sim/**/*.tsx"
diff --git a/.claude/rules/sim-ui-copy.md b/.claude/rules/sim-ui-copy.md
index 951e4a15367..b676483f41f 100644
--- a/.claude/rules/sim-ui-copy.md
+++ b/.claude/rules/sim-ui-copy.md
@@ -1,4 +1,5 @@
 ---
+description: UI copy conventions — no default subtitles or helper text under headings, labels, cards, or settings
 paths:
   - "apps/sim/**/*.tsx"
   - "apps/sim/components/emcn/**"
diff --git a/.claude/rules/sim-url-state.md b/.claude/rules/sim-url-state.md
index 6790bc1b56d..69d8c3aec92 100644
--- a/.claude/rules/sim-url-state.md
+++ b/.claude/rules/sim-url-state.md
@@ -1,4 +1,5 @@
 ---
+description: Shareable client view-state lives in the URL via nuqs
 paths:
   - "apps/sim/app/**/*.tsx"
   - "apps/sim/app/**/*.ts"
diff --git a/.cursor/rules/constitution.mdc b/.cursor/rules/constitution.mdc
index dbce52e5298..9e9a50d2b2b 100644
--- a/.cursor/rules/constitution.mdc
+++ b/.cursor/rules/constitution.mdc
@@ -1,8 +1,10 @@
 ---
-description: Sim product language, positioning, and tone guidelines
-globs: ["apps/sim/app/(landing)/**", "apps/docs/**", "apps/sim/app/manifest.ts", "apps/sim/app/sitemap.ts", "apps/sim/app/robots.ts", "apps/sim/app/llms.txt/**", "apps/sim/app/llms-full.txt/**", "apps/sim/app/(landing)/**/structured-data*", "apps/docs/**/structured-data*", "**/metadata*", "**/seo*"]
+description: "Sim product language, positioning, and tone guidelines"
+alwaysApply: true
 ---
 
+<!-- Generated from .claude/rules/constitution.md by `bun run skills:sync`. Edit the source, not this file. -->
+
 # Sim — Language & Positioning
 
 When editing user-facing copy (landing pages, docs, metadata, marketing), follow these rules.
@@ -28,7 +30,8 @@ Sim is the **AI workspace** where teams build and run AI agents. Not a workflow
 | The product | "AI workspace" | "workflow tool", "automation platform", "agent framework" |
 | Building | "build agents", "create agents" | "create workflows" (unless describing the workflow module specifically) |
 | Visual builder | "workflow builder" or "visual builder" | "canvas", "graph editor" |
-| Mothership | "Mothership" (capitalized) | "chat", "AI assistant", "copilot" |
+| The agent | "Sim" — you talk to Sim | "Mothership", "copilot", "AI assistant" |
+| The chat surface | "Chat" (capitalized, the module) | "Mothership", "copilot" |
 | Deployment | "deploy", "ship" | "publish", "activate" |
 | Audience | "teams", "builders" | "users", "customers" (in marketing copy) |
 | What agents do | "automate real work" | "automate tasks", "automate workflows" |
@@ -55,7 +58,7 @@ When describing Sim, always lead with the most differentiated claim:
 
 | Module | One-liner |
 |--------|-----------|
-| **Mothership** | Your AI command center. Build and manage everything in natural language. |
+| **Chat** | Your AI command center. Talk to Sim — build and manage everything in natural language. |
 | **Workflows** | The visual builder. Connect blocks, models, and integrations into agent logic. |
 | **Knowledge Base** | Your agents' memory. Upload docs, sync sources, build vector databases. |
 | **Tables** | A database, built in. Store, query, and wire structured data into agent runs. |
@@ -70,7 +73,8 @@ When describing Sim, always lead with the most differentiated claim:
 - Never promise unshipped features
 - Never use jargon ("RAG", "vector database", "MCP") without plain-English explanation on public pages
 - Avoid "agentic workforce" as a primary term — use "AI agents"
+- Never say "Mothership" or "copilot" — the agent is "Sim", the surface is "Chat" (in run logs the trigger reads "Sim agent")
 
 ## Vision
 
-Sim becomes the default environment where teams build AI agents — not a tool you visit for one task, but a workspace you live in. Workflows are one module; Mothership is another. The workspace is the constant; the interface adapts.
+Sim becomes the default environment where teams build AI agents — not a tool you visit for one task, but a workspace you live in. Workflows are one module; Chat is another. The workspace is the constant; the interface adapts.
diff --git a/.cursor/rules/emcn-components.mdc b/.cursor/rules/emcn-components.mdc
index e9307f6dccf..1ac5fc577f8 100644
--- a/.cursor/rules/emcn-components.mdc
+++ b/.cursor/rules/emcn-components.mdc
@@ -1,16 +1,19 @@
 ---
-description: EMCN component library patterns
+description: "EMCN component library patterns"
 globs: ["packages/emcn/**"]
 ---
+
+<!-- Generated from .claude/rules/emcn-components.md by `bun run skills:sync`. Edit the source, not this file. -->
+
 # EMCN Components
 
-Import from `@sim/emcn`, never from subpaths (except CSS files). The **chip family** is the platform's primary chrome — always reach for it over the legacy primitives it is progressively replacing (`Input`→`ChipInput`, `Textarea`→`ChipTextarea`, `Modal`→`ChipModal`, `Select`/`Combobox`→`ChipSelect`/`ChipCombobox`/`ChipDropdown`, `Switch`→`ChipSwitch`, date field→`ChipDatePicker`). For context/action menus the canonical control is `DropdownMenu` — the standard menu (not a chip, and never a hand-rolled popover).
+Import components, `cn`, and tokens from the `@sim/emcn` barrel; icons come from the `@sim/emcn/icons` subpath, and CSS modules from their file path. Never deep-import other component subpaths. The **chip family** is the platform's primary chrome — always reach for it over the legacy primitives it is progressively replacing (`Input`→`ChipInput`, `Textarea`→`ChipTextarea`, `Modal`→`ChipModal`, `Select`/`Combobox`→`ChipSelect`/`ChipCombobox`/`ChipDropdown`, `Switch`→`ChipSwitch`, date field→`ChipDatePicker`). For context/action menus the canonical control is `DropdownMenu` — the standard menu (not a chip, and never a hand-rolled popover).
 
 ## Chip chrome — single source of truth
 
 Never hand-roll the chip pill from raw class strings (they go stale). Compose from the canonical sources:
 
-- **Surface, typography + content tokens:** `chip/chip-chrome.ts` — `chipFilledSurfaceTokens`, `chipFieldSurfaceClass`, `chipFieldTextClass` (text fields and the dropdown search box build on these), plus the chip-content chrome `chipContentGap`, `chipGeometryClass`, `chipContentIconClass`, `chipContentLabelClass`, and `cellIconNodeClass` (non-chip surfaces that must visually match chip content, e.g. resource table cells). All are re-exported from the `@sim/emcn` barrel — no subpath import needed.
+- **Surface, typography + content tokens:** `chip/chip-chrome.ts` — `chipFilledSurfaceTokens`, `chipFieldSurfaceClass`, `chipFieldTextClass` (text fields and the dropdown search box build on these), plus the chip-content chrome `chipContentGap`, `chipGeometryClass`, `chipContentIconClass`, `chipContentLabelClass`, `cellIconNodeClass` (non-chip surfaces that must visually match chip content, e.g. resource table cells), and the row-state pair `chipHoverSurfaceClass` / `chipActiveSurfaceClass` (hover vs. selected — mutually exclusive, so a selected row holds its surface through hover; every hand-rolled row imports these rather than restating the literals). All are re-exported from the `@sim/emcn` barrel — no subpath import needed.
 - **Pill geometry:** `chip/chip.tsx` — `chipVariants` (30px tall, `rounded-lg`, `px-2`, icon↔text `gap-1.5`). Every pill-shaped trigger (`ChipDropdown`, `ChipSelect`, `ChipSwitch`) reuses it for visual parity.
 
 Canonical look: normal font-weight (never `font-medium`/`font-semibold`), value text `--text-body`, icons `--text-icon` at `size-[14px]`, placeholder `--text-muted`, `transition-colors`, **no focus ring** (the caret marks focus). Filled surface is `--surface-5` light / `--surface-4` dark with a `--border-1` border.
@@ -19,16 +22,30 @@ The menu surface intentionally diverges from the pill: `dropdown-menu.tsx` items
 
 ## Component catalogue
 
-- **`Chip` / `ChipLink`** — the pill button (`<button>` / Next `<Link>`). Variants: `primary`, `destructive`, `border-shadow`, `border`; the bare chip is implicit (omit `variant`). `filled` is deliberately NOT a `Chip` variant — it is reserved for chip fields/triggers. For a selected/toggle chip use the `active` prop, never a variant. `leftIcon`/`rightIcon`, `active`, `fullWidth`. Chips carry **no outer margin** — space between them is the parent's `gap`. The old `mx-0.5` default and its `flush` opt-out are gone; do not reintroduce either, and never add a margin to a chip through `className`.
+- **`Chip` / `ChipLink`** — the pill button (`<button>` / Next `<Link>`). Variants: `primary`, `destructive`, `border-shadow`, `border`, `outline` (a true `--border` border, no shadow or hover fill); the bare chip is implicit (omit `variant`). `filled` is deliberately NOT a `Chip` variant — it is reserved for chip fields/triggers. For a selected/toggle chip use the `active` prop, never a variant. `leftIcon`/`rightIcon`, `active`, `fullWidth`. Chips carry **no outer margin** — space between them is the parent's `gap`. The old `mx-0.5` default and its `flush` opt-out are gone; do not reintroduce either, and never add a margin to a chip through `className`.
 - **`ChipInput`** — single-line text field. `icon`, `endAdornment`, `error`, `inputClassName` (inner `<input>`); `className` styles the chrome wrapper.
-- **`ChipTextarea`** — multi-line sibling. `error`, `resizable` (off by default).
+- **`ChipCopyInput`** — the canonical view-only field: a read-only `ChipInput` at full opacity with a trailing copy-to-clipboard button. View-only is a display mode, not a disabled state — reach for it (or `ChipModalField type='copy'`) over a `disabled` (greyed) input for values the user cannot edit.
+- **`ChipTextarea`** — multi-line sibling. `error`, `resizable` (off by default), `viewOnly` (read-only at full opacity with the default cursor — the multi-line counterpart of `ChipCopyInput`).
 - **`ChipDropdown`** — pill that opens a menu. Single OR multi-select via the discriminated `multiple` prop (one component, not two). Owns its trailing chevron — no `rightIcon`.
 - **`ChipSelect` / `ChipCombobox`** — `Combobox`-backed pickers with search, groups, multi-select; for richer lists than `ChipDropdown`.
-- **`ChipModal` + `ChipModalField`** — declarative compact modal. The field's `type` (`input` | `email` | `textarea` | `dropdown` | `file` | `emails` | `custom`) picks the control and **owns all chrome** — consumers describe intent, never pass `variant`/`className`/`id` to the inner control. `custom` is the escape hatch. **Every body field MUST be a `ChipModalField`** — never hand-roll a field row (raw `<div>` + hand-rolled `<p>`/`<label>` title + bare `ChipInput`/`ChipTextarea`). `ChipModalBody` applies `px-2` + `gap-4`; `ChipModalField` adds another `px-2`, so each field lands at effective `px-4`, exactly matching the `px-4` header/footer — a hand-rolled row skips that gutter and sits misaligned at `px-2`. For controls the field doesn't cover (`ChipCombobox`, `ChipSelect`, `DatePicker`, `TimePicker`, `ButtonGroup`, arbitrary JSX), use `type='custom'` with a `title` — it still applies the gutter and renders the canonical `Label`.
+- **`ChipModal` + `ChipModalField`** — declarative compact modal. The field's `type` (`input` | `email` | `textarea` | `dropdown` | `copy` | `file` | `emails` | `custom`) picks the control and **owns all chrome** — consumers describe intent, never pass `variant`/`className`/`id` to the inner control. `custom` is the escape hatch. **Every body field MUST be a `ChipModalField`** — never hand-roll a field row (raw `<div>` + hand-rolled `<p>`/`<label>` title + bare `ChipInput`/`ChipTextarea`). `ChipModalBody` applies `px-2` + `gap-4`; `ChipModalField` adds another `px-2`, so each field lands at effective `px-4`, exactly matching the `px-4` header/footer — a hand-rolled row skips that gutter and sits misaligned at `px-2`. For controls the field doesn't cover (`ChipCombobox`, `ChipSelect`, `DatePicker`, `TimePicker`, `ButtonGroup`, arbitrary JSX), use `type='custom'` with a `title` — it still applies the gutter and renders the canonical `Label`.
 - **`ChipSwitch`** — segmented pill control (built from `chipVariants`).
 - **`ChipTag`** — 20px inline tag/badge (`mono`/`gray`/`invite`), not a pill trigger.
 - **`ChipDatePicker`** — chip-styled date field.
+- **`ChipTimePicker`** — minute-granular time sibling of `ChipDatePicker`, a `ChipInput` that leniently parses typed input (`9:47`, `947`, `2:05pm`, `14:30`), commits on Enter/blur, and re-renders the canonical `9:47 AM` label.
 - **`DropdownMenu`** — the canonical context/action menu (Radix-backed). Not a chip, but the standard menu for command/action lists; reach for it instead of a hand-rolled popover. Its surface intentionally diverges from the chip pill (`text-small`, `gap-2`) — keep them distinct. For a pill that opens a value picker, use `ChipDropdown`/`ChipSelect` instead.
+- **`useScrollEdges` + `scrollFadeClass` / `scrollFadeAttributes`** — the canonical scroll-region edge treatment. The hook reports which edges hide content (tracking scroll and resizes; pass the element itself, held in state, when the region mounts after its owner, e.g. inside a Radix portal); the class and attributes fade a fixed 12px band at an active edge only, so a list that fits or sits at its top is never fogged. A floating control over the top edge sets `--scroll-fade-inset` to its height. A region that scrolls sideways (a tab row, a chip strip) uses `useScrollEdges(ref, { axis: 'x' })` with `scrollFadeXClass`; the attributes helper is shared. Any divider beside the region belongs to the neighboring block (`border-b` above, `border-t` below), never to the masked element, and shows only while that edge is active. Never hand-roll a `mask-image` gradient for a scroll region.
+- **`OverflowText`** — the canonical single-line overflow treatment for read-only human labels and titles. It owns `min-w-0`, fade-only clipping (never an ellipsis), the conditional 18px edge mask, and the full-value floating tooltip; consumers pass only layout/typography through `className`. `overflowTextClipClass` and `overflowTextFadeClass` are the complete base/faded treatments for the rare component that must own measurement itself; never pair either with `truncate`, `text-ellipsis`, or hover-time mask removal. Use `DropdownMenuItemLabel` for a menu label beside icons, checks, or actions. A non-editable `Combobox` passes the full visual value through `overlayLabel`; the combobox owns the visual overlay's fade and keeps its one accessible tooltip on the interactive layer. Keep ordinary `truncate` only for editable values, code/log/path content, dense or virtualized grids, and rich composite content that cannot supply a plain tooltip label. Multiline copy uses an intentional `line-clamp-*` treatment instead.
+
+## Modal keyboard defaults
+
+Declare keyboard intent on the action-owning primitive; never add document-level or per-callsite Enter listeners.
+
+- `ChipModalFooter` defaults to `defaultAction='primary'`. A plain Enter in a canonical single-line field or a custom plain input invokes the enabled primary action. Use `'none'` when submission must require an explicit click, such as an irreversible destructive action or an editor whose nested control owns Enter. Use `'dismiss'` only when dismissal is genuinely the modal's default decision.
+- `ChipConfirmModal` fails safe with `defaultAction='dismiss'`. Opt into `'confirm'` only for an audited, low-impact reversible or non-destructive decision. Deleting an aggregate resource such as a workflow, table, knowledge base, or folder remains `'dismiss'` even when it can be restored, because the action takes a broad dependent graph offline. Use `'none'` for typed confirmations and severe account, ownership, or access changes. Button color never determines keyboard behavior.
+- Textareas, native forms, buttons, links, comboboxes, menus, listboxes, tag/email inputs, IME composition, modified Enter, and disabled or pending actions retain their native behavior. A native form remains the sole submission path so browser validation is not bypassed.
+- A custom field containing a search, token editor, or another input that owns Enter must set `submitOnEnter={false}` on `ChipModalField`. Do not attach a duplicate `onKeyDown` handler merely to call the footer action.
+- Initial focus goes to the first visible editable text control. With no text control, the declared real button receives focus; `'none'` focuses the dialog surface. A safe dismiss default never turns Enter in a text field into data loss—the field simply does not publish a submit action.
 
 ## Authoring principles
 
diff --git a/.cursor/rules/global.mdc b/.cursor/rules/global.mdc
index 5535b598224..09c1388c196 100644
--- a/.cursor/rules/global.mdc
+++ b/.cursor/rules/global.mdc
@@ -1,7 +1,10 @@
 ---
-description: Global coding standards that apply to all files
+description: "Global coding standards that apply to all files"
 alwaysApply: true
 ---
+
+<!-- Generated from .claude/rules/global.md by `bun run skills:sync`. Edit the source, not this file. -->
+
 # Global Standards
 
 ## Logging
@@ -72,5 +75,15 @@ const clone = structuredClone(obj)
 const filtered = filterUndefined(obj)
 ```
 
+## Deployment flags in the browser
+Client code inside a workspace reads `hosted`, `billingEnabled`, `chatEnabled`, and the enterprise feature set through `useDeploymentShape()` (components) or `getDeploymentShape()` (block conditions, stores, helpers) from `@/lib/core/config/deployment-shape`, never the `isHosted`/`isBillingEnabled` constants from `env-flags`. Those constants freeze at module init from the root layout's `NEXT_PUBLIC_*` transport, which Next's bare 404 shell and `global-error` never emit, so a tab recovered from one would render Sim Cloud as self-hosted. The reader is seeded from the server-resolved workspace host context. Server code keeps reading `env-flags`.
+
 ## Package Manager
 Use `bun` and `bunx`, not `npm` and `npx`.
+
+## Type-checking
+`tsc` must resolve to the native (Go) TypeScript 7 compiler. Do not remove the `@typescript/native` alias from the root `devDependencies` — nothing imports it, and deleting it looks harmless.
+
+`apps/sim` needs `@typescript/typescript6` for its runtime TypeScript API, and that package depends on `@typescript/old` — an alias of `typescript@6` — which declares its own `tsc` bin. Package managers pick bin winners by lexical sort rather than dependency depth, so `@typescript/old` beats `typescript` and `node_modules/.bin/tsc` silently becomes the JavaScript TypeScript 6 compiler: identical diagnostics, ~10x slower (83s vs 8s on `apps/sim`). The `@typescript/native` alias exists only to sort ahead of `@typescript/old`.
+
+`bun run check:native-typecheck` fails the build if a bare `tsc` stops reporting 7.x — which is also what a newly added package that sorts ahead of `@typescript/native` and ships a `tsc` bin would look like. See [microsoft/typescript-go#4567](https://github.com/microsoft/typescript-go/issues/4567).
diff --git a/.cursor/rules/landing-seo-geo.mdc b/.cursor/rules/landing-seo-geo.mdc
index c078b175d22..28715512a07 100644
--- a/.cursor/rules/landing-seo-geo.mdc
+++ b/.cursor/rules/landing-seo-geo.mdc
@@ -1,7 +1,10 @@
 ---
-description: SEO and GEO guidelines for the landing page
-globs: ["apps/sim/app/(landing)/**/*.tsx"]
+description: "SEO and GEO guidelines for the landing page"
+globs: ["apps/sim/app/(landing)/**/*.tsx","apps/sim/content/**/*.mdx"]
 ---
+
+<!-- Generated from .claude/rules/landing-seo-geo.md by `bun run skills:sync`. Edit the source, not this file. -->
+
 # Landing Page — SEO / GEO
 
 ## SEO
@@ -20,6 +23,25 @@ globs: ["apps/sim/app/(landing)/**/*.tsx"]
 - **Answer-first pattern**: each section's H2 + subtitle should directly answer a user question (e.g. "What is Sim?", "How fast can I deploy?").
 - **Atomic answer blocks**: each feature / template card should be independently extractable by an AI summariser.
 - **Entity consistency**: always write "Sim" by name — never "the platform" or "our tool".
-- **Keyword density**: first 150 visible chars of Hero must name "Sim", "AI workspace", "AI agents".
+- **Keyword density**: first 150 visible chars of Hero must name "AI workspace" and "AI agents". "Sim" is carried by the title tag, the meta description, and the Hero `sr-only` summary — the H1 does not have to spend its opening words on the brand.
 - **sr-only summaries**: Hero and Templates each have a `<p className="sr-only">` (~50 words) as an atomic product/catalog summary for AI citation.
 - **Specific numbers**: prefer concrete figures ("1,000+ integrations", "15+ AI providers") over vague claims.
+
+## Citations and linking (`/library`, `/blog`, `/comparisons`)
+
+The Princeton GEO study (Aggarwal et al., KDD 2024, [arXiv:2311.09735](https://arxiv.org/abs/2311.09735)) found that adding citations, quotations, and statistics were the three strongest of nine tested tactics, worth 30–40% relative lifts in AI-answer visibility. Sourcing is also what makes a claim checkable by a human reader.
+
+- **Every third-party factual claim carries an outbound source link.** Pricing, rate limits, feature availability, licensing, compliance certifications — link the primary source (the vendor's own pricing page, docs, changelog, or license file), not a secondary blog. External links get `rel="noopener noreferrer"`.
+- **Prefer the primary source over a roundup.** Citing another vendor's comparison post to substantiate a fact about them is second-hand and ages badly.
+- **Internal links: 3–5 per library post**, pointing at genuinely related library entries, using real `href`s (Next `<Link>` in TSX; a plain markdown link in MDX). A post with zero internal links is a dead end for crawlers and readers alike.
+- **Never fabricate a citation.** An unlinked claim is better than a link that does not substantiate it. If a number cannot be sourced, cut the number.
+
+## Freshness
+
+Answer engines weight recency to avoid repeating stale facts, and a reader deciding whether to trust a pricing comparison wants to know when it was last checked. The vendor-published "fresh content earns Nx more citations" figures are directional, not measured — the reason to do this is that both signals must agree and both must be real.
+
+- **Emit `dateModified`** in the page's structured data (JSON-LD or microdata), and emit it exactly once per document.
+- **Show the same date to the reader.** `/comparisons/[provider]` renders "Last verified …" from `getLatestVerifiedDate()`; `/library` and `/blog` posts render "Updated …" next to the publish date. A date that exists only in metadata is invisible to a reader deciding whether to trust the page.
+- **Only surface a modified date when it differs from the publish date** — an "Updated" label on the publish day is noise.
+- **Bump the date only on a substantive edit.** Touching frontmatter without changing the content is date-washing; it degrades the signal for every other page on the domain.
+- **Comparison facts are dated at the fact level.** Every `Fact` in `apps/sim/lib/compare/data` carries `sources: [{ url, label, asOf }]`. Re-checking a fact means updating its `asOf`, which flows through `getLatestVerifiedDate()` to the visible date, the JSON-LD, and the sitemap.
diff --git a/.cursor/rules/sim-architecture.mdc b/.cursor/rules/sim-architecture.mdc
index af712e4fa6a..01aa90bf5db 100644
--- a/.cursor/rules/sim-architecture.mdc
+++ b/.cursor/rules/sim-architecture.mdc
@@ -1,7 +1,10 @@
 ---
-description: Core architecture principles for the Sim app
+description: "Core architecture principles for the Sim app"
 globs: ["apps/sim/**"]
 ---
+
+<!-- Generated from .claude/rules/sim-architecture.md by `bun run skills:sync`. Edit the source, not this file. -->
+
 # Sim App Architecture
 
 ## Core Principles
@@ -52,6 +55,35 @@ Ordinary internal and v2 routes use the shared JSON/binary route builders. Those
 
 Use the `migrate-application-operation` skill before creating or migrating a protected endpoint, tool command, or resource method.
 
+## The `'use client'` server boundary
+
+Every export of a `'use client'` module becomes a *client reference* on the server — server-evaluated code (RSC pages/layouts, `prefetch.ts`, route handlers, block definitions, triggers) can only *render* it as a component or pass it as a prop, never *call* it (doing so throws at runtime, e.g. `tableKeys.list is not a function`; `next build` does not catch it). Keep server-importable query primitives (key factories, fetchers, mappers, constants) in non-`'use client'` modules — see `.claude/rules/sim-queries.md`. Enforced by `scripts/check-client-boundary-imports.ts`.
+
+## The app/worker runtime boundary
+
+Server code runs in two runtimes with **different environments**. The app container loads the
+full env from `SIM_ENV_SECRET_ID` (Secrets Manager). Trigger.dev workers — which execute
+workflows, so every block handler and every tool call — get their env from the Trigger.dev
+dashboard; `trigger.config.ts` additionally syncs `DB_APP_NAME`, `TRIGGER_DEV_ENABLED`, and the
+`FUNCTION_EXECUTION_ENV` vars. The repo cannot see what the dashboard holds.
+
+So before replacing a worker's HTTP call to our own API with an in-process call, ask what env
+that work reads *on the app side*. Anything gated by a `require*Capability` helper is the sharp
+case: those **throw** when the variable is absent (`requireOAuthClientCapability` →
+`EnvCapabilityConfigurationError`), and the throw may be caught and reported as something
+unrelated — an in-worker OAuth refresh missing a provider's client pair reports every expired
+credential as `Failed to refresh access token`, while a still-valid token hides the bug until it
+lapses. The required step before such a conversion is verifying the dashboard env holds every
+variable the moved code reads (for OAuth refresh: the `OAUTH_CLIENT_CAPABILITIES` key pairs in
+`packages/deployment-config/src/env-capabilities.ts`).
+
+An in-process conversion is safe when the same work already runs in that runtime (the agent
+block has always called `executeProviderRequest` in-process, so router and evaluator joining it
+is proven; connector sync refreshing OAuth tokens in-worker is what proved credential-token
+resolution could move in-process), or when the caller and the callee are both the app (a route
+calling a lib module, an RSC prefetch reading the data layer). It is not safe on reasoning
+alone — verify the env, then convert.
+
 ## Feature Organization
 
 Features live under `app/workspace/[workspaceId]/`:
diff --git a/.cursor/rules/sim-caching.mdc b/.cursor/rules/sim-caching.mdc
new file mode 100644
index 00000000000..dc4a204f5c3
--- /dev/null
+++ b/.cursor/rules/sim-caching.mdc
@@ -0,0 +1,98 @@
+---
+description: "In-process caching with lru-cache and a ceiling, never hand-rolled TTL maps"
+globs: ["apps/sim/lib/**/*.ts","apps/sim/providers/**/*.ts","apps/sim/executor/**/*.ts","apps/sim/tools/**/*.ts"]
+---
+
+<!-- Generated from .claude/rules/sim-caching.md by `bun run skills:sync`. Edit the source, not this file. -->
+
+# In-Process Caching
+
+**Never hand-roll TTL arithmetic.** `lru-cache` is a direct dependency of `apps/sim` and owns
+expiry, the ceiling, and — through `fetchMethod` — request coalescing. A
+`Map` plus `Date.now() - entry.fetchedAt < TTL` re-implements all three, badly.
+
+## First decide whether it is a cache at all
+
+Most module-level `Map`s in this codebase are **not** caches, and forcing them into one is worse
+than leaving them alone.
+
+| Shape | Key dies when | Right tool |
+| --- | --- | --- |
+| **Lifecycle map** — `activeStreams`, `pendingChildRuns`, `memoryStreams`, `handlerRegistry` | the tracked thing ends, and the code deletes it there | plain `Map`. No TTL, no ceiling. |
+| **TTL cache** — a remote read keyed by tenant (org id, user id, workspace id) | time passes | `LRUCache` |
+
+A lifecycle map's key space is unbounded and that is fine, because every key has a defined death.
+Adding a TTL to one introduces an expiry that races the lifecycle. Adding a ceiling silently drops
+live state.
+
+## TTL caches: always set `max`
+
+```ts
+const policyCache = new LRUCache<string, ResolvedSessionPolicy>({
+  max: 20_000,
+  ttl: SESSION_POLICY_CACHE_TTL_MS,
+})
+```
+
+`ttl` alone does **not** bound memory. Without `ttlAutopurge` (itself expensive — one timer per
+entry) an expired entry lingers until something touches its key or the ceiling evicts it. `max` is
+what actually caps the process, which is why a tenant-keyed `Map` grew for the life of the process
+before this rule existed.
+
+**The ceiling is a memory backstop, not an operating limit.** Exceeding it makes the LRU evict
+*inside* the TTL, so each miss becomes one more read — never a wrong answer, it degrades to exactly
+the pre-cache behavior, but it is a hit-rate cliff on whatever path the cache sits on. Entries are
+tens of bytes, so set the cap far above any plausible per-instance working set within the TTL
+window and let it stay a backstop.
+
+**Reads test `!== undefined`, not truthiness**, whenever the value can be `false`, `0`, or `null`.
+`if (cached)` on a cached `false` re-queries on every single call, for exactly the tenants the
+cache exists to protect.
+
+## Async read-through: prefer `fetchMethod`
+
+`fetchMethod` + `cache.fetch(key)` gives TTL, coalescing (concurrent callers share one promise),
+and eviction-on-rejection (`noDeleteOnFetchRejection` defaults to `false`) in one primitive. Reach
+for it before composing anything yourself.
+
+**The one reason to compose instead: a hung producer.** `fetchMethod` has no settle deadline, and
+the app pool sets no `statement_timeout` (`packages/db/db.ts` sets only `connect_timeout` /
+`idle_timeout`, neither of which bounds a query already in flight). Where a wedged read would hold
+every caller for the whole TTL, wrap `coalesceLocally` from `@/lib/concurrency/singleflight` around
+a read-through `LRUCache` instead — it evicts and rejects at its deadline. See
+`lib/api-key/byok-entitlement.ts`, and `lib/oauth/credential-service.ts` for the same shape.
+
+Do **not** build a house wrapper over `lru-cache`. Call sites differ in ways a thin helper cannot
+hold (synchronous memoization with `updateAgeOnGet` in `providers/client-cache.ts`, per-entry TTLs
+in `lib/auth/security-policy.ts`), so a wrapper covering the common case just adds a fourth pattern.
+
+## Cache the gate, never the credential
+
+Entitlements, plans, and policies tolerate bounded staleness **in the safe direction** — a lapsed
+organization keeping its own provider key for another minute costs a little metering and charges
+nobody wrongly. Key material does not: revocation has to be immediate, so
+`getBYOKKey` reads key rows fresh on every call and caches only the entitlement around them.
+
+An outage must not be cached as a negative answer. A resolver that maps a failed read to `false`
+makes an outage indistinguishable from a real lapse, so give it an `onError: 'throw'` option and
+write the cache only on the success path — see `resolveOrganizationPlan`.
+
+**Where a human is waiting, read fresh.** Keep two entry points rather than one cached function:
+the settings surfaces and management use cases must not tell an organization that just upgraded
+that it still lacks a plan, while the execution path underneath can serve from cache
+(`isOrganizationBYOKEntitled` vs `isOrganizationBYOKEntitledCached`).
+
+## React `cache()` does nothing in a worker
+
+`cache()` is request-scoped. Workflows run in Trigger.dev workers, which have no React request
+scope, so a `cache()`-wrapped gate that looks free on a settings page is uncached and per-block on
+the execution path. Anything reached from the executor needs a real cache — see
+`.claude/rules/sim-architecture.md`'s app/worker runtime boundary.
+
+## Invalidation
+
+Add a per-key invalidator only when the code that mutates the value runs in the **same process**
+that reads it. `invalidateSessionPolicyCache` works because the route writing the policy is the one
+serving the reads. An entitlement change arriving on a Stripe webhook lands in one process while
+the readers are per-worker, so an invalidator there would imply an immediacy it cannot deliver —
+the TTL is the real mechanism, and the absence of an invalidator should say so.
diff --git a/.cursor/rules/sim-components.mdc b/.cursor/rules/sim-components.mdc
index 8ff932e6a61..4d93ea5484b 100644
--- a/.cursor/rules/sim-components.mdc
+++ b/.cursor/rules/sim-components.mdc
@@ -1,7 +1,10 @@
 ---
-description: Component patterns and structure for React components
+description: "Component patterns and structure for React components"
 globs: ["apps/sim/**/*.tsx"]
 ---
+
+<!-- Generated from .claude/rules/sim-components.md by `bun run skills:sync`. Edit the source, not this file. -->
+
 # Component Patterns
 
 Component authoring rules — structure order (refs → external hooks → store hooks → custom hooks → state → useMemo → useCallback → useEffect → return), required props interface, and extraction thresholds (50+ lines / 2+ files vs keep inline < 10 lines) — live in CLAUDE.md > Components.
@@ -11,3 +14,22 @@ Component authoring rules — structure order (refs → external hooks → store
 - `'use client'` only when using React hooks or browser-only APIs.
 - Prefer semantic HTML (`aside`, `nav`, `article`).
 - Optional-chain callbacks: `onAction?.(id)`.
+
+## List-render performance
+
+When rendering or sorting a list of rows against a lookup collection (members, folders, tags), keep the per-row work O(1):
+
+- **Precompute a lookup `Map` once**, never `array.find(...)` per row. Build `const byId = useMemo(() => { const m = new Map<string, T>(); for (const x of items ?? []) m.set(x.id, x); return m }, [items])` and read `byId.get(id)` in the sort comparator, `.map(...)`, and cell builders. A `.find` inside a sort comparator is O(n²·log n) — the worst offender. Depend memos on the derived `Map`, not the raw array.
+- **Sort with `[...array].sort(cmp)` in client code — NOT `array.toSorted(cmp)`.** SWC (Next's compiler) transforms syntax but does not polyfill prototype methods, and the repo sets no core-js/browserslist target, so `toSorted`/`toReversed`/`toSpliced`/`Array.prototype.with` ship as-is and throw `TypeError` on Safari <16 / iOS 15 (they landed in Safari 16). `tsconfig` `lib: ES2023` only affects type-checking, never the runtime. The `[...arr].sort()` spread copy is the intended cost — it keeps the sort non-mutating without an unpolyfilled builtin. These methods are only safe in server-only modules (no `'use client'`, executed on Node ≥20). react-doctor's `js-tosorted-immutable` is therefore a won't-fix in client components.
+- **Partition in a single pass** — when splitting one collection into several (`fileIds`/`folderIds`), do one `for…of` pushing into each bucket and return `{ a, b }` from a single `useMemo`, not two memos that each `map→filter→map` the same source twice.
+
+## react-doctor (`npx react-doctor`) — apply the wins, skip the false positives
+
+react-doctor diagnostics are hypotheses, not verdicts — confirm against the code before acting, and preserve behavior. Known repo-specific false positives to NOT "fix":
+
+- `no-barrel-import` — barrel imports are the repo convention (see sim-imports.md, "Barrel Exports"). Keep them.
+- `js-tosorted-immutable` — in `'use client'` code, keep `[...arr].sort(cmp)`; `toSorted` is unpolyfilled and crashes Safari <16 / iOS 15 (see "List-render performance" above). Only apply it in server-only modules.
+- `rerender-state-only-in-handlers` / "state set but never rendered" — a false positive when the `useState` is consumed by a `useEffect`/`useLayoutEffect` dependency (the effect must re-run on change). Only convert to a ref when nothing reads the value reactively.
+- `no-render-in-render` — a helper *called inline* (`{renderRow()}`) is reconciled by position and does **not** remount, so extracting it to a component is usually pure churn and can regress behavior (prop-drilling many closures, focus/scroll loss on the inner `<input>`). Apply it only when the helper is genuinely a *component defined during render*, or when the move is mechanical (a stateless, ref-free helper whose closures become a small, explicit prop set).
+- `async-await-in-loop` on an upload/progress loop where sequential execution is intentional (per-item progress, server backpressure) — leave it.
+- Broad refactors (`prefer-useReducer` for many `useState`, `no-giant-component` splits) — out of scope for a perf pass; note, don't churn.
diff --git a/.cursor/rules/sim-hooks.mdc b/.cursor/rules/sim-hooks.mdc
index 53e14437177..93d1d87238d 100644
--- a/.cursor/rules/sim-hooks.mdc
+++ b/.cursor/rules/sim-hooks.mdc
@@ -1,7 +1,10 @@
 ---
-description: Custom hook patterns and best practices
-globs: ["apps/sim/**/use-*.ts", "apps/sim/**/hooks/**/*.ts"]
+description: "Custom hook patterns and best practices"
+globs: ["apps/sim/**/use-*.ts","apps/sim/**/hooks/**/*.ts"]
 ---
+
+<!-- Generated from .claude/rules/sim-hooks.md by `bun run skills:sync`. Edit the source, not this file. -->
+
 # Hook Patterns
 
 ## Structure
@@ -46,3 +49,27 @@ export function useFeature({ id, onSelect }: UseFeatureProps) {
 4. Wrap returned functions in useCallback
 5. Server data goes through React Query (`hooks/queries/`), never `useState` + `fetch`
 6. Keep only UI/orchestration state in these hooks
+
+## State shape
+
+Never mirror a prop into state with `useState(prop)` + a syncing `useEffect` — a prop change clobbers in-progress local edits. Use the prop directly, reset via a remount `key`, or — when you must seed local state from a prop only on a transition (e.g. a modal opening) — adjust it **during render** with a `prev`-value tracker held in `useState`:
+
+```typescript
+const [prevOpen, setPrevOpen] = useState(open)
+if (prevOpen !== open) {
+  setPrevOpen(open)
+  if (open) setName(initialName) // closed → open only
+}
+```
+
+React re-renders immediately with the corrected state without committing the stale value. Rules: the `if (prev !== current)` guard is mandatory (an unconditional `setState` in render loops forever), the tracker is set **inside** the guard, and you may only set the currently-rendering component's state this way. Hold the tracker in `useState`, **not a `useRef`** — React forbids reading/writing `ref.current` during render (react.dev, useRef → "Do not write _or read_ `ref.current` during rendering"; the `react-hooks` `refs` lint flags it), and a `useState` tracker is concurrent-safe where a mutated ref is not (a discarded render rolls state back, not a ref).
+
+**The tracker's initial value decides mount behavior — choose it deliberately.** The example seeds `useState(open)` because the modal mounts closed, so the first render's guard is `false` and nothing resets on mount (correct — `name` is already at its initial value). When the effect you're replacing did real work **on mount** — opening a panel because a prop already matches, seeding editable state from an already-present value, or a component that can mount in the active state — seed a **sentinel** the live value can't equal (e.g. `useState<T | null>(null)`), otherwise the guard is `false` on the first render and that mount action is silently dropped. Place the block before any early `return`.
+
+> Some existing components use a `useRef` prev-tracker (`if (prevRef.current !== x) { prevRef.current = x; … }`). It works but reads/writes a ref during render — prefer the `useState` form above for new code.
+
+Only convert a `useState` to a `useRef` when the value is **never read during render/JSX and is never a hook dependency** — a value in a `useEffect`/`useMemo`/`useCallback` dep array must re-run the hook on change, so it stays state (see also `rerender-state-only-in-handlers` in `sim-components.md`). Convert only set-only values read solely inside handlers or effect bodies (e.g. a prompt-history index, a pending-upload URL). If a ref feeds render, mutating it won't re-render and the UI goes stale.
+
+Model mutually-exclusive flags as ONE `status` enum, not several contradictory booleans. `isLoading`/`isVerified`/`isInvalidOtp` describing one machine collapse to `status: 'idle' | 'verifying' | 'verified' | 'error'` (+ `errorMessage`); derive any boolean a consumer still needs (`status === 'error'`).
+
+Derive busy/success from the mutation object — never duplicate `mutation.isPending`/`mutation.isSuccess` into local `useState`. Read them directly (`mutation.isSuccess`) and reset with `mutation.reset()`. A distinct phase the mutation doesn't cover — e.g. a pre-submit captcha/Turnstile gate that runs before `mutate()` — is not a duplicate; keep that flag.
diff --git a/.cursor/rules/sim-imports.mdc b/.cursor/rules/sim-imports.mdc
index 230d0acfeb6..19da378bccf 100644
--- a/.cursor/rules/sim-imports.mdc
+++ b/.cursor/rules/sim-imports.mdc
@@ -1,8 +1,10 @@
 ---
-description: Import patterns for the Sim application
-globs: ["apps/sim/**/*.ts", "apps/sim/**/*.tsx"]
+description: "Import patterns for the Sim application"
+globs: ["apps/sim/**/*.ts","apps/sim/**/*.tsx"]
 ---
 
+<!-- Generated from .claude/rules/sim-imports.md by `bun run skills:sync`. Edit the source, not this file. -->
+
 # Import Patterns
 
 ## Absolute Imports
@@ -30,6 +32,20 @@ import { Dashboard, Sidebar } from '@/app/workspace/[workspaceId]/logs/component
 import { Dashboard } from '@/app/workspace/[workspaceId]/logs/components/dashboard/dashboard'
 ```
 
+## Code-splitting through barrels
+
+When you `lazy(() => import(...))` a component to keep it out of a route's initial bundle, import the **deep module path** (`./components/foo/foo`), never the barrel — and **delete the now-dead barrel re-export** of that component. This app has no `"sideEffects": false` in `apps/sim/package.json`, so when any sibling still imports that barrel, webpack can conservatively keep the barrel's re-export edge to the heavy module. A leftover `export { Foo } from './foo'` line can therefore drag `Foo` (and its transitive deps) back into the initial chunk and silently defeat the split. Removing the dead re-export is the guaranteed fix; verify with a production bundle diff, not by eyeballing the `lazy()` call.
+
+```typescript
+// ✓ Good — deep lazy import + no barrel edge left behind
+const MothershipView = lazy(() =>
+  import('./components/mothership-view/mothership-view').then((m) => ({ default: m.MothershipView }))
+)
+// (and remove `export { MothershipView } from './mothership-view'` from components/index.ts)
+```
+
+Wrap the lazy component in a **local `<Suspense>`** so its suspension resolves at the nearest boundary instead of bubbling to the page-level fallback (which would flash the whole route). `React.lazy(memo(forwardRef(...)))` forwards a DOM `ref` correctly in React 19 — but during the fallback window `ref.current` is `null`, so every consumer must guard it (`if (!el) return` / `el?.`).
+
 ## No Re-exports
 
 Do not re-export from non-barrel files. Import directly from the source.
diff --git a/.cursor/rules/sim-integrations.mdc b/.cursor/rules/sim-integrations.mdc
index ca3ad54a886..b0d1a091c8a 100644
--- a/.cursor/rules/sim-integrations.mdc
+++ b/.cursor/rules/sim-integrations.mdc
@@ -1,7 +1,10 @@
 ---
-description: Adding new integrations (tools, blocks, triggers)
-globs: ["apps/sim/tools/**", "apps/sim/blocks/**", "apps/sim/triggers/**"]
+description: "Adding new integrations (tools, blocks, triggers)"
+globs: ["apps/sim/tools/**","apps/sim/blocks/**","apps/sim/triggers/**"]
 ---
+
+<!-- Generated from .claude/rules/sim-integrations.md by `bun run skills:sync`. Edit the source, not this file. -->
+
 # Adding Integrations
 
 Build order: **Tools** (`tools/{service}/`) → **Block** (`blocks/blocks/{service}.ts`) → **Icon** (`components/icons.tsx`) → optional **Trigger** (`triggers/{service}/`). Always look up the service's API docs first.
@@ -12,5 +15,7 @@ The full authoring instructions — tool/block/icon/trigger scaffolding, SubBloc
 
 - Tool IDs are `snake_case` (`service_action`). Register tools in `tools/registry.ts`, blocks in `blocks/registry-maps.ts` (the `BLOCK_REGISTRY` config map + `BLOCK_META_REGISTRY` catalog-meta map, alphabetically — `blocks/registry.ts` holds only the accessor functions), triggers in `triggers/registry.ts`.
 - Type coercions (`Number()`, etc.) belong in `tools.config.params` (runs at execution, after variable resolution) — never in `tools.config.tool` (runs at serialization; coercing there destroys dynamic `<Block.output>` references).
-- `canonicalParamId` must NOT match any subblock's `id`, must be unique per operation/condition context, and all subblocks in a canonical group must share the same `required` status. The `inputs` section and the params function reference canonical IDs, not raw subblock IDs.
+- `canonicalParamId` must NOT match any subblock's `id`, must be unique **block-wide** (groups are keyed by canonical id across every subblock and hold exactly one `basicId`, so two operations that each need a pair need two different canonical ids), and all subblocks in a canonical group must share the same `required` status. The `inputs` section and the params function reference canonical IDs, not raw subblock IDs — the serializer deletes the subblock IDs and republishes the active member's value under the canonical ID.
+- A canonical pair carries ONE concept. For files that is upload (basic) + file reference (advanced), as in Gmail attachments (`blocks/blocks/gmail.ts`). Never overload the advanced side with alternate identifiers (URL, provider asset ID) — give those their own subblocks, mark mutually exclusive sources `required: false`, and enforce "exactly one" at execution.
+- A sub-block's option list is EITHER `selectorKey` (a registered selector — the only way to load a remote list, and the only one that works off the canvas) OR `options` (a static array, or a pure function of the block's own values). Never fetch from a block definition, and never read the workflow stores there. A credential sub-block needs `canonicalParamId: 'oauthCredential'` for its dependants' selectors to resolve. A secret must never appear in a selector's `getQueryKey`. `bun run check:fork-dependent-coverage` fails a `dependsOn` under a credential/KB/table anchor that the fork sync modal cannot offer.
 - Blocks must also set the catalog/UI metadata fields `integrationType`, `tags`, `authMode`, `docsLink`, and export a `{Service}BlockMeta` — see the `/add-block` skill's BlockMeta section for details.
diff --git a/.cursor/rules/sim-list-ordering.mdc b/.cursor/rules/sim-list-ordering.mdc
new file mode 100644
index 00000000000..f85dc165a02
--- /dev/null
+++ b/.cursor/rules/sim-list-ordering.mdc
@@ -0,0 +1,151 @@
+---
+description: "List and menu ordering that mirrors the sidebar or toolbar, with one separator before the destructive action"
+globs: ["apps/sim/app/**/*.tsx","apps/sim/ee/**/*.tsx","apps/sim/components/**/*.tsx"]
+---
+
+<!-- Generated from .claude/rules/sim-list-ordering.md by `bun run skills:sync`. Edit the source, not this file. -->
+
+# List & Menu Ordering
+
+**A list orders itself the way the user already reads the same things somewhere else.** Dropdowns, context menus, tab strips, command palettes, and settings navs are all *second* presentations of a set the user has already seen — in the sidebar, in a toolbar, in a column-header row. When the second presentation reorders that set, the user re-reads it from scratch every time.
+
+This is not a style preference. Order is the cheapest affordance a list has, and the only one that costs nothing to get right.
+
+## The rule
+
+Before writing a list of items, find where the user sees those same items *first*. That surface owns the order; your list mirrors it.
+
+| The list | Mirrors |
+| --- | --- |
+| Resource menus (`+` attach, `@` mention, resource-tab `+`) | the workspace **sidebar**, top-down |
+| A row / root **context menu** | that surface's **toolbar**, left-to-right → top-to-bottom |
+| Settings tab strip, recently-deleted tabs | the **settings nav**, top-down |
+| A "New …" menu | the order those things appear once created |
+
+Left-to-right becomes top-to-bottom. A toolbar reading `Filter · Sort · Export · Delete` becomes a menu reading Filter, Sort, Export, Delete — never alphabetized, never grouped by implementation, never "destructive last" unless the toolbar already puts it last.
+
+Platform-only entries (desktop **Browser** and **Terminal**) trail the shared set rather than interleaving, so the common prefix is identical on every platform.
+
+## Grouping: a rule marks a change in what the action acts on
+
+Order is governed above. **Separators are governed here.**
+
+A `DropdownMenuSeparator` earns its place when the next group stops acting on the thing the user
+clicked. That is the whole test — one question, asked the same way in every menu:
+
+| The group | Gets a rule before it |
+| --- | --- |
+| Acts on the clicked item (open, rename, duplicate, export, copy, edit, pin, run) | no — this is the body of the menu |
+| Acts on **something else** — the page's filters or view, or a newly created sibling | yes |
+| **Destroys or detaches** it (delete, leave, close, hide, remove) | yes |
+
+Most row menus only ever have the one transition, so they carry one rule, immediately before
+`Delete`. A menu that also filters the page or inserts siblings carries two. Nothing carries
+more, because there is no third thing a menu acts on.
+
+Do **not** band by verb. "Navigation", "status", "edit", "copy" are categories of *what the verb
+is*, not of *what it touches*, and the user meets no such taxonomy anywhere else — every toolbar
+in the app is a flat `gap-1` chip row with no dividers. Menus banded that way put the same action
+in different groups depending on which siblings happened to be visible.
+
+The consequential group trails in almost every menu. It leads in exactly one: the **logs row
+menu**, where `Retry` and `Cancel Run` act on the run itself and are the primary actions on a
+failure, so they sit on top with the rule beneath them. Ordering follows the surface (see "The
+rule" above); the separator fences whichever end that group occupies.
+
+A group whose items are merely *disabled* still gets no extra rule — `disabled` is not a group.
+
+```tsx
+// ✗ Bad — four semantic bands the user meets nowhere else
+Open in new tab │─── Rename, Lock │─── Duplicate, Export │─── Delete
+
+// ✓ Good — one rule, where the menu stops acting on the workflow
+Open in new tab, Rename, Lock, Duplicate, Export │─── Delete
+```
+
+**Worked examples.** The logs row menu carries two: `Retry, Cancel Run │ Copy Run ID, Copy Link,
+Open Workflow, Open Snapshot │ Filter by Workflow, Clear Filters` — the run, then this log, then
+the page. The table row and column menus carry two: the rule before `Insert row above` /
+`Insert column left` is where the menu stops acting on the clicked cell and starts creating
+siblings. Every other row menu in the app has only the destructive transition, so it carries one.
+
+**The one standing exception: menus that emulate a native menu.** The text-editor menu
+(`editor-context-menu.tsx`), the terminal menu (`terminal-context-menu.tsx`), and the browser
+page menu (`browser-session.tsx`) each mirror the OS menu the user already knows — clipboard
+banding (`Cut · Copy · Paste │ Select all`) is a convention every text field on their machine
+teaches them. These keep their native banding, and that is the *same* principle as the ordering
+rule above: mirror the surface the user already reads. The test is whether a real menu outside
+Sim taught them the grouping. Our own resource, row, and action menus have no such precedent —
+the toolbars they mirror are flat — so they take the single rule.
+
+**Both sides of every rule must be guaranteed non-empty.** Write the separator's guard out of
+the *exact* render conditions of the items around it, never a looser approximation:
+
+```tsx
+// ✗ Bad — `showLeave` alone, while the Leave item needs `showLeave && onLeave`.
+//         A caller passing showLeave from a permission check with a conditional
+//         onLeave renders a trailing rule under the last item.
+{hasActionsAbove && (showLeave || showDelete) && <DropdownMenuSeparator />}
+
+// ✓ Good — each term is the item's own condition, verbatim
+const hasDestructiveSection = (showLeave && onLeave) || showDelete
+{hasActionsAboveDestructive && hasDestructiveSection && <DropdownMenuSeparator />}
+```
+
+This is the failure that put a dangling rule at the bottom of the logs row menu, where two
+unconditional separators sat above conditional items.
+
+**Do not add a prop to move a rule.** The shared workflow context menu grew
+`groupNonDestructiveActions` and `separateNavigationAction` for this; between them they moved one
+separator for one caller, four of six branches were unreachable, and `separateNavigationAction`
+had no observable effect anywhere in the repo. Both are gone. A menu that wants different
+grouping wants the standard grouping.
+
+## Encode the order once
+
+An order duplicated across surfaces is an order that will drift. Export **one** constant and sort by it — do not hand-maintain a matching literal per menu.
+
+```ts
+/** Top-down order for every menu listing resource families, mirroring the sidebar. */
+export const RESOURCE_MENU_ORDER: readonly MothershipResourceType[] = [
+  'integration', 'task', 'table', 'file', 'filefolder',
+  'knowledgebase', 'log', 'workflow', 'folder', 'browser', 'terminal', 'generic',
+]
+
+export function byResourceMenuOrder<T extends { type: MothershipResourceType }>(a: T, b: T) {
+  return RESOURCE_MENU_ORDER.indexOf(a.type) - RESOURCE_MENU_ORDER.indexOf(b.type)
+}
+```
+
+Canonical instance: `app/workspace/[workspaceId]/home/components/mothership-view/components/resource-registry/resource-registry.tsx`, consumed by `useAvailableResources` and `ResourceMenuSections`.
+
+## Render kinds in one pass, not one phase per kind
+
+The most common way a canonical order gets silently defeated: emitting all items of one *kind* and then all of another. Every submenu-backed family lands above every flat family regardless of what the order constant says.
+
+```tsx
+// ✗ Bad — two phases; the trees always pin to the top
+<ResourceTreeSections sections={treeSections} />
+{groups.filter((g) => !FOLDERED.has(g.type)).map(renderFlat)}
+
+// ✓ Good — one ordered pass; each entry picks its own rendering
+{entries.sort(byResourceMenuOrder).map((entry) =>
+  sectionByType.has(entry.type) ? renderTree(entry) : renderFlat(entry)
+)}
+```
+
+The same trap appears as "render the pinned ones, then the rest", "render enabled, then disabled", and "render the groups, then the loose items".
+
+## When order may diverge
+
+Only for reasons the user can perceive:
+
+- **Search/filter results** rank by match quality — the whole point is that ranking beats position.
+- **User-controlled ordering** (drag-to-reorder, manual `sortOrder`) wins over any canonical order.
+- **Recency lists** ("Recent chats") order by time, which *is* the order the user reads them elsewhere.
+
+"Grouped by which hook provides it", "alphabetical because it was easy", and "that's the order the array was built in" are not reasons.
+
+## Reviewing
+
+When a diff adds or edits a list of items, ask: where does the user see this set already, and does this match? If the answer is a different file with a different order, the diff needs a shared constant, not a second literal.
diff --git a/.cursor/rules/sim-queries.mdc b/.cursor/rules/sim-queries.mdc
index 4e218f45110..b33eacb7f35 100644
--- a/.cursor/rules/sim-queries.mdc
+++ b/.cursor/rules/sim-queries.mdc
@@ -1,11 +1,16 @@
 ---
-description: React Query patterns for the Sim application
+description: "React Query patterns for the Sim application"
 globs: ["apps/sim/hooks/queries/**/*.ts"]
 ---
+
+<!-- Generated from .claude/rules/sim-queries.md by `bun run skills:sync`. Edit the source, not this file. -->
+
 # React Query Patterns
 
 All React Query hooks live in `hooks/queries/`. All server state must go through React Query — never use `useState` + `fetch` in components for data fetching or mutations.
 
+For *client* view-state that belongs in a shareable link (tabs, filters, search, pagination, selected entity id), use URL query params via nuqs — see `.claude/rules/sim-url-state.md`. React Query owns remote data; nuqs owns shareable client view-state.
+
 ## Query Key Factory
 
 Every query file defines a hierarchical keys factory with an `all` root key and intermediate plural keys for prefix-level invalidation:
@@ -22,6 +27,19 @@ export const entityKeys = {
 
 Never use inline query keys — always use the factory.
 
+**Every identifier the `queryFn` forwards into the fetch MUST appear in the `queryKey`.** (Query-machinery identifiers — `signal`, `pageParam` — are exempt; they aren't fetch-scoping args.) If the fetch is scoped by `workspaceId`, `cursor`, `limit`, an org id, etc., those values must be part of the key — otherwise distinct fetch args share one cache entry (a cross-tenant / per-param cache collision). The lone exception is a globally-unique id used as the key while a second fetch arg is only an authz scope that cannot collide; annotate those with `// rq-lint-allow: <reason>`. Enforced by the `key-fetch-arg-drift` check in `scripts/check-react-query-patterns.ts`.
+
+## Server-importable query primitives must NOT live in a `'use client'` module
+
+Next.js rewrites **every** export of a `'use client'` module into a *client reference* in the server bundle. Server-evaluated code — RSC `page.tsx`/`layout.tsx`, `prefetch.ts`, route handlers, **block definitions**, triggers/workers — can only *render* such an export as a component or pass it as a prop; **calling** one throws at runtime (`Attempted to call X from the server but X is on the client` — for an object export it surfaces as `X.list is not a function`). `next build` does **not** catch this — only SSR/runtime does.
+
+So any **query-key factory, standalone `requestJson` fetcher, mapper, or constant** that a server module imports must live in a **non-`'use client'`** module:
+
+- key factories → `hooks/queries/utils/<entity>-keys.ts` (see `folder-keys.ts`, `table-keys.ts`, `credential-keys.ts`)
+- standalone fetchers/mappers → `hooks/queries/utils/fetch-*.ts` / `*-list-query.ts` (see `fetch-workflow-envelope.ts`, `fetch-workspace-credentials.ts`)
+
+The `'use client'` hook module then imports these back for its hooks. **Never** define a server-imported factory/fetcher directly in a `'use client'` hooks file — it crashes SSR (this caused the tables-page crash). Enforced for prefetch/route/trigger/block files by `scripts/check-client-boundary-imports.ts` (`bun run check:client-boundary`, run in CI). Escape hatch for a genuinely browser-only path: `// client-boundary-allow: <reason>` on the line above the import.
+
 ## File Structure
 
 ```typescript
@@ -34,7 +52,7 @@ Never use inline query keys — always use the factory.
 ## Query Hook
 
 - Every `queryFn` must destructure and forward `signal` for request cancellation
-- Every query must have an explicit `staleTime`
+- Every query must have an explicit `staleTime`, assigned from a named exported constant (`ENTITY_LIST_STALE_TIME`), never an inline numeric literal. A server-side prefetch (`prefetch.ts`) hydrating the same query key must import and reuse that constant, not restate the number — this is what keeps a prefetched cache entry from going stale out of sync with the client hook that reads it
 - Use `keepPreviousData` only on variable-key queries (where params change), never on static keys
 - Same-origin JSON calls must go through `requestJson(contract, ...)` from `@/lib/api/client/request` against the contract in `@/lib/api/contracts/**`
 
@@ -42,6 +60,8 @@ Never use inline query keys — always use the factory.
 import { requestJson } from '@/lib/api/client/request'
 import { listEntitiesContract, type EntityList } from '@/lib/api/contracts/entities'
 
+export const ENTITY_LIST_STALE_TIME = 60 * 1000
+
 async function fetchEntities(workspaceId: string, signal?: AbortSignal): Promise<EntityList> {
   const data = await requestJson(listEntitiesContract, {
     query: { workspaceId },
@@ -55,7 +75,7 @@ export function useEntityList(workspaceId?: string, options?: { enabled?: boolea
     queryKey: entityKeys.list(workspaceId),
     queryFn: ({ signal }) => fetchEntities(workspaceId as string, signal),
     enabled: Boolean(workspaceId) && (options?.enabled ?? true),
-    staleTime: 60 * 1000,
+    staleTime: ENTITY_LIST_STALE_TIME,
     placeholderData: keepPreviousData, // OK: workspaceId varies
   })
 }
@@ -125,6 +145,22 @@ const handler = useCallback(() => {
 }, [data])
 ```
 
+## Server prefetching
+
+A server prefetch fills the *same* cache key a client hook fills, so it must be indistinguishable from a client fetch. Five rules:
+
+1. **Read the data layer, never our own API over HTTP.** A server-to-server call to `/api/...` costs a round trip and a second authentication for data the process can already read. Where the route runs an application use case, call that same use case with a principal from the same auth policy the route declares — not a manager underneath it.
+2. **Match the wire shape the hook caches.** The hook's data is whatever `requestJson(contract, …)` produced, so the seed must equal it. Two traps: a contract field declared `z.coerce.date()` means the hook holds a `Date` where raw route JSON holds a string; a passthrough response schema (`z.custom`) means the hook caches route JSON *verbatim*, so seeding raw rows leaks `Date`s and server-only fields. When the route projects before responding, share that projection — have the route and the prefetch call one function.
+3. **Prove the viewer.** Data-layer reads carry no authorization; the route used to provide it. Resolve the viewer (`getWorkspaceHostContextForViewer`, already `cache`d by the layout so it costs nothing) and return early on failure, caching nothing — the client fetch then reaches the route for the real 403. Never widen what a viewer can see.
+4. **Always `await`.** Only a settled query is dehydrated, so an unawaited prefetch is silently dropped from the payload and the pane waterfalls anyway.
+5. **Don't repeat what the layout already seeded.** `getQueryClient()` builds a new client per server call, so a page re-seeding a layout key is a genuine second read — and `HydrationBoundary` defers an already-seen query to an effect, which SSR never runs, so it never reaches the server render either.
+
+Reuse the hook's exported `staleTime` constant and its key factory; `dehydrate` carries neither options nor `staleTime`, and freshness is per-observer.
+
+Seed with `setQueryData` only when the prefetch must be able to *decline* to create an entry (an empty list that has to fall through to a route's creation path). `prefetchQuery` and `ensureQueryData` always create one.
+
+Keep prefetch imports light. A page prefetch's imports land in that route's server graph, so pulling a barrel to reach one function can drag thousands of modules behind it — `bun run check:tool-registry-boundary` gates this per page.
+
 ## Boundary Types
 
 - Hooks import named type aliases from `@/lib/api/contracts/**` (e.g., `import { listEntitiesContract, type EntityList } from '@/lib/api/contracts/entities'`). Never write `z.input<...>` / `z.output<...>` in hooks, and never `import { z } from 'zod'` in client code.
@@ -136,3 +172,7 @@ const handler = useCallback(() => {
 - **Query hooks**: `useEntity`, `useEntityList`
 - **Mutation hooks**: `useCreateEntity`, `useUpdateEntity`, `useDeleteEntity`
 - **Fetch functions**: `fetchEntity`, `fetchEntities` (private)
+
+## Enforcement
+
+`scripts/check-react-query-patterns.ts` (`bun run check:react-query`, run in CI) statically enforces these conventions: every `useQuery`/`useInfiniteQuery`/`useSuspenseQuery` declares an explicit `staleTime`, inline `queryFn`s destructure `signal`, `queryKey`s reference a colocated factory rather than an inline literal, every `*Keys` factory in `hooks/queries/**` exposes an `all` root key, and every identifier the `queryFn` forwards into the fetch also appears in the `queryKey` (`key-fetch-arg-drift`). `hooks/queries/**` is a zero-tolerance zone; the rest of `apps/sim/**` is ratcheted against `scripts/check-react-query-patterns.baseline.json`. For a genuine exception, put `// rq-lint-allow: <reason>` on the line directly above the flagged construct.
diff --git a/.cursor/rules/sim-react-performance.mdc b/.cursor/rules/sim-react-performance.mdc
new file mode 100644
index 00000000000..f5f523f7e57
--- /dev/null
+++ b/.cursor/rules/sim-react-performance.mdc
@@ -0,0 +1,130 @@
+---
+description: "Behavior-preserving React render-performance idioms"
+alwaysApply: true
+---
+
+<!-- Generated from .claude/rules/sim-react-performance.md by `bun run skills:sync`. Edit the source, not this file. -->
+
+# React & Render Performance
+
+Behavior-preserving performance idioms for components, hooks, and hot render paths. These are safe defaults — apply them freely. For the render-causing *effect/state* anti-patterns (derived state in effects, effect chains, state synced to a prop), use the dedicated skills: `/you-might-not-need-an-effect`, `/you-might-not-need-state`, `/you-might-not-need-a-memo`, `/you-might-not-need-a-callback`. Those refactors change render timing — verify them against the running UI, never mass-apply blind.
+
+## Lazy-init refs that hold objects
+
+`useRef(new Map())` / `useRef(new Set())` / `useRef({...})` allocates a fresh object on **every render** and throws it away — only the first is ever kept. Lazy-init instead so the allocation happens once.
+
+```typescript
+// ✗ Bad — allocates a new Map each render, discards all but the first
+const cacheRef = useRef<Map<string, string>>(new Map())
+
+// ✓ Good — allocated once, stable identity thereafter
+const cacheRef = useRef<Map<string, string> | null>(null)
+cacheRef.current ??= new Map()
+```
+
+Read `cacheRef.current` directly inside effects/handlers — refs are stable and never belong in a dependency array. A cheap primitive (`useRef(0)`, `useRef('')`, `useRef(null)`) needs no lazy init.
+
+## Hoist static values and closure-free functions to module scope
+
+A value or function declared inside a component is rebuilt every render. If it captures **nothing** from component scope (no props/state/refs), move it above the component at module scope. This skips the per-render allocation and keeps a stable identity so memoized children don't re-render.
+
+```typescript
+// ✗ Bad — rebuilt every render, new identity each time
+function Toolbar({ mode }: ToolbarProps) {
+  const TITLES = { create: 'Add', edit: 'Configure' } as const
+  const handleWheel = (e: React.WheelEvent) => e.currentTarget.scrollBy(e.deltaX, e.deltaY)
+  // ...
+}
+
+// ✓ Good — allocated once at module load
+const TITLES = { create: 'Add', edit: 'Configure' } as const
+function handleWheel(e: React.WheelEvent) {
+  e.currentTarget.scrollBy(e.deltaX, e.deltaY)
+}
+function Toolbar({ mode }: ToolbarProps) { /* ... */ }
+```
+
+A closure-free function that IS wired through a ref sink or intentionally kept for stable identity may stay inline — hoisting a one-line `preventDefault` handler is churn, not a win. Hoist when it removes a real per-render allocation or unblocks child memoization.
+
+## Pre-index with Map/Set for repeated lookups
+
+`array.find()` / `array.includes()` / `array.indexOf()` scan the whole list each call. Inside a loop or a hot render path over a non-trivial list, that is O(n·m). Build a `Map` (for lookup-by-key) or `Set` (for membership) **once before** the loop, then look up in O(1).
+
+```typescript
+// ✗ Bad — find() re-scans outputs for every column
+for (const child of columns) {
+  const output = group.outputs.find((o) => o.columnName === getColumnId(child))
+}
+
+// ✓ Good — index once, then O(1) lookups
+const outputByName = new Map<string, Output>()
+for (const o of group.outputs) {
+  if (!outputByName.has(o.columnName)) outputByName.set(o.columnName, o) // first wins, matches find()
+}
+for (const child of columns) {
+  const output = outputByName.get(getColumnId(child))
+}
+```
+
+Preserve `.find()`'s **first-match** semantics when duplicate keys are possible: `new Map(arr.map(...))` keeps the *last* entry, so guard with `if (!map.has(key))` when replacing a `.find()`. Skip this for tiny, cold arrays (a handful of items in an event handler) where the Map build costs more than it saves.
+
+## Never mutate a shared array in place
+
+The real bug to avoid is `array.sort()` / `array.reverse()` on an array you don't own — sorting a React Query cache array in place corrupts shared state. Always sort a copy:
+
+```typescript
+// ✗ Bad — mutates the (possibly shared) source array in place
+return items.sort(compare)
+
+// ✓ Good — sorts a throwaway copy, source untouched
+return [...items].sort(compare)
+```
+
+**Do NOT reach for `toSorted()` / `toReversed()` / `with()` / `toSpliced()` on client render paths.** They are ES2023 *runtime* methods — and a tsconfig `"lib": ["ES2023"]` only makes them **type-check**, it does not make them **run**. Next/SWC compiles syntax but does **not** polyfill prototype methods, and the default browserslist still includes browsers without them (`toSorted` landed in Safari 16 / iOS 16, so any device capped at iOS 15 throws `TypeError: x.toSorted is not a function` and crashes the page). The perf difference vs `[...arr].sort()` is negligible (both allocate one array), so the copy-then-sort form is the correct default everywhere client code runs. Only consider the immutable methods in Node-only code (server routes, scripts) on Node ≥20, where the runtime is known.
+
+## Run independent awaits in parallel
+
+Sequential `await`s that don't consume each other's result serialize latency for nothing — in an async Server Component or a route handler this directly delays the response. Kick them off together with `Promise.all` and destructure.
+
+```typescript
+// ✗ Bad — waits for params, then separately waits for searchParams
+const { id } = await params
+const { kbName } = await searchParams
+
+// ✓ Good — one combined wait
+const [{ id }, { kbName }] = await Promise.all([params, searchParams])
+```
+
+Only keep awaits sequential when a later call genuinely uses an earlier result, or when the ordering is deliberate (rate-limited batches, retry loops, write-then-read).
+
+## Carry exact lifecycle ownership across async boundaries
+
+When asynchronous work can outlive an execution, session, or resource instance, capture its
+opaque ownership token before the first `await` and pass that exact token through completion and
+error cleanup. Never re-adopt the current owner from delayed cleanup: a replacement may now own
+the same scope. End the lifecycle by exact-token match, and clear shared state only when that end
+succeeds. Current-owner adoption is reserved for synchronous user actions that explicitly stop
+the current lifecycle.
+
+## Prefetch dynamic destination lists on intent
+
+For long lists of dynamic destinations, do not viewport-prefetch every row and do not assume
+`router.prefetch()` warms the full route: in Next 16 it uses the automatic/PPR strategy. Gate
+`<Link prefetch={true}>` behind deliberate hover or keyboard focus, and prefetch destination
+server state with the consumer's shared React Query options. A short, cancelable hover dwell
+avoids drive-by downloads. Do not treat `touchstart` as intent because it also begins scrolling;
+let the actual unmodified click start the data request.
+
+A speculative failure must not poison a later visit when the app default disables
+`retryOnMount`: remove only that exact failed query while it is inactive, keep failures visible
+to mounted consumers, and set the shared options to `retryOnMount: true` so a quick-click failure
+can recover after the user leaves and returns. Never carry placeholder data between protected
+resource keys (for example, workspace A to workspace B); an explicit loading state is truthful.
+
+If a continuity-focused surface intentionally omits `loading.tsx` so the current view remains
+mounted until its peer is ready, the intent path must warm both the full route and its critical
+data. Otherwise keep the loading boundary so dynamic navigation remains responsive.
+
+## Local feature barrels are the convention — do not "fix" them
+
+Tooling (e.g. react-doctor's `no-barrel-import`) will flag imports from local `index.ts` barrels as a bundle cost. In this repo that is a **false positive**: barrel imports for 3+ export folders are mandated by `.claude/rules/sim-imports.md`. Leave them.
diff --git a/.cursor/rules/sim-sandbox.mdc b/.cursor/rules/sim-sandbox.mdc
index 74ba0ffc85f..1699f9dda5c 100644
--- a/.cursor/rules/sim-sandbox.mdc
+++ b/.cursor/rules/sim-sandbox.mdc
@@ -1,8 +1,10 @@
 ---
-description: Isolated-vm sandbox worker security policy. Hard rules for anything that lives in the worker child process that runs user code.
-globs: ["apps/sim/lib/execution/isolated-vm-worker.cjs", "apps/sim/lib/execution/isolated-vm.ts", "apps/sim/lib/execution/sandbox/**", "apps/sim/sandbox-tasks/**"]
+description: "Isolated-vm sandbox worker security policy. Hard rules for anything that lives in the worker child process that runs user code."
+globs: ["apps/sim/lib/execution/isolated-vm-worker.cjs","apps/sim/lib/execution/isolated-vm.ts","apps/sim/lib/execution/sandbox/**","apps/sim/sandbox-tasks/**"]
 ---
 
+<!-- Generated from .claude/rules/sim-sandbox.md by `bun run skills:sync`. Edit the source, not this file. -->
+
 # Sim Sandbox — Worker Security Policy
 
 The isolated-vm worker child process at
@@ -18,7 +20,10 @@ about what must **never** live in that process.
    secrets, or any LLM / email / search provider API keys. If you catch yourself
    `require`'ing `@/lib/auth`, `@sim/db`, `@/lib/uploads/core/storage-service`,
    or anything that imports `env` directly inside the worker, stop and use a
-   host-side broker instead.
+   host-side broker instead. This includes the OS environment: the worker is
+   spawned with the explicit allowlisted env from `buildWorkerEnv()` in
+   `isolated-vm.ts` — never spawn it without an `env` option (Node would copy
+   the app's full `process.env`, secrets included, into the worker).
 
 2. **Host-side brokers own all credentialed work**. The worker can only access
    resources through `ivm.Reference` / `ivm.Callback` bridges back to the host
@@ -65,6 +70,10 @@ payload or `ivm.Reference` wrapper in the worker:
 - [ ] Did you update the broker limits (`IVM_MAX_BROKER_ARGS_JSON_CHARS`,
       `IVM_MAX_BROKER_RESULT_JSON_CHARS`, `IVM_MAX_BROKERS_PER_EXECUTION`) if
       the new broker can emit large payloads or fire frequently?
+- [ ] Does the worker read a new env var? Add it to the `buildWorkerEnv()`
+      allowlist in `isolated-vm.ts` **and** to the allowlist regression test in
+      `isolated-vm.test.ts` — the worker does not inherit the app environment,
+      so an un-allowlisted var is simply absent in the child.
 
 ## What the worker *may* hold
 
diff --git a/.cursor/rules/sim-settings-pages.mdc b/.cursor/rules/sim-settings-pages.mdc
new file mode 100644
index 00000000000..29db1e041e9
--- /dev/null
+++ b/.cursor/rules/sim-settings-pages.mdc
@@ -0,0 +1,400 @@
+---
+description: "Settings page layout and SettingsPanel design-system compliance"
+globs: ["apps/sim/app/workspace/*/settings/**","apps/sim/app/workspace/*/{integrations,skills,upgrade}/**","apps/sim/app/workspace/*/components/{resource-tile,credential-detail}/**","apps/sim/components/{settings,permissions}/**","apps/sim/ee/**/components/**"]
+---
+
+<!-- Generated from .claude/rules/sim-settings-pages.md by `bun run skills:sync`. Edit the source, not this file. -->
+
+# Settings Pages
+
+The Next.js `settings/[section]/layout.tsx` owns all settings page chrome via
+`SettingsHeaderShell` — a fixed header bar (a left back chip + right-aligned
+action chips), a scroll region, and a centered `max-w-[48rem]` content column led
+by a **title + description from navigation metadata**. The chrome stays mounted
+across section navigation. Its routed title and description are available before
+the section body resolves. Each section renders through the **`SettingsPanel`**
+registrar
+(`@/app/workspace/[workspaceId]/settings/components/settings-panel`), which feeds
+the shell its header data and renders only the section body. Sections supply
+**data**, never chrome.
+
+Do NOT hand-roll any of these in a settings page — they are owned by the layout
+shell (fed through `SettingsPanel`):
+
+- `<div className='flex h-full flex-col bg-[var(--bg)]'>` shell
+- the header bar — compose `PAGE_HEADER_BAR` (`@/components/page-header-bar`); never rewrite its padding
+- the scroll container (`min-h-0 flex-1 overflow-y-auto px-6 [scrollbar-gutter:stable_both-edges]`)
+- the content column (`mx-auto … max-w-[48rem] … gap-7`)
+- a title block (`<h1 className='font-medium text-[var(--text-body)] text-lg'>` + `<p className='text-[var(--text-muted)] text-md'>`)
+- the page-level search input
+
+## Canonical page shape
+
+```tsx
+import { SettingsPanel } from '@/app/workspace/[workspaceId]/settings/components/settings-panel'
+
+return (
+  <SettingsPanel
+    actions={[{ text: 'Create', icon: Plus, variant: 'primary', onSelect: onCreate }]}
+    search={{ value: searchTerm, onChange: setSearchTerm, placeholder: 'Search …' }}
+  >
+    {/* body only — sections, lists, forms */}
+  </SettingsPanel>
+)
+```
+
+When the page has modal/dialog siblings, wrap them with the panel in a fragment:
+
+```tsx
+return (
+  <>
+    <SettingsPanel actions={…}>{body}</SettingsPanel>
+    <SomeModal … />
+  </>
+)
+```
+
+## `SettingsPanel` props
+
+- `actions?: SettingsAction[]` — right-aligned header chips, **data only**:
+  `{ id?, text, textTone?: 'error', icon?, variant?: 'primary'|'destructive', active?,
+  onSelect, onPrefetch?, disabled?, tooltip? }`.
+  The shell renders each as a `Chip` — never pass JSX, a `<div>`, or `className`
+  (the locked contract: it's structurally impossible to vibe-code a padding
+  change). Multiple/conditional actions are a plain array
+  (`[...(canManage ? [{…}] : []), …]`). Labels are **sentence case** (`Add override`,
+  not `Add Override`). A disabled action that needs to explain itself sets
+  `tooltip` (the shell renders the hover tooltip, disabled chip included). An action
+  that wants to warm a route on hover sets `onPrefetch`; the shell wires it. A label
+  that flips while pending (`Delete` → `Deleting...`) sets a stable `id`, or the chip
+  remounts mid-action. Save/Discard pairs come from the `saveDiscardActions()`
+  helper (spread it into `actions`).
+- `back?: SettingsBackAction` (`{ text, icon?, onSelect }`) — left-aligned back
+  chip for a **detail sub-view** (e.g. a selected MCP server, a permission group,
+  a retention policy). Detail sub-views render through `SettingsPanel` like list
+  pages — they do NOT hand-roll their own shell.
+- `docsLink?: string` — renders the header's `Docs` `ChipLink`.
+- `search?: { value; onChange: (value: string) => void; placeholder?; disabled? }` —
+  renders the canonical search field directly below the title. Pass `setSearchTerm`
+  straight to `onChange`. Use this for a standalone search; if search shares a row
+  with other controls (sort, filters, a date picker), render that whole row in
+  `children` instead and omit the prop.
+- `title?` / `description?` — overrides for the nav-driven defaults. **Only** for a
+  detail sub-view that needs a different heading; normal pages never pass these.
+  A top-level page's header identity must remain stable while its data loads:
+  never replace navigation metadata with client-fetched copy after first paint.
+  Put data-dependent context in the page body instead.
+- `scrollContainerRef?: React.Ref<HTMLDivElement>` — forwards a ref to the scroll
+  region (e.g. programmatic scroll-to-bottom).
+
+## Title + description live in navigation metadata
+
+`apps/sim/components/settings/navigation.ts` is the single source of truth (the
+`settings/navigation.ts` in the route tree is only a re-export shim). Every `NavigationItem` carries a one-line `description`; `SettingsPanel`
+resolves both via `getSettingsSectionMeta(plane, section)` and the
+`SettingsSectionProvider` the settings shell wraps around the active section.
+
+Adding a new settings page:
+
+1. Add the section id to the `UnifiedSettingsSection` union + a `NavigationItem`
+   (with `label` **and** `description`) in `components/settings/navigation.ts`. Keep descriptions verb-first, one line,
+   ~40–55 chars, in the product voice (see `.claude/rules/constitution.md`).
+2. Render the component inside the shell's `effectiveSection` switch in
+   `settings/[section]/settings.tsx`.
+3. Build the component body inside `<SettingsPanel>` — no shell, no title block.
+4. When a real second consumer or server boundary needs it, extract client-safe React Query options;
+   otherwise keep them with the hook. Approved intent warmers reuse those exact options and must keep
+   `check-tool-registry-boundary` green. Warm only authorized destinations, preserve the current
+   section during the transition, and follow `sim-react-performance.md` recovery rules; never render
+   temporary default data that will be replaced after load.
+
+## Text-scale tokens (no literal pixel sizes)
+
+Settings pages never use a literal `text-[Npx]` class — always the named Tailwind
+scale token from the `@theme` block in `apps/sim/app/_styles/globals.css` (`text-micro`
+10px, `text-xs` 11px, `text-caption` 12px, `text-small` 13px, `text-sm` 14px
+[Tailwind default, unmodified], `text-base` 15px, `text-md` 16px, `text-lg` 18px
+[Tailwind default]). A literal size is either a straight rename to the equivalent
+token (if the pixel value matches one exactly) or a sign the page never migrated —
+grep `text-\[1[0-8]px\]` under `apps/sim/app/workspace/*/settings/**` and
+`apps/sim/ee/**` to find stragglers.
+
+Watch `text-xs`: it is 11px here, so a "caption" written as `text-xs` is a pixel
+short. See `sim-styling.md` for the full scale.
+
+The two-line list row (title over a muted subtitle — a name + email, a tool name
++ description, a server name + status) is **not something you build**: it is
+`SettingsResourceRow`, which owns the pairing
+(`text-[var(--text-body)] text-sm` over `text-[var(--text-muted)] text-caption`).
+See "The resource row" below.
+
+For a toggle row (a `Switch` with a title and optional description), use the emcn
+`Label` component for the title — never a hand-rolled `<span>` — paired with
+`Switch`'s `id`/`Label`'s `htmlFor`:
+
+```tsx
+<div className='flex items-center justify-between'>
+  <div className='flex flex-col gap-1'>
+    <Label htmlFor='my-toggle'>Enable thing</Label>
+    <p className='text-[var(--text-muted)] text-caption'>One-line description.</p>
+  </div>
+  <Switch id='my-toggle' checked={enabled} onCheckedChange={onToggle} />
+</div>
+```
+
+`Label`'s own default styling (`font-medium text-[var(--text-primary)]
+text-small`) already matches the established title treatment — do not add a
+`className` overriding its size/color unless the row genuinely needs something
+different.
+
+`--text-primary`/`--text-secondary` and `--text-body`/`--text-muted` are both real,
+independently-defined tokens (not interchangeable — they resolve to different
+colors) and both see legitimate use across settings pages; this rule only pins
+down the **row title/subtitle** shape above, not every text element on every page.
+
+## The resource row
+
+**`SettingsResourceRow`** (`…/components/settings-resource-row`) is *the* list row
+for every settings resource — and for skills, integrations, and the `ee/` surfaces
+too. It owns the tile, the title/subtitle tokens, the row padding and bleed
+(`-mx-2 … rounded-lg p-2`), the hit area, the focus ring, the navigation chevron,
+and — on activatable rows only — the hover band. Never hand-roll any of it, and never wrap the row in your own
+`<button>` or `<Link>` — that is what `onClick`/`href` are for.
+
+```tsx
+<div className={RESOURCE_LIST_STACK}>
+  {items.map((item) => (
+    <SettingsResourceRow
+      key={item.id}
+      icon={<Wrench className='text-[var(--text-icon)]' />}
+      iconFilled
+      title={item.name}
+      description={item.summary}
+      onClick={() => open(item.id)}   // or href={`…/${item.id}`}
+      clickLabel={`Open ${item.name}`}
+      navigable
+    />
+  ))}
+</div>
+```
+
+- `icon?` + `iconVariant` — `tile` (default, the 36px bordered tile), `plain` (a
+  bare 14px glyph), `custom` (you supply the whole tile, e.g. the brand-tinted
+  `IntegrationTile`). Omit `icon` entirely for resources with no identity glyph
+  (an API key, a permission group). `iconFilled` uses the skills/tools fill;
+  `iconFill` lets an uploaded image reach the tile edge.
+- `onClick` / `href` — makes the **whole row** activatable via a stretched
+  overlay. Prefer `href` when the destination is a route, so the row keeps
+  prefetch, middle-click, and open-in-new-tab. Always pass `clickLabel` with
+  either — the overlay holds no text, so it is the control's *only* accessible
+  name. The prop is optional in the type (nothing enforces it), so omitting it
+  ships a nameless button rather than failing the build.
+- `navigable` — appends the one canonical chevron. Set it on rows that open a
+  detail page; leave it off when `onClick` acts in place (revealing a folder).
+  Never import an arrow yourself: `lucide-react` and `@sim/emcn/icons` ship
+  visibly different glyphs, and the row already picked one. A sanctioned bespoke
+  row (below) draws it with `RESOURCE_ROW_ARROW_CLASSES` from the same module.
+- `trailing` vs `badge` — `trailing` is for **interactive** controls (a `Chip`, a
+  `RowActionsMenu`) and sits above the hit area. `badge` is for **decoration** (a
+  status tag) and is click-through. Putting a badge in `trailing` turns the row's
+  right edge into a dead zone.
+- `RESOURCE_LIST_STACK` / `RESOURCE_LIST_GRID` — the single-column and two-up
+  containers. A `SettingsResourceRow` carries its own `-mx-2` bleed and padding,
+  so a container holding one only sets rhythm: never add a second `-mx-2` (they
+  stack into a 16px bleed) and never a different gap. A list of hand-rolled rows
+  is the opposite — there the container owns the bleed. A row inside a
+  fixed-height `overflow-y-auto` box, or a heading that must line up with the
+  section labels under it, passes `flush` to drop the bleed and padding.
+  `RESOURCE_LIST_GRID` budgets its column gap for the bleed (24px of track gap
+  minus 16px of bleed = an 8px gutter); narrowing that gap makes neighbouring
+  rows — and their stretched hit areas — overlap, so a click in the gutter opens
+  the wrong card.
+
+**Three-dots vs. chevron** is not a taste call:
+
+- Opens a **detail page** → `navigable` + a whole-row click, and no `Delete` in
+  the row (it lives in the detail header).
+- **No detail page** → a `RowActionsMenu` in `trailing`, and no `navigable`
+  chevron. The row may still take an `onClick` for an in-place action — a folder
+  mount reveals itself in Finder and also carries a `...` menu — but a row must
+  never offer both a chevron and a menu.
+
+## Other shared settings primitives (do not re-roll these)
+
+- **`SettingsSection`** (`…/components/settings-section/settings-section` — this
+  directory has no barrel) — muted label, hairline
+  divider, body. Also carries `headerAccessory` and `action` slots. Never
+  re-derive the label/divider chrome; `sim-styling.md` owns those tokens.
+- **`SettingsField`** (`…/components/settings-field`) — a read-only label/value
+  pair in a detail body: muted caption over the value. Pair it with
+  `SETTINGS_FIELD_VALUE_CLASSES` for the value text.
+- **`SettingsEmptyState`** (`…/components/settings-empty-state`) — the canonical
+  muted status message, for empty lists, "no results", loading gates, **and
+  failed loads** (`tone='error'`). `variant='fill'` (default) centers in the
+  available height; `variant='inline'` sits in flow. Never hand-roll
+  `<div className='flex h-full items-center justify-center …'>` or
+  `<div className='py-4 text-center …'>`.
+- **`RowActionsMenu`** (`…/components/row-actions-menu`) — the trailing `...`
+  actions menu for a list row. Pass `label` (aria-label) and
+  `actions: RowAction[]` (`{ label, onSelect, destructive?, disabled? }`); the
+  component renders the canonical flush `...` trigger + `DropdownMenuContent`.
+  Conditional items become array spreads: `...(canManage ? [{…}] : [])`. Never
+  hand-roll the `<DropdownMenu>` + `<MoreHorizontal>` trigger per page.
+- **`RESOURCE_TILE_BASE`** + one of `RESOURCE_TILE_FILL` / `RESOURCE_TILE_PLAIN`
+  (`app/workspace/[workspaceId]/components/resource-tile` — note: *not* under
+  `settings/`, unlike the other `…/` paths on this page) — the 36px tile chrome, for
+  any tile the row does not draw itself: a detail heading, or a caller-supplied
+  `iconVariant='custom'` tile. `ResourceTile` wraps the filled pairing. Use
+  `RESOURCE_TILE_FILL` for a glyph, `RESOURCE_TILE_PLAIN` for a brand logo or favicon.
+
+
+**Member avatars are deliberately two components, not one.** `member-list.tsx`
+renders a 14px neutral marker for the dense Teammates/Organization roster, where
+the email is the primary content; `components/permissions/member-row.tsx` renders
+a 36px `getUserColor`-hashed avatar for member *management* rows that carry a name,
+an email, and a role control. Same shape, different job — do not merge them.
+
+## Header action order
+
+Every detail header reads left→right:
+
+```
+← Back        [secondary actions] → Delete → Discard → Save
+```
+
+You do not have to get the array order right — `orderHeaderActions()` ranks them
+(secondary → `id:'delete'` → `id:'discard'` → `variant:'primary'`), order-stable
+within each band, so spreading `saveDiscardActions()` first still renders Save
+last. Three stacks apply it: `SettingsHeaderShell`, `SettingsActionChips`, and
+`Resource.Header` — so tables, files, knowledge and logs get the same ordering
+as settings.
+
+Delete is placed by its **`id`**, not by position, which is why `id:'delete'` is
+required rather than cosmetic: a page with no primary action still must not
+leave a destructive chip in the slot a primary would occupy.
+
+The bar geometry and the action cluster are both single-sourced in
+`@/components/page-header-bar` — `PAGE_HEADER_BAR` (or `Resource.Header`'s
+bordered variant) and `HEADER_ACTION_CLUSTER`. Never re-derive `h-[30px]`,
+`gap-1`, or the lane padding per header.
+Covered by `settings-header-order.test.ts` and `settings-header-shell.test.tsx`
+— the latter pins that a reordered chip still routes to its own handler.
+
+Two consequences worth knowing:
+
+- **The primary chip is always right-most**, and it is not always Save — on a
+  page with no save state it is whatever the primary action is (`Add workflows`,
+  `Import`). Delete still precedes it.
+- `CredentialDetailLayout` takes a `ReactNode`, so the chips you write directly
+  are in your order — only what you route through `SettingsActionChips` /
+  `SaveDiscardChips` is ranked. Put `<SaveDiscardChips>` last (skills, secrets,
+  connected credentials already do).
+
+## Deleting a resource
+
+Delete lives in the **detail header**, as `{ id: 'delete', text: 'Delete',
+onSelect: … }` behind a `ChipConfirmModal` — a **plain chip**, never
+`textTone: 'error'`, and never unconfirmed. In a `SettingsPanel` header it is
+action *data*, never a hand-rolled `<Chip>`; only `CredentialDetailLayout`
+surfaces, which take a `ReactNode`, render one directly. Always set `id: 'delete'`; without a
+stable id the chip remounts when the label flips to `Deleting...`.
+
+`variant: 'destructive'` is reserved for actions that are destructive at
+**scale** — `Delete all` passwords, `Clear all` browsing data, `Sign out all
+members`. Removing the single resource you are already looking at is confirmed
+by the modal, so it does not also need a red chip.
+
+A list row does not carry Delete when the resource has a detail page.
+
+## Save / Discard + unsaved-changes guard
+
+Any settings surface with editable state uses **one** shared stack — never
+hand-roll a Save button, a Discard button, a `beforeunload`, or an "Unsaved
+changes" modal:
+
+- **`saveDiscardActions(config)`** (`@/components/settings/save-discard-actions`)
+  — returns the canonical **Discard + Save** `SettingsAction[]`. **Save is always
+  rendered** (primary), disabled until there is something to save, so every
+  editable surface announces its primary action in the same place and a create
+  form is never a page with no visible way to commit it; **Discard appears only
+  when dirty**. Spread it into a `SettingsPanel` `actions` array, beside any
+  sibling actions (a detail view's Delete / Remove override). Config: `dirty`,
+  `saving`, `onSave`, `onDiscard`, `saveDisabled?`, `saveTooltip?`, `creating?`,
+  `saveLabel?`, `savingLabel?`. Create flows pass `creating` — the
+  Create / Creating... labels come as a pair and can never drift apart.
+  `saveLabel`/`savingLabel` are only for genuinely bespoke wording (SSO's
+  `Update`); never hand-roll the pair to get a create label.
+- **`<SaveDiscardChips {...config} />`** (same module) — the identical rule
+  rendered as chips, for surfaces whose header takes a `ReactNode` instead of
+  action data (`CredentialDetailLayout`: skills, secrets, connected credentials).
+  Both stacks derive from the one function; never hand-roll a Save chip.
+
+`CredentialDetailLayout` stays slot-driven for exactly two reasons: its back
+control is a real `<ChipLink href>` (deep-linkable / middle-clickable, which
+`SettingsBackAction`'s `onSelect` cannot express), and actions like
+`SkillImportButton` own a hidden file input and their own pending state.
+**Everything else in one of those headers should be `SettingsAction` data**
+rendered through `<SettingsActionChips actions={…} />` from
+`@/components/settings/settings-header` — that is the shared chip path, and it
+is what keeps tone/icon/variant/tooltip handling from drifting between the two
+shells. Reach for it before hand-rolling a `Chip`.
+- **`useSettingsUnsavedGuard({ isDirty })`** (`…/settings/hooks/use-settings-unsaved-guard`)
+  — syncs the page's local `isDirty` into the shared `useSettingsDirtyStore` (so
+  the sidebar's **section-switch** confirm + the centralized `beforeunload` both
+  apply for free) and returns `{ showUnsavedModal, setShowUnsavedModal, guardBack,
+  confirmDiscard }` for a detail view's **in-view back** chip.
+  - **Top-level pages** (whitelabeling, sso): call it **unassigned** —
+    `useSettingsUnsavedGuard({ isDirty: hasChanges })` — they only need the
+    store-sync; the sidebar/`beforeunload` do the rest.
+  - **Detail sub-views** (data-retention, access-control group-detail): route the
+    back chip through `onClick={() => guard.guardBack(closeFn)}` and render the
+    shared `<UnsavedChangesModal open={guard.showUnsavedModal}
+    onOpenChange={guard.setShowUnsavedModal} onDiscard={guard.confirmDiscard} />`
+    (from `@/app/workspace/[workspaceId]/components/credential-detail`). The
+    in-view header **Discard** chip (via `SaveDiscardActions onDiscard`) is a
+    *reset to original* — distinct from the back-confirm's discard, which leaves.
+- **`useSettingsBeforeUnload`** is mounted by the settings shells
+  (`settings/layout.tsx` and `components/settings/standalone-settings-shell.tsx`) —
+  never add a per-page `beforeunload`.
+- **Dirty *computation* stays local** (shapes differ: field-compare vs
+  normalize+stringify) — only how dirty is *consumed* is shared. Derive it (a
+  `const`/`useMemo`), never store it in `useState`.
+- **CRITICAL — rules of hooks:** call `useSettingsUnsavedGuard(...)`
+  **unconditionally, before every early-return gate** (entitlement / loading /
+  not-entitled `return <SettingsEmptyState>`). A hook placed after a gate is
+  skipped on gated renders and crashes.
+- The route-based credential detail keeps its own `useUnsavedChangesGuard` (it
+  guards real `router.push` navigation + browser Back via a history sentinel);
+  it already shares `UnsavedChangesModal`, so copy stays unified.
+
+## Detail sub-views
+
+A drill-down view reached from a list row (selected MCP server, workflow MCP
+server, permission group, retention policy) renders through
+`SettingsPanel` like a list page: pass `back={{ text, icon: ArrowLeft, onSelect }}`
+for the left back chip, `title` (the entity name), and the header `actions`, then
+render the body. Do NOT hand-roll a shell or header bar; a tab bar renders as the
+first body child. Gate/early-return states (not-entitled, loading, upgrade
+prompts) stay as-is.
+
+The route-based credential detail (`settings/secrets/[credentialId]`) is the lone
+exception — it lives outside `[section]` and keeps its own `CredentialDetailLayout`.
+
+## Audit checklist
+
+A settings page is design-system-clean when:
+
+- [ ] Its main return is a `<SettingsPanel>` (or `<>…<SettingsPanel>…</>` with modal siblings) — no hand-rolled shell/header/scroll/column.
+- [ ] It renders **no** hand-rolled `<h1>`/description title block — the title comes from nav metadata.
+- [ ] Header chips are in `actions`; a standalone search is in the `search` prop.
+- [ ] Its `NavigationItem` has an accurate, consistent-length `description`.
+- [ ] Detail sub-views and entitlement/loading gates keep their own chrome (intentional).
+- [ ] If it has editable state: Save/Discard go through `SaveDiscardActions`, dirty is wired via `useSettingsUnsavedGuard` (called before any early-return gate), and there is **no** hand-rolled Save button / `beforeunload` / "Unsaved changes" modal.
+- [ ] No business logic, handlers, or conditional rendering changed by the migration — except where the shared primitive makes a gate structural (a permission gate becomes `onClick={can ? … : undefined}` + `navigable={can}`, which renders a plain non-interactive row).
+- [ ] No literal `text-[Npx]` classes — named scale tokens only (see "Text-scale tokens" above).
+- [ ] Every **resource** list row (a thing with an identity — a tool, a server, a key, a credential) is a `SettingsResourceRow` in a `RESOURCE_LIST_STACK`/`RESOURCE_LIST_GRID` — no wrapper `<button>`/`<Link>`, no hand-passed arrow, no re-derived title/subtitle spans. Rows with a genuinely different shape stay bespoke, and draw their own arrow with `RESOURCE_ROW_ARROW_CLASSES`: multi-line bodies (inbox tasks), tabular columns (billing invoices, credit usage), grids (secrets), and the member rows (see the avatar note above).
+- [ ] Rows that open a detail page use `navigable` + `clickLabel`; flat records use `RowActionsMenu`. Not both.
+- [ ] Decorative trailing content is in `badge`, not `trailing`.
+- [ ] Labeled sections use `SettingsSection`; read-only fields use `SettingsField`; empty/loading/error use `SettingsEmptyState`.
+- [ ] Delete is a plain `id:'delete'` header action behind a `ChipConfirmModal`; `destructive` is reserved for bulk actions.
+- [ ] `tsc`, `biome`, and the page's tests pass.
diff --git a/.cursor/rules/sim-stores.mdc b/.cursor/rules/sim-stores.mdc
index d7411553566..0707b7f9926 100644
--- a/.cursor/rules/sim-stores.mdc
+++ b/.cursor/rules/sim-stores.mdc
@@ -1,8 +1,10 @@
 ---
-description: Zustand store patterns
-globs: ["apps/sim/**/store.ts", "apps/sim/**/stores/**/*.ts"]
+description: "Zustand store patterns"
+globs: ["apps/sim/**/store.ts","apps/sim/**/stores/**/*.ts"]
 ---
 
+<!-- Generated from .claude/rules/sim-stores.md by `bun run skills:sync`. Edit the source, not this file. -->
+
 # Zustand Store Patterns
 
 Stores live in `stores/`. Complex stores split into `store.ts` + `types.ts`.
@@ -56,7 +58,7 @@ export const useFeatureStore = create<FeatureState>()(
 
 1. Use `devtools` middleware (named stores)
 2. Use `persist` only when data should survive reload
-3. `partialize` to persist only necessary state
+3. `persist` MUST use `partialize` with an explicit whitelist of the durable fields. Exclude transient flags (`isResizing`, drag/hover state) and `_hasHydrated` from the whitelist, and never spread the whole state (`{ ...state }`) — it leaks actions and transient state into storage
 4. `_hasHydrated` pattern for persisted stores needing hydration tracking
 5. Immutable updates only
 6. `set((state) => ...)` when depending on previous state
diff --git a/.cursor/rules/sim-styling.mdc b/.cursor/rules/sim-styling.mdc
index e4688808503..7f92c255aeb 100644
--- a/.cursor/rules/sim-styling.mdc
+++ b/.cursor/rules/sim-styling.mdc
@@ -1,14 +1,21 @@
 ---
-description: Tailwind CSS and styling conventions
-globs: ["apps/sim/**/*.tsx", "apps/sim/**/*.css"]
+description: "Tailwind CSS and styling conventions"
+globs: ["apps/sim/**/*.tsx","apps/sim/**/*.css"]
 ---
+
+<!-- Generated from .claude/rules/sim-styling.md by `bun run skills:sync`. Edit the source, not this file. -->
+
 # Styling Rules
 
 ## Tailwind
 
-1. **No inline styles** - Use Tailwind classes
+1. **No inline styles** - Use Tailwind classes. Exception: a genuinely dynamic
+   value (a hashed avatar colour, a brand tile background) that cannot be a class.
 2. **No duplicate dark classes** - Skip `dark:` when value matches light mode
-3. **Exact values** - `text-[14px]`, `h-[26px]`
+3. **Exact values over approximations** - `h-[26px]`, not `h-6`. But **type size is
+   always a named token** (`text-sm`, `text-caption`) — never `text-[14px]`, which
+   sets font-size only and inherits a different line-height. See
+   `sim-settings-pages.md` for the scale.
 4. **Transitions** - `transition-colors` for interactive states
 
 ## Conditional Classes
@@ -54,9 +61,29 @@ Use `DropdownMenuItemLabel` for a human label beside menu icons, checks, shortcu
 
 Do not apply the fade universally to editable or mirrored input values, code, logs, paths, filenames that use intentional middle truncation, dense or virtualized grids, or a composite container that also holds icons/actions. Those keep their purpose-built overflow behavior. Multiline copy uses an intentional `line-clamp-*` treatment.
 
+## Scroll Edges
+
+A scroll region that can hide rows past an edge uses `useScrollEdges` with `scrollFadeClass` + `scrollFadeAttributes` from `@sim/emcn`: a 12px fade at an edge only while content is hidden beyond it, never at rest. The region's baseline padding lives on the scroll box itself (so rows pass through it under the fade), and the divider at that edge is drawn by the neighboring block, conditional on the same edge. Never hand-roll a `mask-image` gradient or a `scrollTop > 0` effect for this.
+
+## Font Weight
+
+Three steps, Tailwind's stock scale, nothing else: **`font-normal` (400)**, **`font-medium` (500)**, **`font-semibold` (600)**. 400 is the document default, so body text, chip labels, sidebar items, and headings carry **no weight class at all** — they inherit. Reach for a class only to step *up* from body.
+
+Never write an arbitrary weight (`font-[380]`, `font-[430]`, `font-[450]`, …), and never set `fontWeight` in an inline `style`. There was previously a CSS-variable weight scale (`--font-weight-base/medium/semibold`, remapping `font-medium` to 440/480) plus seven ad-hoc values clustered between 380 and 500; it was deleted because nothing read as hierarchical. Off-scale values are only acceptable where the design system genuinely cannot reach — react-email templates and the static `apps/sim/emails/broadcasts/*.html`, which email clients render without CSS variables.
+
+Headings inherit their weight. Tailwind preflight resets `h1`–`h6` to `font-weight: inherit`, so an `<h1>` is 400 unless you say otherwise — that is the intended look, not a bug to patch.
+
 ## Color Tokens
 
-Value text `--text-body`; muted/placeholder/labels `--text-muted`; icons `--text-icon`; borders `--border-1` (fields) / `--border` (dividers); surfaces `--surface-5` (light) / `--surface-4` (dark); active row `--surface-active`; error `--text-error`. No focus rings on chip surfaces.
+Value text `--text-body`; muted/placeholder/labels `--text-muted`; icons `--text-icon`; progress and completion (a checked step, a done state) `--brand-blue` — `--selection` stays the interactive highlight; neutral borders and dividers `--border` (`--border-1` and `--border-muted` are legacy aliases resolving to it; `--divider` is retired); surfaces `--surface-5` (light) / `--surface-4` (dark); active row `--surface-active`; error `--text-error`. No focus rings on chip surfaces.
+
+### Line weight
+
+Neutral border geometry comes from `--border-width`: `1px` by default, dropping to `0.5px` under `@media (min-resolution: 2dppx)` so hidpi displays get a true hairline. Tailwind's `border*` and `divide-*` utilities resolve through it, as do `h-px`/`w-px` — the `px` key is overridden on **`spacing`**, not on `width`/`height`, so a hairline and the `-right-px`/`inset-px` offsets that position it stay in agreement.
+
+**Tune line weight on `--border`, never on `--border-width`.** Browsers floor a border to whole device pixels, so on a 2dppx display every value in `(0, 1px)` collapses to the same single-pixel hairline and the next drawable step is a full `1px` — double. Width has exactly one usable position; perceived weight is a color property. Light mode gains weight by darkening `--border`, dark mode by lightening it.
+
+Draw a line with a real `border-*` utility. Never hand-roll one as `shadow-[inset_0_-1px_0_…]` — box-shadow has its own width and cannot follow the token, so such a line silently renders at double weight against every neighbor. Use an explicit numeric width (or a `ring`/`outline`) only when the line is intentionally emphasized, e.g. focus and selection affordances.
 
 ## Chip Components (consumer usage)
 
diff --git a/.cursor/rules/sim-testing.mdc b/.cursor/rules/sim-testing.mdc
index 515784d541b..2ce946647a7 100644
--- a/.cursor/rules/sim-testing.mdc
+++ b/.cursor/rules/sim-testing.mdc
@@ -1,8 +1,9 @@
 ---
-description: Testing patterns with Vitest and @sim/testing
-globs: ["apps/sim/**/*.test.ts", "apps/sim/**/*.test.tsx"]
+description: "Testing patterns with Vitest and @sim/testing"
+globs: ["apps/sim/**/*.test.ts","apps/sim/**/*.test.tsx"]
 ---
 
+<!-- Generated from .claude/rules/sim-testing.md by `bun run skills:sync`. Edit the source, not this file. -->
 
 # Testing Patterns
 
diff --git a/.cursor/rules/sim-typescript.mdc b/.cursor/rules/sim-typescript.mdc
index 21f20f8c936..f12506d43d9 100644
--- a/.cursor/rules/sim-typescript.mdc
+++ b/.cursor/rules/sim-typescript.mdc
@@ -1,8 +1,10 @@
 ---
-description: TypeScript conventions and type safety
-globs: ["apps/sim/**/*.ts", "apps/sim/**/*.tsx"]
+description: "TypeScript conventions and type safety"
+globs: ["apps/sim/**/*.ts","apps/sim/**/*.tsx"]
 ---
 
+<!-- Generated from .claude/rules/sim-typescript.md by `bun run skills:sync`. Edit the source, not this file. -->
+
 # TypeScript Rules
 
 1. **No `any`** - Use proper types or `unknown` with type guards
diff --git a/.cursor/rules/sim-ui-copy.mdc b/.cursor/rules/sim-ui-copy.mdc
index 4648eb21e32..4324b556436 100644
--- a/.cursor/rules/sim-ui-copy.mdc
+++ b/.cursor/rules/sim-ui-copy.mdc
@@ -1,14 +1,17 @@
 ---
-description: UI copy conventions — no default subtitles or helper text under headings, labels, cards, or settings
-globs: ["apps/sim/**/*.tsx"]
+description: "UI copy conventions — no default subtitles or helper text under headings, labels, cards, or settings"
+globs: ["apps/sim/**/*.tsx","apps/sim/components/emcn/**"]
 ---
+
+<!-- Generated from .claude/rules/sim-ui-copy.md by `bun run skills:sync`. Edit the source, not this file. -->
+
 # UI Copy
 
 **Do not add subtitles, helper text, or descriptive copy beneath headings, labels, cards, or settings by default.** Prefer one concise, self-explanatory heading or label. Only add supporting copy when the user explicitly asks for it, or when it is necessary to prevent misunderstanding or error — and never use it to restate the heading.
 
-This applies to product surfaces: settings rows, modals, panels, cards, list rows, empty states, form fields, and section headers. Marketing surfaces (`app/(landing)`, docs) are governed by `constitution.mdc` instead.
+This applies to product surfaces: settings rows, modals, panels, cards, list rows, empty states, form fields, and section headers. Marketing surfaces (`app/(landing)`, docs) are governed by `constitution.md` instead.
 
-**Carve-out — settings section metadata.** `SettingsNavigationItem.description` in `components/settings/navigation.ts` stays required, and `SettingsPanel` keeps rendering it as the page subtitle. Settings sections are reached through a nav list where the description is the only thing distinguishing adjacent sections. Everything else on a settings page — inline `<p>` blurbs under section headings, field hints, modal bodies, row subtitles — follows the default rule above.
+**Carve-out — settings section metadata.** `SettingsNavigationItem.description` in `components/settings/navigation.ts` stays required, and `SettingsPanel` keeps rendering it as the page subtitle. Settings sections are reached through a nav list where the description is the only thing distinguishing adjacent sections, so it earns its place by the "prevents misunderstanding" test. Keep those descriptions verb-first and one line, per `sim-settings-pages.md`. Everything else on a settings page — inline `<p>` blurbs under section headings, field hints, modal bodies, row subtitles — follows the default rule above.
 
 ## The default is no description
 
diff --git a/.cursor/rules/sim-url-state.mdc b/.cursor/rules/sim-url-state.mdc
new file mode 100644
index 00000000000..ede5704a8e2
--- /dev/null
+++ b/.cursor/rules/sim-url-state.mdc
@@ -0,0 +1,283 @@
+---
+description: "Shareable client view-state lives in the URL via nuqs"
+globs: ["apps/sim/app/**/*.tsx","apps/sim/app/**/*.ts","apps/sim/app/**/search-params.ts","apps/sim/ee/**/*.tsx","apps/sim/ee/**/*.ts"]
+---
+
+<!-- Generated from .claude/rules/sim-url-state.md by `bun run skills:sync`. Edit the source, not this file. -->
+
+# URL / Query-Param State (nuqs)
+
+URL query state is managed with [`nuqs`](https://nuqs.dev). The `NuqsAdapter` is wired once in `apps/sim/app/layout.tsx` — do not add another. This rule is the source of truth for *what* belongs in the URL and *how* to wire it.
+
+## Decision framework — where does this state live?
+
+Pick exactly one home for each piece of state:
+
+- **React Query** → server/remote data. Unchanged; see `.claude/rules/sim-queries.md`.
+- **URL params (nuqs)** → client view-state worth putting in a link: active tab/panel, selected entity id, filters, search query, pagination, view mode (list/grid), an open "view" drawer/modal that represents a destination.
+- **Zustand** → cross-component client state that must NOT be in the URL: high-frequency, large, ephemeral, or socket-synced (canvas pan/zoom, cursor, drag state, resize widths, unsaved buffers, live collaborative selection).
+- **`useState`** → purely local, single-component UI.
+
+Put state in the URL **only** when it is *all* of: shareable, deep-linkable, bookmarkable, survives reload + back/forward — **and** is discrete, low-frequency, and small. If it fails any of those, it does not go in the URL.
+
+### When to use what (decision table)
+
+| Home | Trigger | Example |
+| --- | --- | --- |
+| **URL (nuqs)** | Client view-state worth a link: tab, filter, search, sort, pagination, selected-entity id, an open "view" modal/drawer that is a destination | `?tab=licenses`, `?category=Communication`, `?page=3`, `?skillId=abc` |
+| **React Query** | Server/remote data fetched from an endpoint | `useMcpServers(workspaceId)`, `useSkills(workspaceId)` |
+| **Zustand** | Cross-component client state that must NOT be in the URL: high-frequency, large, ephemeral, socket-synced | canvas pan/zoom, live cursor, drag state, resize widths, unsaved buffers |
+| **`useState`** | Purely local single-component UI; also the snappy mirror of a debounced URL search | a hover flag, a transient dialog target, the live text of a debounced search box |
+
+## Anti-patterns (forbidden)
+
+- Direct `useSearchParams().get(...)` or `new URLSearchParams(window.location.search)` to **read** state.
+- Hand-built query strings + `router.replace`/`router.push` to **mutate** state. **If the target path equals the current path, it is a query mutation, not a navigation** — even when written as a full path template. Re-serializing the path by hand is lossy by construction: it drops every param the template forgets. Use the nuqs setter (`setParams({ key: null }, { history: 'replace', scroll: false })`) — `null` always removes the key, and only the params you name are touched. Both options are already nuqs defaults (see "Conventions"); write them explicitly because a group whose shared options set `history: 'push'` (e.g. `filesUrlKeys`) would otherwise push a back-stack entry for a strip.
+- `window.history.replaceState`/`pushState` to mutate a param.
+- Duplicating URL state into a store and syncing it with effects / `popstate` listeners.
+- High-frequency or large state in the URL (cursor, pan/zoom, un-debounced keystrokes, big JSON blobs).
+- `import { z } from 'zod'` in client code for param validation — use nuqs parsers (`parseAsString`, `parseAsInteger`, `parseAsBoolean`, `parseAsStringLiteral`, `parseAsArrayOf`) or a custom `createParser`.
+
+These reads/mutations are **not** anti-patterns and stay as-is:
+
+- **Outbound URL builders** — `new URLSearchParams({...})` to construct a `href`, a download endpoint, an external WebSocket/API URL, or a `window.open(_, '_blank')` destination.
+- **Route navigations** — `router.push('/path/[id]?folderId=x')` that changes the route *path*, not just the current query. A nuqs setter only mutates the query on the current path; cross-path navigation stays on `router`.
+- **Read-once auth / redirect signals** — `token`, `callbackUrl`, `redirect`, `error`, `invite_flow`, `new` (invite signup flow), `upgraded`, `redirect_workflow`, etc. These are navigation signals consumed once (often read-then-strip), not synced view-state. Leave them on `useSearchParams`. Key names are per-surface: files' `new` is a genuine nuqs param (`files/search-params.ts`), while invite's `new` is a one-shot signup signal.
+
+### Remembered list-preference exception
+
+Files, Tables, and Knowledge may persist their last-used filter/sort snapshot through
+`useResourceListPreferences`. This is a fallback preference, not a second live source of truth:
+
+- nuqs remains authoritative while the module is open.
+- Zustand is consulted once on a clean module entry, after persisted state hydrates.
+- An explicit URL filter/sort parameter wins even when it resolves to the module default. The
+  complete resolved URL snapshot becomes the remembered value; omitted fields use URL defaults
+  rather than merging with storage.
+- Explicit filter/sort gestures commit the same complete snapshot to nuqs and Zustand together.
+- Never mirror subsequent URL changes with a synchronization effect or `popstate` listener.
+- Search and folder navigation remain URL-only and are excluded from the persisted snapshot.
+
+## Per-feature `search-params.ts` — single source of truth
+
+Co-locate a `search-params.ts` next to the feature. Export the parser map (and shared options). Both the client (`useQueryStates`/`useQueryState`) and any server component (`createSearchParamsCache` from `nuqs/server`) import from this one file. Import parsers from `nuqs/server` so the module is safe to import in both client and server contexts.
+
+Conventions:
+
+- `.withDefault(...)` on every parser so reads are non-null. A deliberately **nullable** parser (dynamic default, custom-range-only dates, nullable sort) must carry a comment saying why.
+- Filter / search / toggle / pagination options: `{ history: 'replace', clearOnDefault: true }` — clean URLs, no back-stack churn. Note all three of `history: 'replace'`, `clearOnDefault: true`, and `shallow: true` are already the nuqs v2 defaults — writing the first two explicitly is documentation (and guards the groups whose options differ, e.g. `history: 'push'`), and `shallow: true` may be omitted entirely.
+- Navigations that belong in browser history (changing folder, opening a deep-linked entity): `{ history: 'push' }`.
+- `shallow: false` **only** when a Server Component / loader must re-read the param. For loading states during the server re-render, pass React's `startTransition` via `.withOptions({ startTransition, shallow: false })`.
+- Short, stable, **kebab-case** URL keys. Renaming a key is a breaking change to shared links — treat it as one. When the parser-map key is camelCase (for clean destructuring), remap the wire key via the `urlKeys` option in the shared options object (see `files/search-params.ts` `uploadedBy: 'uploaded-by'`, `ee/audit-logs/search-params.ts` `timeRange: 'time-range'`); nuqs also exports a `UrlKeys<typeof parsers>` type helper for standalone mappings.
+- `throttleMs` is deprecated in nuqs — rate-limit URL writes with `limitUrlUpdates: throttle(ms)` / `debounce(ms)` (the debounced-search hook below already does this).
+- A parser **shared across surfaces with different defaults** (e.g. `parseAsTimeRange`) must `parse` unknown tokens to `null` — never to one surface's default — so each consumer's `.withDefault(...)` decides the fallback.
+- For an opaque/literal value use `parseAsStringLiteral([...] as const)`; for a custom wire format use [`createParser`](https://nuqs.dev/docs/parsers).
+- A `createParser` for a value **not** comparable with `===` (arrays, objects, `Date`) **must** define an `eq` — `clearOnDefault` uses it to detect the default, so without it an empty-array/object default never strips from the URL. Built-in `parseAsArrayOf(...)` already ships its own `eq`; only string/number/boolean custom parsers can omit it. Example (array): `eq: (a, b) => a.length === b.length && a.every((v, i) => v === b[i])`.
+
+### Example — grouped filters (single source of truth)
+
+```typescript
+// apps/sim/app/workspace/[workspaceId]/things/search-params.ts
+import { parseAsArrayOf, parseAsString, parseAsStringLiteral } from 'nuqs/server'
+
+const VIEW_MODES = ['list', 'grid'] as const
+
+export const thingsParsers = {
+  search: parseAsString.withDefault(''),
+  tags: parseAsArrayOf(parseAsString).withDefault([]),
+  view: parseAsStringLiteral(VIEW_MODES).withDefault('list'),
+} as const
+
+/** Clean URLs, no back-stack churn for filter changes. */
+export const thingsUrlKeys = {
+  history: 'replace',
+  clearOnDefault: true,
+} as const
+```
+
+(The `*UrlKeys` suffix is the repo's naming convention for a feature's shared **options** object — which may itself contain a nuqs `urlKeys` key-remapping entry; the two are different things.)
+
+### Client — `useQueryStates` (grouped) / `useQueryState` (single)
+
+```typescript
+'use client'
+
+import { useQueryStates } from 'nuqs'
+import { thingsParsers, thingsUrlKeys } from '@/app/workspace/[workspaceId]/things/search-params'
+
+export function useThingFilters() {
+  const [filters, setFilters] = useQueryStates(thingsParsers, thingsUrlKeys)
+  // filters.search / filters.tags / filters.view are non-null (defaults applied)
+  // setFilters({ view: 'grid' }) — pass null to clear a single key back to default
+  return { filters, setFilters }
+}
+```
+
+For a single param, use `useQueryState(key, parser)`:
+
+```typescript
+const [serverId, setServerId] = useQueryState(mcpServerIdParam.key, mcpServerIdParam.parser)
+```
+
+### Server — `createSearchParamsCache`
+
+When a Server Component or loader must read a param, build a cache from the **same** parser map:
+
+```typescript
+// in a server component / page.tsx
+import { createSearchParamsCache } from 'nuqs/server'
+import { thingsParsers } from '@/app/workspace/[workspaceId]/things/search-params'
+
+const thingsCache = createSearchParamsCache(thingsParsers)
+
+export default async function Page({ searchParams }: { searchParams: Promise<Record<string, string | string[] | undefined>> }) {
+  const { search, view } = await thingsCache.parse(await searchParams)
+  // ...
+}
+```
+
+If a client param must be re-read server-side after a change, set `shallow: false` on the write.
+
+## Suspense boundary
+
+`useQueryState`/`useQueryStates` read `useSearchParams` internally, so any client component using them must sit under a `<Suspense>` boundary (Next.js requirement). Wrap the page entry with a real-chrome fallback so a suspend never flashes a blank frame.
+
+**Never `fallback={null}` on a page entry.** The route's co-located `loading.tsx` default export *is* the correct fallback — one skeleton serves both the route-level navigation transition (which Next renders automatically) and the in-page suspend (which this boundary renders). If the segment has no `loading.tsx`, add one; the route transition needs it anyway. Import it absolutely (`sim-imports.md`):
+
+```typescript
+import { KnowledgeBase } from '@/app/workspace/[workspaceId]/knowledge/[id]/base'
+import KnowledgeBaseLoading from '@/app/workspace/[workspaceId]/knowledge/[id]/loading'
+
+<Suspense fallback={<KnowledgeBaseLoading />}>
+  <KnowledgeBase id={id} knowledgeBaseName={kbName || 'Knowledge Base'} />
+</Suspense>
+```
+
+Reference: `apps/sim/app/workspace/[workspaceId]/knowledge/[id]/page.tsx`.
+
+The narrow exception is a continuity-focused peer switch that deliberately keeps the current
+view mounted and follows the full-route plus critical-data intent-prefetch rule in
+`sim-react-performance.md`. It still needs a real in-page Suspense fallback; it only omits the
+route-level `loading.tsx` that would replace the current peer before the destination is ready.
+
+This applies to **page entries**. An inner `<Suspense>` wrapping a `lazy()` component is the exception: there `fallback={null}` is correct, precisely so the suspend resolves at the nearest boundary instead of flashing the whole route — see `sim-imports.md`, "Code-splitting through barrels".
+
+## Debounced text inputs
+
+Use `useDebouncedSearchSetter` from `@/hooks/use-debounced-search-setter` — never hand-roll a local `useState` mirror + `useDebounce` + a URL write-back effect, and never hand-roll the debounce wiring inline. The nuqs value updates instantly (the input is controlled directly by it and stays snappy); only the *URL write* is debounced via nuqs's built-in [`limitUrlUpdates: debounce(ms)`](https://nuqs.dev/docs/options), which the hook applies for you. Clearing (or a whitespace-only value) writes `null` immediately so the param strips without lingering.
+
+```typescript
+import { useDebouncedSearchSetter } from '@/hooks/use-debounced-search-setter'
+
+// Search inside a grouped useQueryStates — the group's discrete filters keep immediate writes:
+const setSearch = useDebouncedSearchSetter((value, options) => setFilters({ search: value }, options))
+
+// Standalone single param — pass the useQueryState setter directly:
+const setSearch = useDebouncedSearchSetter(setSearchParam)
+
+// Non-default window (e.g. files' 200ms):
+const setSearch = useDebouncedSearchSetter(write, { debounceMs: 200 })
+```
+
+- **Never write a trimmed value to a param that controls the input** — trimming on write eats the user's trailing space mid-typing and makes multi-word queries untypable. The hook writes the raw value; trim only for the empty-check (the hook does this) and on *read* where the value feeds a query or filter.
+- **Keep fetches/filtering debounced.** Where the search value feeds a React Query key or an expensive in-memory filter, derive a debounced value off the instant nuqs value (`const debounced = useDebounce(urlSearch, SEARCH_DEBOUNCE_MS)` with `SEARCH_DEBOUNCE_MS` from `@/lib/url-state`) and feed *that* to the query — the instant value is only for the input box. Cheap in-memory filtering over a small static list may read the instant value directly.
+- Settings list search boxes use `useSettingsSearch()` from `settings/components/use-settings-search` — the shared `?search=` binding for that surface.
+- Preserve `clearOnDefault` (empty clears the param), the existing default, and `history: 'replace'`. See logs (`use-log-filters.ts` grouped, query stays debounced), integrations (cheap in-memory filter, instant value), and tables (filter stays debounced).
+
+## Sort convention (`sort` + `dir`)
+
+Sortable lists use **two scalar params**, never a serialized `{column,direction}` object. Build them with `createSortParams` from `@/lib/url-state` (in the feature's `search-params.ts`) and consume them with `useUrlSort` from `@/hooks/use-url-sort` — never re-declare `SORT_DIRECTIONS`/default constants or hand-roll the `activeSort`/`onSort`/`onClear` wiring:
+
+```typescript
+// search-params.ts (server-safe)
+import { createSortParams } from '@/lib/url-state'
+
+const THING_SORT_COLUMNS = ['name', 'created', 'updated'] as const
+
+export const thingsSortParams = createSortParams(THING_SORT_COLUMNS, {
+  column: 'updated',
+  direction: 'desc',
+})
+```
+
+```typescript
+// component (client)
+import { useUrlSort } from '@/hooks/use-url-sort'
+
+const { sort, dir, activeSort, onSort, onClear } = useUrlSort(thingsSortParams, thingsUrlKeys)
+// activeSort/onSort/onClear plug straight into SortConfig; sort/dir feed query keys and comparators.
+```
+
+Two modes, chosen by whether you pass a default:
+
+- **Defaulted (the common case)** — pass the list's existing default sort; it must match exactly. A clean URL means the default ordering; explicitly selecting the default collapses back to a clean URL (`clearOnDefault`), and "clear sort" writes the defaults back. `useUrlSort` derives `activeSort: null` for the default state.
+- **Nullable** — omit the default when "no active sort" is behaviorally distinct from explicitly sorting by the fallback column (e.g. document chunks: with no sort the query omits `sortBy` entirely and the server's own order applies). The params carry no defaults, explicit selections always persist in the URL, and "clear sort" strips both params (`useUrlSort` writes `null`s).
+
+Sort params live alongside — not inside — the feature's grouped filter parser map (one definition per param; `useUrlSort` owns its own `useQueryStates`, and nuqs keeps hooks on the same keys in sync). Both params carry the shared filter options (`{ history: 'replace', clearOnDefault: true }`). Free-form user-defined columns (e.g. `tables/[tableId]`) can't use `parseAsStringLiteral` and stay hand-rolled with `parseAsString` — reuse the shared `SORT_DIRECTIONS` there.
+
+## Dates in the URL (date-only params)
+
+A date-only param (a calendar anchor, a date filter) is stored as `yyyy-MM-dd` — never serialize a full `Date`/timestamp when only the day matters.
+
+**Local vs UTC — pick the parser that matches your date math.** nuqs's built-in `parseAsIsoDate` is **UTC-based** (`serialize` via `toISOString().slice(0, 10)`, `parse` to UTC midnight). If your `Date` is local-time (e.g. produced by local-time helpers and read by `date-fns` `startOfWeek`/`isSameDay`, which are all local), `parseAsIsoDate` will shift the day by ±1 in any non-UTC timezone on reload/deep-link/back-forward. For local-time date math, use a small local-date `createParser` that serializes/parses on local calendar fields (`getFullYear`/`getMonth`/`getDate` ↔ `new Date(y, m-1, d)`) with an `eq` comparing y/m/d. Only use `parseAsIsoDate` when the value is genuinely UTC/midnight-UTC.
+
+```typescript
+const parseAsLocalDate = createParser({
+  parse: (v) => {
+    const [y, m, d] = v.split('-').map(Number)
+    return y && m && d ? new Date(y, m - 1, d) : null
+  },
+  serialize: (v) =>
+    `${v.getFullYear()}-${String(v.getMonth() + 1).padStart(2, '0')}-${String(v.getDate()).padStart(2, '0')}`,
+  eq: (a, b) =>
+    a.getFullYear() === b.getFullYear() && a.getMonth() === b.getMonth() && a.getDate() === b.getDate(),
+})
+```
+
+When the default is **dynamic** (e.g. "today"), make the param **nullable** (omit `.withDefault`) and derive the fallback in the hook (`const anchor = param ?? today`), so a clean URL means the dynamic default and navigating back to it writes `null` (clears the param).
+
+## Selected-entity deep-link (store the id, derive the object)
+
+To deep-link a row/modal/drawer to one entity, store **only its id** and look the object up in the already-loaded list — never serialize the object into the URL:
+
+```typescript
+const [skillId, setSkillId] = useQueryState(skillIdParam.key, {
+  ...skillIdParam.parser,
+  history: 'push', // opening an entity is a destination; "back" closes it
+  clearOnDefault: true,
+})
+// Derive — do not duplicate into useState or sync with an effect:
+const editingSkill = skillId ? (skills.find((s) => s.id === skillId) ?? null) : null
+```
+
+Open the panel/modal only when the id **resolves to a loaded entity** — never gate on the raw param alone, or a dead/stale id (deleted entity, old bookmark) renders a broken detail view and a still-loading list flashes one. A dead id simply falls back to the list; the lingering param is harmless. Because this reads `useSearchParams` it needs a **Suspense** boundary on the page (see "Suspense boundary" above). A separate "create new" flow has no id and stays in local `useState`.
+
+**Close with `replace`, open with `push`.** Opening pushed a history entry; closing must not push another. Close via the setter's per-call options — `setSkillId(null, { history: 'replace' })` — so Back from the list leaves the page instead of reopening the detail (see `mcp.tsx`, `workflow-mcp-servers.tsx`, access-control, custom-blocks, forks). Secondary params scoped to the detail view (e.g. its active tab, `server-tab`) are cleared in the same close handler with their own setter — nuqs batches same-tick writes into one URL update.
+
+**Reusable components** rendered both as a settings/list page and inside a modal (e.g. `BYOKKeyManager`) expose an optional controlled `searchTerm`/`onSearchTermChange` prop pair: the page consumer binds the URL (`useSettingsSearch()`), modal consumers omit the props and keep local state. Never bind URL state from inside a component that can mount in a non-destination context.
+
+## Read-then-strip deep links
+
+For an ephemeral deep-link that pre-opens a modal/drawer and should not linger in the URL (e.g. integrations `?connect=oauth`, knowledge `?addConnector=`), read the param, act on it once behind a `useRef` guard, then clear it: `setParam(null, { history: 'replace', scroll: false })`. See `apps/sim/app/workspace/[workspaceId]/integrations/[block]/integration-block-detail.tsx`.
+
+## Workflow editor carve-out — what must NOT go in the URL
+
+The workflow editor (`apps/sim/app/workspace/[workspaceId]/w/**`) is realtime/socket-synced via `socket-provider.tsx`. Its view-state is intentionally store-backed (Zustand), not URL-backed. Do **not** move the following into the URL:
+
+- **Live cursor** and **broadcast live selection** (presence; emitted over the socket, throttled).
+- **Pan / zoom / viewport** (ReactFlow-owned, continuous, not persisted).
+- **Drag state** and **resize widths/heights** (panel/terminal/sidebar — high-frequency, persisted as local preferences).
+- **Ephemeral diff staging** (`hasActiveDiff`, `baselineWorkflow`, `diffAnalysis`).
+
+Borderline candidates that *look* shareable but currently stay in Zustand because moving them fights existing machinery:
+
+- **Panel `activeTab`** — a persisted local *preference* wired into an SSR flash-prevention path (`data-panel-active-tab` + `_hasHydrated`); moving it would unwind that machinery and risk tab-flash on load. **Canvas mode** (`mode` on `useCanvasModeStore`) is likewise a persisted layout preference, not a destination.
+- **The panel editor's `currentBlockId`** (`stores/panel/editor/store.ts` — a would-be "look at this block" deep link) — the only genuinely shareable candidate, but it is persisted and entangled with panel-open orchestration. Adding a URL param for it is a *new feature*, not a migration; ship it deliberately (with runtime verification against a live socket), not as part of a sweep.
+
+Rule of thumb for the editor: if state is socket-coupled, high-frequency, viewport-related, or a persisted resize/preference, it stays in Zustand. When in doubt, leave it and flag it — do not force fragile URL state into the canvas.
+
+## Docs
+
+- Adapters (App Router `NuqsAdapter`): https://nuqs.dev/docs/adapters
+- Parsers & options (`parseAsString`/`parseAsInteger`/`parseAsBoolean`/`parseAsStringLiteral`/`parseAsArrayOf`/`createParser`, `withDefault`, `history`, `shallow`, `clearOnDefault`): https://nuqs.dev/docs/parsers and https://nuqs.dev/docs/options
+- Server-side reads (`createSearchParamsCache`): https://nuqs.dev/docs/server-side
diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile
deleted file mode 100644
index f99d9bbcba9..00000000000
--- a/.devcontainer/Dockerfile
+++ /dev/null
@@ -1,47 +0,0 @@
-FROM oven/bun:1.4.1-alpine
-
-# Install necessary packages for development
-RUN apk add --no-cache \
-    git \
-    curl \
-    wget \
-    jq \
-    sudo \
-    postgresql-client \
-    vim \
-    nano \
-    bash \
-    bash-completion \
-    zsh \
-    zsh-vcs \
-    ca-certificates \
-    shadow
-
-# Create a non-root user with matching UID/GID
-ARG USERNAME=bun
-ARG USER_UID=1000
-ARG USER_GID=$USER_UID
-
-# Create user group if it doesn't exist
-RUN if ! getent group $USER_GID >/dev/null; then \
-        addgroup -g $USER_GID $USERNAME; \
-    fi
-
-# Create user if it doesn't exist
-RUN if ! getent passwd $USER_UID >/dev/null; then \
-        adduser -D -u $USER_UID -G $(getent group $USER_GID | cut -d: -f1) $USERNAME; \
-    fi
-
-# Add sudo support
-RUN echo "$USERNAME ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/$USERNAME \
-    && chmod 0440 /etc/sudoers.d/$USERNAME
-
-# Set up shell environment
-RUN echo "export PATH=\$PATH:/home/$USERNAME/.bun/bin" >> /etc/profile
-
-WORKDIR /workspace
-
-# Expose the ports we're interested in
-EXPOSE 3000
-EXPOSE 3001
-EXPOSE 3002
\ No newline at end of file
diff --git a/.devcontainer/README.md b/.devcontainer/README.md
deleted file mode 100644
index 10e684d3d81..00000000000
--- a/.devcontainer/README.md
+++ /dev/null
@@ -1,75 +0,0 @@
-# Sim Development Container
-
-Development container configuration for VS Code Dev Containers and GitHub Codespaces.
-
-## Prerequisites
-
-- Visual Studio Code
-- Docker Desktop or Podman Desktop
-- VS Code Dev Containers extension
-
-## Getting Started
-
-1. Open this project in VS Code
-2. Click "Reopen in Container" when prompted (or press `F1` → "Dev Containers: Reopen in Container")
-3. Wait for the container to build and initialize
-4. Start developing with `sim-start`
-
-The setup script will automatically install dependencies and run migrations.
-
-## Development Commands
-
-### Running Services
-
-You have two options for running the development environment:
-
-**Option 1: Run everything together (recommended for most development)**
-```bash
-sim-start  # Runs both app and socket server using concurrently
-```
-
-**Option 2: Run services separately (useful for debugging individual services)**
-- In the **app** container terminal: `sim-app` (starts Next.js app on port 3000)
-- In the **realtime** container terminal: `sim-sockets` (starts socket server on port 3002)
-
-### Other Commands
-
-- `sim-migrate` - Push schema changes to the database
-- `sim-generate` - Generate new migrations
-- `build` - Build the application
-- `pgc` - Connect to PostgreSQL database
-
-## Troubleshooting
-
-**Build errors**: Rebuild the container with `F1` → "Dev Containers: Rebuild Container"
-
-**Port conflicts**: Ensure ports 3000, 3002, and 5432 are available
-
-**Container runtime issues**: Verify Docker Desktop or Podman Desktop is running
-
-## Technical Details
-
-Services:
-- **App container** (8GB memory limit) - Main Next.js application
-- **Realtime container** (4GB memory limit) - Socket.io server for real-time features
-- **Database** - PostgreSQL with pgvector extension
-- **Migrations** - Runs automatically on container creation
-
-You can develop with services running together or independently.
-
-### Personalization
-
-**Project commands** (`sim-start`, `sim-app`, etc.) are automatically available via `/workspace/.devcontainer/sim-commands.sh`.
-
-**Personal shell customization** (aliases, prompts, etc.) should use VS Code's dotfiles feature:
-1. Create a dotfiles repository (e.g., `github.com/youruser/dotfiles`)
-2. Add your `.bashrc`, `.zshrc`, or other configs
-3. Configure in VS Code Settings:
-   ```json
-   {
-     "dotfiles.repository": "youruser/dotfiles",
-     "dotfiles.installCommand": "install.sh"
-   }
-   ```
-
-This separates project-specific commands from personal preferences, following VS Code best practices.
diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
deleted file mode 100644
index 99bd1b3a4fb..00000000000
--- a/.devcontainer/devcontainer.json
+++ /dev/null
@@ -1,37 +0,0 @@
-{
-  "name": "Sim Dev Environment",
-  "dockerComposeFile": "docker-compose.yml",
-  "service": "app",
-  "workspaceFolder": "/workspace",
-  "workspaceMount": "source=${localWorkspaceFolder},target=/workspace,type=bind,consistency=cached",
-
-  "customizations": {
-    "vscode": {
-      "settings": {
-        "editor.formatOnSave": true,
-        "editor.codeActionsOnSave": {
-          "source.fixAll.biome": "explicit",
-          "source.organizeImports.biome": "explicit"
-        },
-        "terminal.integrated.shellIntegration.enabled": true
-      },
-      "extensions": [
-        "biomejs.biome",
-        "bradlc.vscode-tailwindcss",
-        "ms-vscode.vscode-typescript-next",
-        "github.copilot",
-        "github.copilot-chat",
-        "mikestead.dotenv",
-        "dsznajder.es7-react-js-snippets",
-        "steoates.autoimport",
-        "oven.bun-vscode"
-      ]
-    }
-  },
-
-  "forwardPorts": [3000, 3002, 5432],
-
-  "postCreateCommand": "bash -c 'bash .devcontainer/post-create.sh || true'",
-
-  "remoteUser": "bun"
-}
diff --git a/.devcontainer/docker-compose.yml b/.devcontainer/docker-compose.yml
deleted file mode 100644
index 2689fd7b689..00000000000
--- a/.devcontainer/docker-compose.yml
+++ /dev/null
@@ -1,99 +0,0 @@
-services:
-  app:
-    build:
-      context: ..
-      dockerfile: .devcontainer/Dockerfile
-    volumes:
-      - ..:/workspace:cached
-      - bun-cache:/home/bun/.bun/cache:delegated
-    command: sleep infinity
-    deploy:
-      resources:
-        limits:
-          memory: 8G
-    environment:
-      - NODE_ENV=development
-      - DATABASE_URL=postgresql://postgres:postgres@db:5432/simstudio
-      - BETTER_AUTH_URL=http://localhost:3000
-      - NEXT_PUBLIC_APP_URL=http://localhost:3000
-      - BETTER_AUTH_SECRET=${BETTER_AUTH_SECRET:-your_auth_secret_here}
-      - ENCRYPTION_KEY=${ENCRYPTION_KEY:-your_encryption_key_here}
-      - COPILOT_API_KEY=${COPILOT_API_KEY}
-      - MSHIP_SYSPROMPT_OVERRIDE=${MSHIP_SYSPROMPT_OVERRIDE:-}
-      - NEXT_PUBLIC_CHAT_DISABLED=${NEXT_PUBLIC_CHAT_DISABLED:-}
-      - SIM_AGENT_API_URL=${SIM_AGENT_API_URL}
-      - OLLAMA_URL=${OLLAMA_URL:-http://localhost:11434}
-      - NEXT_PUBLIC_SOCKET_URL=${NEXT_PUBLIC_SOCKET_URL:-}
-      - BUN_INSTALL_CACHE_DIR=/home/bun/.bun/cache
-    # Lets a workflow reach a service on the Docker host. Reaching it also
-    # requires naming it in EGRESS_ALLOWED_HOSTS; this only makes the name
-    # resolve, which it does not on Linux by default.
-    extra_hosts:
-      - 'host.docker.internal:host-gateway'
-    depends_on:
-      db:
-        condition: service_healthy
-      migrations:
-        condition: service_completed_successfully
-    ports:
-      - "3000:3000"
-      - "3001:3001"
-    working_dir: /workspace
-
-  realtime:
-    build:
-      context: ..
-      dockerfile: .devcontainer/Dockerfile
-    volumes:
-      - ..:/workspace:cached
-      - bun-cache:/home/bun/.bun/cache:delegated
-    command: sleep infinity
-    deploy:
-      resources:
-        limits:
-          memory: 1G
-    environment:
-      - NODE_ENV=development
-      - DATABASE_URL=postgresql://postgres:postgres@db:5432/simstudio
-      - BETTER_AUTH_URL=http://localhost:3000
-      - NEXT_PUBLIC_APP_URL=http://localhost:3000
-      - BETTER_AUTH_SECRET=${BETTER_AUTH_SECRET:-your_auth_secret_here}
-    depends_on:
-      db:
-        condition: service_healthy
-    ports:
-      - "3002:3002"
-    working_dir: /workspace
-
-  migrations:
-    build:
-      context: ..
-      dockerfile: docker/db.Dockerfile
-    environment:
-      - DATABASE_URL=postgresql://postgres:postgres@db:5432/simstudio
-    depends_on:
-      db:
-        condition: service_healthy
-    command: ['bun', 'run', 'db:migrate']
-    restart: 'no'
-
-  db:
-    image: pgvector/pgvector:pg17
-    restart: unless-stopped
-    volumes:
-      - postgres-data:/var/lib/postgresql/data
-    environment:
-      - POSTGRES_USER=postgres
-      - POSTGRES_PASSWORD=postgres
-      - POSTGRES_DB=simstudio
-    ports:
-      - "${POSTGRES_PORT:-5432}:5432"
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U postgres"]
-      interval: 5s
-      timeout: 5s
-      retries: 5
-
-volumes:
-  postgres-data:
-  bun-cache:
diff --git a/.devcontainer/post-create.sh b/.devcontainer/post-create.sh
deleted file mode 100755
index 841d5c2e362..00000000000
--- a/.devcontainer/post-create.sh
+++ /dev/null
@@ -1,138 +0,0 @@
-#!/bin/bash
-
-# Exit on error, but with some error handling
-set -e
-
-echo "🔧 Setting up Sim development environment..."
-
-# Change to the workspace root directory
-cd /workspace
-
-# Install global packages for development (done at runtime, not build time)
-echo "📦 Installing global development tools..."
-bun install -g turbo drizzle-kit typescript @types/node 2>/dev/null || {
-  echo "⚠️ Some global packages may already be installed, continuing..."
-}
-
-# Set up bun completions (with proper shell detection)
-echo "🔧 Setting up shell completions..."
-if [ -n "$SHELL" ] && [ -f "$SHELL" ]; then
-  SHELL=/bin/bash bun completions 2>/dev/null | sudo tee /etc/bash_completion.d/bun > /dev/null || {
-    echo "⚠️ Could not install bun completions, but continuing..."
-  }
-fi
-
-# Add project commands to shell profile
-echo "📄 Setting up project commands..."
-# Add sourcing of sim-commands.sh to user's shell config files if they exist
-for rcfile in ~/.bashrc ~/.zshrc; do
-  if [ -f "$rcfile" ]; then
-    # Check if already added
-    if ! grep -q "sim-commands.sh" "$rcfile"; then
-      echo "" >> "$rcfile"
-      echo "# Sim project commands" >> "$rcfile"
-      echo "if [ -f /workspace/.devcontainer/sim-commands.sh ]; then" >> "$rcfile"
-      echo "  source /workspace/.devcontainer/sim-commands.sh" >> "$rcfile"
-      echo "fi" >> "$rcfile"
-    fi
-  fi
-done
-
-# If no rc files exist yet, create a minimal one
-if [ ! -f ~/.bashrc ] && [ ! -f ~/.zshrc ]; then
-  echo "# Source Sim project commands" > ~/.bashrc
-  echo "if [ -f /workspace/.devcontainer/sim-commands.sh ]; then" >> ~/.bashrc
-  echo "  source /workspace/.devcontainer/sim-commands.sh" >> ~/.bashrc
-  echo "fi" >> ~/.bashrc
-fi
-
-# Clean and reinstall dependencies to ensure platform compatibility
-echo "📦 Cleaning and reinstalling dependencies..."
-if [ -d "node_modules" ]; then
-  echo "Removing existing node_modules to ensure platform compatibility..."
-  rm -rf node_modules
-  rm -rf apps/sim/node_modules
-  rm -rf apps/docs/node_modules
-fi
-
-# Ensure Bun cache directory exists and has correct permissions
-mkdir -p ~/.bun/cache
-chmod 700 ~/.bun ~/.bun/cache
-
-# Install dependencies with platform-specific binaries
-echo "Installing dependencies with Bun..."
-bun install
-
-# Check for native dependencies
-echo "Checking for native dependencies compatibility..."
-if grep -q '"trustedDependencies"' apps/sim/package.json 2>/dev/null; then
-  echo "⚠️ Native dependencies detected. Bun will handle compatibility during install."
-fi
-
-# Set up environment variables if .env doesn't exist for the sim app
-if [ ! -f "apps/sim/.env" ]; then
-  echo "📄 Creating apps/sim/.env from template..."
-  if [ -f "apps/sim/.env.example" ]; then
-    cp apps/sim/.env.example apps/sim/.env
-  else
-    echo "DATABASE_URL=postgresql://postgres:postgres@db:5432/simstudio" > apps/sim/.env
-  fi
-fi
-
-# Set up env for the realtime server (must match the shared values in apps/sim/.env)
-if [ ! -f "apps/realtime/.env" ] && [ -f "apps/realtime/.env.example" ]; then
-  echo "📄 Creating apps/realtime/.env from template..."
-  cp apps/realtime/.env.example apps/realtime/.env
-fi
-
-# Set up packages/db/.env for drizzle-kit and migration scripts
-if [ ! -f "packages/db/.env" ] && [ -f "packages/db/.env.example" ]; then
-  echo "📄 Creating packages/db/.env from template..."
-  cp packages/db/.env.example packages/db/.env
-fi
-
-# Generate schema and run database migrations
-echo "🗃️ Running database schema generation and migrations..."
-echo "Generating schema..."
-cd packages/db
-bun run db:generate
-cd ../..
-
-echo "Waiting for database to be ready..."
-# Try to connect to the database, but don't fail the script if it doesn't work
-(
-  timeout=60
-  while [ $timeout -gt 0 ]; do
-    if PGPASSWORD=postgres psql -h db -U postgres -c '\q' 2>/dev/null; then
-      echo "Database is ready!"
-      cd packages/db
-      DATABASE_URL=postgresql://postgres:postgres@db:5432/simstudio bun run db:push
-      cd ../..
-      break
-    fi
-    echo "Database is unavailable - sleeping (${timeout}s remaining)"
-    sleep 5
-    timeout=$((timeout - 5))
-  done
-  
-  if [ $timeout -le 0 ]; then
-    echo "⚠️ Database connection timed out, skipping migrations"
-  fi
-) || echo "⚠️ Database setup had issues but continuing..."
-
-# Clear the welcome message flag to ensure it shows after setup
-unset SIM_WELCOME_SHOWN
-
-echo ""
-echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-echo "✅ Sim development environment setup complete!"
-echo ""
-echo "Your environment is now ready. A new terminal session will show"
-echo "available commands. You can start the development server with:"
-echo ""
-echo "  sim-start"
-echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-echo ""
-
-# Exit successfully regardless of any previous errors
-exit 0 
\ No newline at end of file
diff --git a/.devcontainer/sim-commands.sh b/.devcontainer/sim-commands.sh
deleted file mode 100755
index c8e3ab1a52f..00000000000
--- a/.devcontainer/sim-commands.sh
+++ /dev/null
@@ -1,42 +0,0 @@
-#!/bin/bash
-# Sim Project Commands
-# Source this file to add project-specific commands to your shell
-# Add to your ~/.bashrc or ~/.zshrc: source /workspace/.devcontainer/sim-commands.sh
-
-# Project-specific aliases for Sim development
-alias sim-start="cd /workspace && bun run dev:full"
-alias sim-app="cd /workspace && bun run dev"
-alias sim-sockets="cd /workspace && bun run dev:sockets"
-alias sim-migrate="cd /workspace/packages/db && bun run db:push"
-alias sim-generate="cd /workspace/packages/db && bun run db:generate"
-alias sim-rebuild="cd /workspace && bun run build && bun run start"
-alias docs-dev="cd /workspace/apps/docs && bun run dev"
-
-# Database connection helpers
-alias pgc="PGPASSWORD=postgres psql -h db -U postgres -d simstudio"
-alias check-db="PGPASSWORD=postgres psql -h db -U postgres -c '\l'"
-
-# Default to workspace directory
-cd /workspace 2>/dev/null || true
-
-# Welcome message - show once per session
-if [ -z "$SIM_WELCOME_SHOWN" ]; then
-  export SIM_WELCOME_SHOWN=1
-
-  echo ""
-  echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-  echo "🚀 Sim Development Environment"
-  echo ""
-  echo "Project commands:"
-  echo "  sim-start      - Start app + socket server"
-  echo "  sim-app        - Start only main app"
-  echo "  sim-sockets    - Start only socket server"
-  echo "  sim-migrate    - Push schema changes"
-  echo "  sim-generate   - Generate migrations"
-  echo ""
-  echo "Database:"
-  echo "  pgc            - Connect to PostgreSQL"
-  echo "  check-db       - List databases"
-  echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-  echo ""
-fi
diff --git a/.dockerignore b/.dockerignore
index 3a5d3e50438..f2a2426339e 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -25,7 +25,6 @@ docs/
 
 # CI/CD and DevOps
 .github
-.devcontainer
 .husky
 docker-compose*.yml
 Dockerfile*
diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md
index d3637761fe8..bc4666f7875 100644
--- a/.github/CONTRIBUTING.md
+++ b/.github/CONTRIBUTING.md
@@ -208,44 +208,9 @@ To use local models with Sim:
    docker compose -f docker-compose.prod.yml up -d
    ```
 
-### Option 3: Using VS Code / Cursor Dev Containers
+### Option 3: Manual Setup
 
-Dev Containers provide a consistent and easy-to-use development environment:
-
-1. **Prerequisites:**
-
-   - Visual Studio Code or Cursor
-   - Docker Desktop
-   - [Remote - Containers](https://marketplace.visualstudio.com/items?itemName=ms-vscode-remote.remote-containers) extension for VS Code
-
-2. **Setup Steps:**
-
-   - Clone the repository:
-
-     ```bash
-     git clone https://github.com/<your-username>/sim.git
-     cd sim
-     ```
-
-   - Open the project in VS Code/Cursor.
-   - When prompted, click "Reopen in Container" (or press F1 and select "Remote-Containers: Reopen in Container").
-   - Wait for the container to build and initialize.
-
-3. **Start Developing:**
-
-   - Run `bun run dev:full` in the terminal or use the `sim-start` alias.
-   - This starts both the main application and the realtime socket server.
-   - All dependencies and configurations are automatically set up.
-   - Your changes will be automatically hot-reloaded.
-
-4. **GitHub Codespaces:**
-
-   - This setup also works with GitHub Codespaces if you prefer development in the browser.
-   - Just click "Code" → "Codespaces" → "Create codespace on staging".
-
-### Option 4: Manual Setup
-
-If you prefer not to use Docker or Dev Containers. **All commands run from the repository root unless explicitly noted.**
+If you prefer not to use Docker. **All commands run from the repository root unless explicitly noted.**
 
 1. **Clone and Install:**
 
@@ -359,6 +324,8 @@ Sim is built in a modular fashion where blocks and tools extend the platform's f
 > The shorter overview below is a high-level reference; the SKILL.md files are the authoritative source of truth and stay in sync with the codebase.
 >
 > **Skills have one source and one generated compatibility projection.** Edit only the canonical `.agents/skills/<name>/SKILL.md`. Cursor discovers that directory directly; Claude uses the generated `.claude/skills/<name>` symlink. After changing a canonical skill, run `bun run skills:sync` (the pre-commit hook does this automatically when a `SKILL.md` is staged). CI runs `bun run check:skills` and fails if a Claude symlink is stale or a deprecated `.claude/commands/<name>.md` or `.cursor/commands/<name>.md` projection remains. Canonical frontmatter is `name`, `description`, and optional `argument-hint`.
+>
+> **Rules work the same way.** Edit only the canonical `.claude/rules/<name>.md` (frontmatter `description` and optional `paths`). Claude reads that directory directly; Cursor uses the generated `.cursor/rules/<name>.mdc`, which `bun run skills:sync` rewrites and `bun run check:skills` verifies.
 
 ### Where to Add Your Code
 
diff --git a/.github/workflows/ci-cache-cleanup.yml b/.github/workflows/ci-cache-cleanup.yml
deleted file mode 100644
index 2888e7f0aee..00000000000
--- a/.github/workflows/ci-cache-cleanup.yml
+++ /dev/null
@@ -1,39 +0,0 @@
-name: CI Cache Cleanup
-
-# DRAINING LEGACY DISKS ONLY. test-build.yml no longer mounts a Next.js build
-# cache — the Turbopack persistent cache measured 3.2x SLOWER than no cache, so it
-# is off. But every PR open while the per-branch key was live left a 5-12 GB volume
-# behind, and nothing else reclaims them. This keeps deleting them as those PRs
-# close.
-#
-# Delete this workflow once the backlog is drained (no PR predating the cache
-# removal is still open). It is a no-op for new PRs, which never create a disk.
-
-on:
-  pull_request:
-    types: [closed]
-
-permissions:
-  contents: read
-
-jobs:
-  delete-nextjs-cache:
-    name: Delete Next.js build cache disk
-    # Sticky disks only exist on Blacksmith; the GitHub break-glass path uses
-    # actions/cache, which expires on its own.
-    if: vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith'
-    runs-on: blacksmith-2vcpu-ubuntu-2404
-    timeout-minutes: 5
-
-    steps:
-      # A hard-coded legacy drain key. It no longer mirrors anything — the
-      # Mount Next.js build cache step it used to match was removed with the
-      # cache. Do not retarget or delete it while PRs from before that removal
-      # are still open, or their 5-12 GB disks are never reclaimed.
-      # Non-blocking: PRs skipped by ci.yml's paths-ignore never made a disk,
-      # and neither does any PR opened after the removal.
-      - name: Delete sticky disk
-        uses: useblacksmith/stickydisk-delete@b41313d28b8647d72114c9ba3c96bb04061562b6 # v1
-        continue-on-error: true
-        with:
-          delete-key: ${{ github.repository }}-nextjs-cache-pull_request${{ github.event.pull_request.head.repo.fork && '-fork' || '' }}-${{ github.head_ref }}
diff --git a/.husky/pre-commit b/.husky/pre-commit
index a323fdfbd33..b18fb91eb4a 100755
--- a/.husky/pre-commit
+++ b/.husky/pre-commit
@@ -1,9 +1,9 @@
 bunx lint-staged
 
-# Regenerate skill projections when a canonical .agents/skills source is staged,
-# so .claude/skills never drifts from it. Cursor reads .agents/skills directly.
-# CI's check:skills is the backstop.
-if git diff --cached --name-only | grep -q '^\.agents/skills/.*/SKILL\.md$'; then
+# Regenerate projections when a canonical source is staged, so .claude/skills
+# never drifts from .agents/skills and .cursor/rules never drifts from
+# .claude/rules. CI's check:skills is the backstop.
+if git diff --cached --name-only | grep -qE '^\.agents/skills/.*/SKILL\.md$|^\.claude/rules/.*\.md$'; then
   bun run skills:sync
-  git add .claude/skills
+  git add .claude/skills .cursor/rules
 fi
diff --git a/AGENTS.md b/AGENTS.md
deleted file mode 100644
index b13fecd2b96..00000000000
--- a/AGENTS.md
+++ /dev/null
@@ -1,487 +0,0 @@
-# Sim Development Guidelines
-
-You are a professional software engineer. All code must follow best practices: accurate, readable, clean, and efficient.
-
-## Global Standards
-
-- **Linting / Audit**: `bun run check:api-validation` must pass on PRs. Do not introduce route-local boundary Zod schemas, direct route Zod imports, or ad-hoc client wire types — see "API Contracts" and "API Route Pattern" below
-- **Logging**: Import `createLogger` from `@sim/logger`. Use `logger.info`, `logger.warn`, `logger.error` instead of `console.log`. Inside API routes wrapped with `withRouteHandler`, loggers automatically include the request ID — no manual `withMetadata({ requestId })` needed
-- **API Route Handlers**: All API route handlers (`GET`, `POST`, `PUT`, `DELETE`, `PATCH`) must run inside `withRouteHandler`. Ordinary internal and v2 handlers use the shared JSON/binary route builders, which already apply it; never double-wrap a builder. Use raw `withRouteHandler` only for documented protocol or lifecycle exceptions. See "API Route Pattern" below
-- **Comments**: Use TSDoc for documentation. No `====` separators. No non-TSDoc comments
-- **Styling**: Never update global styles. Keep all styling local to components
-- **ID Generation**: Never use `crypto.randomUUID()`, `nanoid`, or `uuid` package. Use `generateId()` (UUID v4) or `generateShortId()` (compact) from `@sim/utils/id`
-- **Common Utilities**: Use shared helpers from `@sim/utils` instead of inline implementations:
-  - `sleep(ms)` from `@sim/utils/helpers` — never `new Promise(resolve => setTimeout(resolve, ms))`
-  - `toError(e)` from `@sim/utils/errors` — normalize caught values to `Error`
-  - `getErrorMessage(e, fallback?)` from `@sim/utils/errors` — extract message string from unknown caught value; never write `e instanceof Error ? e.message : 'fallback'`
-  - `structuredClone(value)` — built-in deep clone; never `JSON.parse(JSON.stringify(...))`
-  - `omit(obj, keys)` / `filterUndefined(obj)` from `@sim/utils/object` — object trimming; never `Object.fromEntries(Object.entries(...).filter(...))`
-  - `truncate(str, maxLength, suffix?)` from `@sim/utils/string` — never inline slice + ellipsis
-  - `backoffWithJitter(attempt, retryAfterMs, options?)` / `parseRetryAfter(header)` from `@sim/utils/retry` — shared retry pacing; never reimplement exponential backoff inline
-- **Package Manager**: Use `bun` and `bunx`, not `npm` and `npx`
-
-## Architecture
-
-### Core Principles
-
-1. Single Responsibility: Each component, hook, store has one clear purpose
-2. Composition Over Complexity: Break down complex logic into smaller pieces
-3. Type Safety First: TypeScript interfaces for all props, state, return types
-4. Predictable State: Zustand for global state, useState for UI-only concerns
-
-### Application Operation Boundary
-
-- Every protected read, write, canonical resource lookup, or authorization-sensitive reference resolution enters through an authorized application use case.
-- Define one stable semantic operation with its minimum role, workspace-key policy, allowed principal kinds, and delegated services. Internal APIs, v2 APIs, Copilot, and trusted tools call the same use case when the domain behavior is the same.
-- Surface adapters authenticate and construct a `Principal`, apply request-rate policy, parse contracts, map input, and present results. They never query protected data, decide resource authorization, implement business transactions, or record semantic audit.
-- Application use cases load canonical context, compare asserted scope, authorize current access, execute managers/repositories, project semantic audit, and trigger shared domain effects. Managers accept canonical IDs and scope, never credentials or principals.
-- Copilot is a surface adapter. Use `createCopilotApplicationAdapter` and the domain's registered operation object; do not create Copilot-only authorization or business implementations.
-- Protected compound mutations belong in one top-level semantic application operation. Do not sequence independently committing mutations in a route or tool adapter.
-- Never substitute a billing owner, uploader, creator, or API-key owner for the acting principal. Fail fast when the identity model or operation policy cannot express the caller.
-- Use the `migrate-application-operation` skill whenever creating or migrating a protected endpoint, tool command, or resource method.
-
-### Tool Execution Boundary
-
-- A tool has exactly one execution boundary. Use `InternalToolConfig.operation` when the executor can call the implementation in the same process and trust/runtime plane. Put the server handler under `apps/sim/lib/internal/<service>/execute-tool.ts` and register it in `apps/sim/lib/internal/tool-operations/registry.server.ts`.
-- `ToolConfig.request` is only for absolute external HTTP(S) provider APIs. A tool definition must never point at `/api/...`, construct an absolute URL back to this Sim app, or declare an `internal` request policy. Do not add a same-origin route merely to reuse code, normalize files, or perform authorization.
-- Real browser/API ingress and real cross-process capability boundaries may remain HTTP. Their route and any in-process tool adapter call the same application/provider operation; neither calls the other, and tool code never imports route modules.
-- Protected Sim resources still enter through authorized application use cases. The internal tool handler is a trusted surface adapter, not an authorization or database bypass.
-- `bun run check:tool-request-boundary` rejects detectable tool self-hops, the external request formatter rejects relative URLs at runtime, and the internal-operation registry test requires every operation-backed tool to have a loadable handler.
-
-### Root Structure
-
-```
-apps/
-├── sim/                    # Next.js app (UI + API routes + workflow editor)
-│   ├── app/                # Next.js app router (pages, API routes)
-│   ├── blocks/             # Block definitions and registry
-│   ├── components/         # Shared UI (emcn/, ui/)
-│   ├── executor/           # Workflow execution engine
-│   ├── hooks/              # Shared hooks (queries/, selectors/)
-│   ├── lib/                # App-wide utilities
-│   ├── providers/          # LLM provider integrations
-│   ├── stores/             # Zustand stores
-│   ├── tools/              # Tool definitions
-│   └── triggers/           # Trigger definitions
-└── realtime/               # Bun Socket.IO server (collaborative canvas)
-
-packages/
-├── audit/                  # @sim/audit
-├── auth/                   # @sim/auth — shared Better Auth verifier
-├── db/                     # @sim/db — drizzle schema + client
-├── logger/                 # @sim/logger
-├── platform-authz/         # @sim/platform-authz — workspace + workflow authz (subpath exports)
-├── realtime-protocol/      # @sim/realtime-protocol — socket op constants + zod schemas
-├── security/               # @sim/security — safeCompare
-├── tsconfig/               # shared tsconfig presets
-├── utils/                  # @sim/utils
-├── workflow-persistence/   # @sim/workflow-persistence
-└── workflow-types/         # @sim/workflow-types — pure BlockState/Loop/Parallel types
-```
-
-### Package boundaries
-
-- `apps/* → packages/*` only. Packages never import from `apps/*`.
-- `apps/realtime` intentionally avoids Next.js, React, the block/tool registry, provider SDKs, and the executor. Do not add imports from `@/lib/webhooks/providers/*`, `@/executor/*`, `@/blocks/*`, or `@/tools/*` to any package consumed by `apps/realtime`. CI enforces this via `scripts/check-monorepo-boundaries.ts` and `scripts/check-realtime-prune-graph.ts`.
-- Auth is shared across both apps via the Better Auth "Shared Database Session" pattern (same `BETTER_AUTH_SECRET`, same DB via `@sim/db`).
-
-### Naming Conventions
-
-- Components: PascalCase (`WorkflowList`)
-- Hooks: `use` prefix (`useWorkflowOperations`)
-- Files: kebab-case (`workflow-list.tsx`)
-- Stores: `stores/feature/store.ts`
-- Constants: SCREAMING_SNAKE_CASE
-- Interfaces: PascalCase with suffix (`WorkflowListProps`)
-
-## Imports
-
-**Always use absolute imports.** Never use relative imports.
-
-```typescript
-// ✓ Good
-import { useWorkflowStore } from '@/stores/workflows/store'
-
-// ✗ Bad
-import { useWorkflowStore } from '../../../stores/workflows/store'
-```
-
-Use barrel exports (`index.ts`) when a folder has 3+ exports. Do not re-export from non-barrel files; import directly from the source.
-
-### Import Order
-
-1. React/core libraries
-2. External libraries
-3. UI components (`@/components/emcn`, `@/components/ui`)
-4. Utilities (`@/lib/...`)
-5. Stores (`@/stores/...`)
-6. Feature imports
-7. CSS imports
-
-Use `import type { X }` for type-only imports.
-
-## TypeScript
-
-1. No `any` - Use proper types or `unknown` with type guards
-2. Always define props interface for components
-3. `as const` for constant objects/arrays
-4. Explicit ref types: `useRef<HTMLDivElement>(null)`
-
-## Components
-
-```typescript
-'use client' // Only if using hooks
-
-const CONFIG = { SPACING: 8 } as const
-
-interface ComponentProps {
-  requiredProp: string
-  optionalProp?: boolean
-}
-
-export function Component({ requiredProp, optionalProp = false }: ComponentProps) {
-  // Order: refs → external hooks → store hooks → custom hooks → state → useMemo → useCallback → useEffect → return
-}
-```
-
-Extract when: 50+ lines, used in 2+ files, or has own state/logic. Keep inline when: < 10 lines, single use, purely presentational.
-
-## API Contracts
-
-Boundary HTTP request and response shapes for all routes under `apps/sim/app/api/**` live in `apps/sim/lib/api/contracts/**` (one file per resource family — `folders.ts`, `chats.ts`, `knowledge.ts`, etc.). Routes never define route-local boundary Zod schemas, and clients never define ad-hoc wire types — both sides consume the same contract.
-
-- Each contract is built with `defineRouteContract({ method, path, params?, query?, body?, headers?, response: { mode: 'json', schema } })` from `@/lib/api/contracts`
-- Contracts export named schemas (e.g., `createFolderBodySchema`) AND named TypeScript type aliases (e.g., `export type CreateFolderBody = z.input<typeof createFolderBodySchema>`)
-- Clients (hooks, utilities, components) import the named type aliases from the contract file. They must never write `z.input<...>` / `z.output<...>` themselves
-- Shared identifier schemas live in `apps/sim/lib/api/contracts/primitives.ts` (e.g., `workspaceIdSchema`, `workflowIdSchema`). Reuse these instead of redefining string-based ID schemas
-- Audit script: `bun run check:api-validation` enforces boundary policy and prints ratchet metrics for route Zod imports, route-local schema constructors, route `ZodError` references, client hook Zod imports, and related counters. It must pass on PRs. `bun run check:api-validation:strict` is the strict CI gate and additionally fails on annotations with empty reasons
-
-Domain validators that are not HTTP boundaries — tools, blocks, triggers, connectors, realtime handlers, and internal helpers — may still use Zod directly. The contract rule is boundary-only.
-
-### Boundary annotations
-
-A small number of legitimate exceptions to the boundary rules are tolerated when annotated. The audit script recognizes four annotation forms:
-
-- `// boundary-raw-fetch: <reason>` — placed on the line directly above a raw `fetch(` call in client hooks (`apps/sim/hooks/queries/**`, `apps/sim/hooks/selectors/**`) AND any same-origin `/api/...` fetch elsewhere under `apps/sim/**` outside an API route handler. Use only for documented exceptions: streaming responses, binary downloads, multipart uploads, signed-URL flows, OAuth redirects, and external-origin requests
-- `// double-cast-allowed: <reason>` — placed on the line directly above an `as unknown as X` cast outside test files
-- `// boundary-raw-json: <reason>` — placed on the line directly above a raw `await request.json()` / `await req.json()` read in a route handler. Use only when the body is a JSON-RPC envelope, a tolerant `.catch(() => ({}))` parse, or otherwise cannot go through `parseRequest`
-- `// untyped-response: <reason>` — placed on the line directly above a `schema: z.unknown()` response declaration in a contract file. Use only when the response body is genuinely opaque (user-supplied data, third-party passthrough)
-
-Placement rule: the annotation must immediately precede the call or cast. Up to three non-empty preceding comment lines are tolerated, so additional context comments above the annotation are fine. The reason must be non-empty after trimming — annotations with empty reasons fail strict mode (`annotationsMissingReason`).
-
-Whole-file allowlists for routes (legitimate non-boundary or auth-handled routes that legitimately import Zod for non-boundary reasons) go through `INDIRECT_ZOD_ROUTES` in `scripts/check-api-validation-contracts.ts`, not per-line annotations.
-
-Examples:
-
-```ts
-// boundary-raw-fetch: streaming SSE chunks must be processed as they arrive
-const response = await fetch(`/api/copilot/chat/stream?chatId=${chatId}`, { signal })
-```
-
-```ts
-// double-cast-allowed: legacy provider type lacks the discriminator field we need
-const provider = config as unknown as LegacyProvider
-```
-
-## API Route Pattern
-
-Every route method must run inside `withRouteHandler`. Ordinary internal and v2 JSON/binary routes use `defineInternalJsonRoute`, `defineV2JsonRoute`, or the matching binary/stream builder. These builders already apply `withRouteHandler`; never wrap them again. Use raw `withRouteHandler` only for explicit protocol or lifecycle exceptions such as streaming, multipart control, large-body admission, OAuth, or public execution.
-
-Routes never `import { z } from 'zod'` and never define route-local boundary schemas. Declarative builders consume contracts and own authentication, admission, parsing, use-case execution, response validation, and error projection. A raw special route consumes the same contracts and validates with canonical helpers from `@/lib/api/server`, after authentication and cheap admission:
-
-- `parseRequest(contract, request, context, options?)` — fully contract-bound routes; parses params, query, body, and headers in one call. Pass `{}` for `context` on routes without route params, or the route's `context` argument when route params exist. Returns a discriminated union; check `parsed.success` and return `parsed.response` on failure
-- `validationErrorResponse(error)` and `getValidationErrorMessage(error, fallback)` — produce 400 responses from a `ZodError`
-- `validationErrorResponseFromError(error)` — when handling unknown caught errors that may or may not be a `ZodError`
-- `isZodError(error)` — type guard. Routes never use `instanceof z.ZodError`
-
-### Ordinary authorized JSON route
-
-```typescript
-export const PATCH = defineInternalJsonRoute({
-  contract: renameWidgetContract,
-  auth: internalSessionAuth,
-  operation: widgetOperations.rename,
-  rateLimit: internalRateLimits.none({ reason: 'Preserve existing internal behavior' }),
-  errorPolicy: internalWidgetErrorPolicy,
-  mapInput: ({ params, body }) => ({
-    widgetId: params.widgetId,
-    assertedWorkspaceId: params.workspaceId,
-    name: body.name,
-  }),
-  useCase: renameWidget,
-  present: ({ widget }) => ({ success: true, widget }),
-})
-```
-
-The contract, operation, and use case must agree at definition time. Authentication and request-rate admission happen before parsing; canonical loading and authorization happen in the application use case. The presenter returns only the surface success body.
-
-Routes under `apps/sim/app/api/v1/**` use the shared middleware in `apps/sim/app/api/v1/middleware.ts` for auth, rate-limit, and workspace access. Compose contract validation inside that middleware — never reimplement auth/rate-limit per-route.
-
-Never export a bare `async function GET/POST/...`. Export the result of a shared builder or, for a documented special route, `withRouteHandler(...)`.
-
-### Adding a new boundary feature end-to-end
-
-When adding a new route + client surface, follow this order. Each step has one place it lives.
-
-1. **Author the contract first** in `apps/sim/lib/api/contracts/<domain>.ts` (or a subdirectory for large domains: `knowledge/`, `selectors/`, `tools/`). Define one schema per request slice (`params`, `query`, `body`, `headers`) and one for the response, then wrap with `defineRouteContract`. Export named type aliases (`z.input` for inputs, `z.output` for outputs).
-2. **Define the semantic operation and application use case** under `apps/sim/lib/<domain>/application/`. The use case owns canonical loading, asserted-scope checks, current authorization, business behavior, semantic audit, and shared domain effects.
-3. **Implement the route adapter** in `apps/sim/app/api/<path>/route.ts` with the appropriate shared builder. Declare auth, operation, rate policy, error policy, input mapping, use case, and presenter. Auth always runs **before** parsing. Use raw `withRouteHandler` only for an explicit special route, and keep protected work in application use cases.
-4. **Add the React Query hook** in `apps/sim/hooks/queries/<domain>.ts`. Use `requestJson(contract, input)` for the call. Build a hierarchical query-key factory (`all` → `lists()` → `list(workspaceId)` → `details()` → `detail(id)`) so invalidations can target prefixes.
-5. **Use the hook in the component**. The mutation's `data` and `error` are fully typed from the contract; surface `error.message` (already extracted from the response body's `error` or `message` field by `requestJson`).
-
-### Schema review checklist (read the contract diff like a DB migration)
-
-LLMs will write contracts that compile but are sloppy. The human reviewer should optimize attention on:
-
-- **`required` vs `optional` vs `nullable` is correct**. `optional()` allows omission; `nullable()` allows `null`; chaining both creates a tri-state that's almost never what you want.
-- **Response schema matches the route's actual JSON output**. The most common drift bug — route emits a field the schema doesn't declare, or omits a required field. Walk every `NextResponse.json(...)` callsite against the schema.
-- **Error messages are descriptive**. `'fileName cannot be empty'` beats `'Required'`. Use the second arg of `min(1, '...')`, `nonempty('...')`, etc. For cross-field refines, use `superRefine` with a `path` and a message that names the failing field.
-- **Bounds are set** on arrays (`.min(1)`, `.max(N)`), strings (`.min(1).max(N)` for IDs/names), and numbers (`.min().max()` for limits/sizes).
-- **`z.unknown()` is a smell** unless the data is genuinely arbitrary (provider passthrough, user-defined tool result, JSON-RPC envelope). When kept, must be annotated `// untyped-response: <specific reason>` in a `schema:` slot.
-- **Discriminated unions over plain unions** when the wire has a discriminant field — gives clients exhaustive narrowing.
-
-CI (`bun run check:api-validation:strict`) catches structural violations (Zod imports in routes, raw `request.json()`, double casts, missing annotations). It does **not** catch these schema-quality judgments — that's the human's job in PR review.
-
-## Hooks
-
-```typescript
-interface UseFeatureProps { id: string }
-
-export function useFeature({ id }: UseFeatureProps) {
-  const idRef = useRef(id)
-  const [data, setData] = useState<Data | null>(null)
-  
-  useEffect(() => { idRef.current = id }, [id])
-  
-  const fetchData = useCallback(async () => { ... }, []) // Empty deps when using refs
-  
-  return { data, fetchData }
-}
-```
-
-## Zustand Stores
-
-Stores live in `stores/`. Complex stores split into `store.ts` + `types.ts`.
-
-```typescript
-import { create } from 'zustand'
-import { devtools } from 'zustand/middleware'
-
-const initialState = { items: [] as Item[] }
-
-export const useFeatureStore = create<FeatureState>()(
-  devtools(
-    (set, get) => ({
-      ...initialState,
-      setItems: (items) => set({ items }),
-      reset: () => set(initialState),
-    }),
-    { name: 'feature-store' }
-  )
-)
-```
-
-Use `devtools` middleware. Use `persist` only when data should survive reload with `partialize` to persist only necessary state.
-
-## React Query
-
-All React Query hooks live in `hooks/queries/`. All server state must go through React Query — never use `useState` + `fetch` in components for data fetching or mutations.
-
-### Client Boundary
-
-Hooks consume contracts the same way routes do. Every same-origin JSON call must go through `requestJson(contract, ...)` from `@/lib/api/client/request` instead of raw `fetch`:
-
-- Hooks import named type aliases from `@/lib/api/contracts/**`. Never write `z.input<...>` / `z.output<...>` in hooks, and never `import { z } from 'zod'` in client code
-- `requestJson` parses params, query, body, and headers against the contract on the way out and validates the JSON response on the way back. Hooks always forward `signal` for cancellation
-- Documented exceptions for raw `fetch`: streaming responses, binary downloads, multipart uploads, signed-URL flows, OAuth redirects, and external-origin requests. Mark each raw `fetch` with a TSDoc comment explaining which exception applies. The `// boundary-raw-fetch` annotation is required not only in client hooks but for any same-origin `/api/...` fetch anywhere under `apps/sim/**` outside an API route handler — strict CI flags these regardless of location
-
-```typescript
-import { keepPreviousData, useQuery } from '@tanstack/react-query'
-import { requestJson } from '@/lib/api/client/request'
-import { listEntitiesContract, type EntityList } from '@/lib/api/contracts/entities'
-
-async function fetchEntities(workspaceId: string, signal?: AbortSignal): Promise<EntityList> {
-  const data = await requestJson(listEntitiesContract, {
-    query: { workspaceId },
-    signal,
-  })
-  return data.entities
-}
-
-export function useEntityList(workspaceId?: string) {
-  return useQuery({
-    queryKey: entityKeys.list(workspaceId),
-    queryFn: ({ signal }) => fetchEntities(workspaceId as string, signal),
-    enabled: Boolean(workspaceId),
-    staleTime: 60 * 1000,
-    placeholderData: keepPreviousData,
-  })
-}
-```
-
-### Query Key Factory
-
-Every file must have a hierarchical key factory with an `all` root key and intermediate plural keys for prefix invalidation:
-
-```typescript
-export const entityKeys = {
-  all: ['entity'] as const,
-  lists: () => [...entityKeys.all, 'list'] as const,
-  list: (workspaceId?: string) => [...entityKeys.lists(), workspaceId ?? ''] as const,
-  details: () => [...entityKeys.all, 'detail'] as const,
-  detail: (id?: string) => [...entityKeys.details(), id ?? ''] as const,
-}
-```
-
-### Query Hooks
-
-- Every `queryFn` must forward `signal` for request cancellation
-- Every query must have an explicit `staleTime`
-- Use `keepPreviousData` only on variable-key queries (where params change), never on static keys
-
-```typescript
-export function useEntityList(workspaceId?: string) {
-  return useQuery({
-    queryKey: entityKeys.list(workspaceId),
-    queryFn: ({ signal }) => fetchEntities(workspaceId as string, signal),
-    enabled: Boolean(workspaceId),
-    staleTime: 60 * 1000,
-    placeholderData: keepPreviousData, // OK: workspaceId varies
-  })
-}
-```
-
-### Mutation Hooks
-
-- Use targeted invalidation (`entityKeys.lists()`) not broad (`entityKeys.all`) when possible
-- For optimistic updates: use `onSettled` (not `onSuccess`) for cache reconciliation — `onSettled` fires on both success and error
-- Don't include mutation objects in `useCallback` deps — `.mutate()` is stable in TanStack Query v5
-
-```typescript
-export function useUpdateEntity() {
-  const queryClient = useQueryClient()
-  return useMutation({
-    mutationFn: async (variables) => { /* ... */ },
-    onMutate: async (variables) => {
-      await queryClient.cancelQueries({ queryKey: entityKeys.detail(variables.id) })
-      const previous = queryClient.getQueryData(entityKeys.detail(variables.id))
-      queryClient.setQueryData(entityKeys.detail(variables.id), /* optimistic */)
-      return { previous }
-    },
-    onError: (_err, variables, context) => {
-      queryClient.setQueryData(entityKeys.detail(variables.id), context?.previous)
-    },
-    onSettled: (_data, _error, variables) => {
-      queryClient.invalidateQueries({ queryKey: entityKeys.lists() })
-      queryClient.invalidateQueries({ queryKey: entityKeys.detail(variables.id) })
-    },
-  })
-}
-```
-
-## Styling
-
-Use Tailwind only, no inline styles. Use `cn()` from `@/lib/core/utils/cn` for conditional classes.
-
-```typescript
-<div className={cn('base-classes', isActive && 'active-classes')} />
-```
-
-For equal height and width, use the `size-*` shorthand — never `h-[Npx] w-[Npx]` or `h-N w-N`. Default icon size is `size-[14px]`.
-
-```typescript
-<Icon className='size-[14px] text-[var(--text-icon)]' />
-```
-
-On chip components (see "EMCN Components"), drive chrome through PROPS, not `className`: `error` for the error state, `icon`/`endAdornment` for adornments, `inputClassName` for the inner field. `className` carries ONLY layout/sizing — never re-specify canonical chrome (border, fill, radius, height, text/icon color) or add focus rings. Full consumer rules in `.claude/rules/sim-styling.md`.
-
-## EMCN Components
-
-Import from `@/components/emcn`, never from subpaths (except CSS files). Use CVA only when 2+ genuine variants exist; otherwise plain `cn()`.
-
-The chip family is the canonical UI chrome and is progressively replacing the legacy EMCN primitives — always reach for the chip equivalent: `ChipInput` over `Input`, `ChipTextarea` over `Textarea`, `ChipModal`/`ChipModalField` over `Modal`, `ChipSelect`/`ChipCombobox` (searchable) or `ChipDropdown` (simple menu-select) over `Select`/`Combobox`, `ChipSwitch` over `Switch`, `ChipDatePicker` over a raw date field, `Chip`/`ChipLink` for pill buttons/links, `ChipTag` for inline tags/badges. For context/action menus the canonical control is `DropdownMenu` (not a chip, but the standard menu — not a hand-rolled popover). Components OWN their chrome (single source of truth) — consumers pass props, not class overrides. Authoring rules in `.claude/rules/emcn-components.md`; consumer rules in `.claude/rules/sim-styling.md`.
-
-Inside a `ChipModalBody`, EVERY labeled field MUST be a `ChipModalField` — never hand-roll a field row (a raw `<div>` + a hand-rolled `<p>`/`<label>` title + a bare `ChipInput`/`ChipTextarea`). `ChipModalBody` applies `px-2` + `gap-4`; `ChipModalField` adds ANOTHER `px-2`, so each field lands at effective `px-4`, exactly matching `ChipModalHeader`/`ChipModalFooter` (`px-4`). Hand-rolled rows skip the field's gutter and sit at `px-2`, visibly misaligned with the header/footer. For controls `ChipModalField` does not cover (`ChipCombobox`, `ChipSelect`, `DatePicker`, `TimePicker`, `ButtonGroup`, arbitrary JSX), use `ChipModalField type='custom'` with a `title` — it still applies the `px-2` gutter and renders the canonical `Label`. Drive intent via props (`title`/`value`/`onChange`/`error`/`hint`/`required`/`flush`); never pass `variant`/`className`/`id` to the inner control, and never add a body-level wrapper `<div>` with a custom `gap-*` that fights `ChipModalBody`'s `gap-4`.
-
-## Design-System Consolidation
-
-Principles when building or migrating shared UI:
-
-- One canonical source of truth for shared chrome — compose it, never re-derive it per consumer.
-- Props-driven API over `className` overrides — reaching for `className` to change chrome is a smell; expose a prop instead.
-- Discriminated-union props for modes (e.g. `ChipDropdown multiple`) over near-duplicate components.
-- Delete legacy variants/components after migration — no parallel paths left behind.
-- Plain `cn()` for a single error/state toggle; CVA only for genuinely multiple variants.
-- Align consumers to the canonical defaults — normal weight, `--text-body` text, `--text-icon` icons.
-- Verify referenced CSS vars exist — an undefined var silently falls back to `currentColor` (black-bug).
-
-## Testing
-
-Use Vitest. Test files: `feature.ts` → `feature.test.ts`. See `.cursor/rules/sim-testing.mdc` for full details.
-
-### Global Mocks (vitest.setup.ts)
-
-`@sim/db`, `@sim/db/schema`, `drizzle-orm`, `@sim/logger`, `@sim/platform-authz/workflow`, `@/blocks/registry`, `@/lib/auth`, `@/lib/auth/hybrid`, `@/lib/core/utils/request`, `@trigger.dev/sdk`, and store mocks are provided globally. Do NOT re-mock them unless overriding behavior. (The `vi.mock('@/lib/auth', ...)` in the example below is an override of the global mock so `getSession` can be controlled per-test.)
-
-### Standard Test Pattern
-
-```typescript
-/**
- * @vitest-environment node
- */
-import { createMockRequest } from '@sim/testing'
-import { beforeEach, describe, expect, it, vi } from 'vitest'
-
-const { mockGetSession } = vi.hoisted(() => ({
-  mockGetSession: vi.fn(),
-}))
-
-vi.mock('@/lib/auth', () => ({
-  auth: { api: { getSession: vi.fn() } },
-  getSession: mockGetSession,
-}))
-
-import { GET } from '@/app/api/my-route/route'
-
-describe('my route', () => {
-  beforeEach(() => {
-    vi.clearAllMocks()
-    mockGetSession.mockResolvedValue({ user: { id: 'user-1' } })
-  })
-  it('returns data', async () => { ... })
-})
-```
-
-### Performance Rules
-
-- **NEVER** use `vi.resetModules()` + `vi.doMock()` + `await import()` — use `vi.hoisted()` + `vi.mock()` + static imports
-- **NEVER** use `vi.importActual()` — mock everything explicitly
-- **NEVER** use `mockAuth()`, `mockConsoleLogger()`, `setupCommonApiMocks()` from `@sim/testing` — they use `vi.doMock()` internally
-- **Mock heavy deps** (`@/blocks`, `@/tools/registry`, `@/triggers`) in tests that don't need them
-- **Use `@vitest-environment node`** unless DOM APIs are needed (`window`, `document`, `FormData`)
-- **Avoid real timers** — use 1ms delays or `vi.useFakeTimers()`
-
-Use `@sim/testing` mocks/factories over local test data.
-
-## Utils Rules
-
-- Never create `utils.ts` for single consumer - inline it
-- Create `utils.ts` when 2+ files need the same helper
-- Check existing sources in `lib/` before duplicating
-
-## Adding Integrations
-
-New integrations are built in order: **Tools** → **Block** → **Icon** → (optional) **Trigger**. Always look up the service's API docs first.
-
-Two hard rules that the skills assume:
-
-- **Tool IDs are `snake_case`** (`service_action`) and must be registered in `tools/registry.ts`; blocks register in `blocks/registry.ts` (alphabetically).
-- **`tools.config.tool` runs during serialization (before variable resolution)** — never do `Number()` or other type coercions there, or dynamic references like `<Block.output>` are destroyed. Put all type coercions in `tools.config.params`, which runs during execution after variables resolve.
-
-For the full authoring instructions — SubBlock property tables, `condition`/`dependsOn`/`required`/`mode`/`canonicalParamId` syntax, required block metadata (`integrationType`, `tags`, `authMode`, `docsLink`, `{Service}BlockMeta`), file-input/`normalizeFileInput` patterns, and checklists — use the skills: `/add-integration` (end-to-end), `/add-tools`, `/add-block`, `/add-trigger`.
-
-## Tables
-
-Table column types are registry entries in `apps/sim/lib/table/column-types/` — one file per type owning its label, icon, storage cast, coercion, validation, conversion compatibility, formatting, and editor. `Record<ColumnType, …>` on `registry.ts` and `registry.server.ts` is a compile-time completeness gate: adding a type to the union errors until both entries exist.
-
-Never add a `case 'sometype':` outside `column-types/` — a missing arm fails silently (a wrong `jsonbCast` breaks every filter on the column). If a consumer needs per-type knowledge, add a registry field. Use `/add-column-type` for the full procedure.
diff --git a/AGENTS.md b/AGENTS.md
new file mode 120000
index 00000000000..681311eb9cf
--- /dev/null
+++ b/AGENTS.md
@@ -0,0 +1 @@
+CLAUDE.md
\ No newline at end of file
diff --git a/CLAUDE.md b/CLAUDE.md
index cc25ad704c0..b0f73d13053 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -429,7 +429,7 @@ Principles when building or migrating shared UI:
 
 ## Testing
 
-Use Vitest. Test files: `feature.ts` → `feature.test.ts`. See `.cursor/rules/sim-testing.mdc` for full details.
+Use Vitest. Test files: `feature.ts` → `feature.test.ts`. See `.claude/rules/sim-testing.md` for full details.
 
 ### Global Mocks (vitest.setup.ts)
 
diff --git a/apps/sim/package.json b/apps/sim/package.json
index ec558e036bc..aab01234f88 100644
--- a/apps/sim/package.json
+++ b/apps/sim/package.json
@@ -20,7 +20,6 @@
     "build": "bun run build:sandbox-bundles && NODE_OPTIONS='--max-old-space-size=8192' next build",
     "build:sandbox-bundles": "bun run ./lib/execution/sandbox/bundles/build.ts",
     "start": "next start",
-    "prepare": "cd ../.. && bun husky",
     "test": "vitest run",
     "test:scim:e2e": "bun run scripts/test-scim-e2e.ts",
     "test:watch": "vitest",
diff --git a/package.json b/package.json
index 080c1582317..768902f6a06 100644
--- a/package.json
+++ b/package.json
@@ -114,7 +114,7 @@
     "test:workflow-sync": "bun --no-env-file scripts/test-workflow-sync.ts",
     "type-check": "turbo run type-check",
     "release": "bun run scripts/create-single-release.ts",
-    "test:scripts": "vitest run --config vitest.scripts.config.ts"
+    "test:scripts": "vitest run --config scripts/vitest.config.ts"
   },
   "overrides": {
     "react": "19.2.4",
diff --git a/renovate.json b/renovate.json
deleted file mode 100644
index eb451c8ebc8..00000000000
--- a/renovate.json
+++ /dev/null
@@ -1,80 +0,0 @@
-{
-  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": ["config:recommended"],
-  "timezone": "America/Los_Angeles",
-  "schedule": ["before 6am on Monday"],
-  "minimumReleaseAge": "7 days",
-  "osvVulnerabilityAlerts": true,
-  "vulnerabilityAlerts": {
-    "enabled": true,
-    "addLabels": ["security"],
-    "schedule": ["at any time"],
-    "minimumReleaseAge": null
-  },
-  "dependencyDashboard": true,
-  "labels": ["dependencies"],
-  "prConcurrentLimit": 5,
-  "prHourlyLimit": 2,
-  "rangeStrategy": "replace",
-  "lockFileMaintenance": {
-    "enabled": true,
-    "schedule": ["before 6am on Monday"]
-  },
-  "packageRules": [
-    {
-      "description": "Group compatible non-major npm updates that are not in a coupled family",
-      "matchManagers": ["bun"],
-      "matchUpdateTypes": ["minor", "patch"],
-      "groupName": "npm non-major dependencies"
-    },
-    {
-      "description": "Keep the generated AWS and Smithy release families aligned",
-      "matchPackageNames": ["@aws-sdk/**", "@smithy/**"],
-      "groupName": "AWS SDK"
-    },
-    {
-      "description": "Keep OpenTelemetry API, SDK, and exporters on compatible release lines",
-      "matchPackageNames": ["@opentelemetry/**"],
-      "groupName": "OpenTelemetry"
-    },
-    {
-      "description": "Keep React, Next.js, and their platform packages aligned",
-      "matchPackageNames": [
-        "react",
-        "react-dom",
-        "next",
-        "@next/**",
-        "@types/react",
-        "@types/react-dom"
-      ],
-      "groupName": "React and Next.js"
-    },
-    {
-      "description": "Keep Radix primitives on one tested release family",
-      "matchPackageNames": ["@radix-ui/**"],
-      "groupName": "Radix UI"
-    },
-    {
-      "description": "Keep TipTap extensions and ProseMirror bindings aligned",
-      "matchPackageNames": ["@tiptap/**"],
-      "groupName": "TipTap"
-    },
-    {
-      "description": "Keep React Email packages and CLI aligned",
-      "matchPackageNames": ["react-email", "@react-email/**"],
-      "groupName": "React Email"
-    },
-    {
-      "description": "Keep Trigger.dev runtime, build package, and CLI aligned",
-      "matchPackageNames": ["@trigger.dev/**", "trigger.dev"],
-      "groupName": "Trigger.dev"
-    },
-    {
-      "description": "Group immutable GitHub Actions digest refreshes",
-      "matchManagers": ["github-actions"],
-      "matchUpdateTypes": ["digest"],
-      "groupName": "GitHub Actions digests",
-      "minimumReleaseAge": null
-    }
-  ]
-}
diff --git a/scripts/check-script-test-coverage.ts b/scripts/check-script-test-coverage.ts
index 87dc148c458..e92dafdfe13 100644
--- a/scripts/check-script-test-coverage.ts
+++ b/scripts/check-script-test-coverage.ts
@@ -1,11 +1,11 @@
 #!/usr/bin/env bun
 /**
- * Asserts every `scripts/*.test.ts` file is collected by the root Vitest config.
+ * Asserts every `scripts/*.test.ts` file is collected by the scripts Vitest config.
  *
  * The root `test` script once chained a hand-maintained list of `test:*` entries, and a
  * hand-maintained list silently drifts from the files on disk: a test added without a matching
  * entry never runs, in CI or locally, and nothing reports it. `scripts/check-migrations-safety.test.ts`
- * sat unreferenced and green for exactly that reason. The root `vitest.scripts.config.ts` now collects
+ * sat unreferenced and green for exactly that reason. `scripts/vitest.config.ts` now collects
  * the directory by glob, so drift can only come from a file the glob does not match (a test in a
  * subdirectory, a different suffix) or from the `test` script no longer chaining `test:scripts`.
  * This guard checks both by asking Vitest which files it would run.
@@ -42,7 +42,7 @@ if (!reachableScripts('test').has('test:scripts')) {
 }
 
 const listed = Bun.spawnSync(
-  ['bunx', 'vitest', 'list', '--json', '--filesOnly', '--config', 'vitest.scripts.config.ts'],
+  ['bunx', 'vitest', 'list', '--json', '--filesOnly', '--config', 'scripts/vitest.config.ts'],
   {
     cwd: ROOT,
   }
@@ -66,11 +66,11 @@ const orphaned = onDisk.filter((file) => !collected.has(file))
 if (orphaned.length > 0) {
   console.error(
     `Script tests never run by \`bun run test\`:\n${orphaned.map((file) => `  - ${file}`).join('\n')}\n` +
-      'Make sure the root `vitest.scripts.config.ts` include glob matches them.'
+      'Make sure the `scripts/vitest.config.ts` include glob matches them.'
   )
   process.exit(1)
 }
 
 console.log(
-  `Script test coverage passed: ${onDisk.length} script tests collected by the root Vitest config.`
+  `Script test coverage passed: ${onDisk.length} script tests collected by the scripts Vitest config.`
 )
diff --git a/scripts/sync-skills.ts b/scripts/sync-skills.ts
index a472d883ea9..bf9914a11bf 100644
--- a/scripts/sync-skills.ts
+++ b/scripts/sync-skills.ts
@@ -1,25 +1,44 @@
 /**
- * Generate the per-tool skill projections from the canonical skill sources so
- * every supported agent surface stays aligned.
+ * Generate the per-tool skill and rule projections from the canonical sources
+ * so every supported agent surface stays aligned.
  *
- * Canonical source of truth: `.agents/skills/<name>/SKILL.md`
+ * Skills — canonical source of truth: `.agents/skills/<name>/SKILL.md`
  *   frontmatter: `name`, `description`, optional `argument-hint`; then the body.
  *
- * Projection (generated — do not hand-edit):
+ *   Projection (generated — do not hand-edit):
  *   - `.claude/skills/<name>` — symlink to the complete canonical skill directory.
  *
- * Cursor discovers `.agents/skills` directly, so it needs no projection.
- * Deprecated `.claude/commands/<name>.md` and `.cursor/commands/<name>.md`
- * projections are removed when syncing and treated as stale in check mode.
+ *   Cursor discovers `.agents/skills` directly, so it needs no projection.
+ *   Deprecated `.claude/commands/<name>.md` and `.cursor/commands/<name>.md`
+ *   projections are removed when syncing and treated as stale in check mode.
  *
- * Claude receives the complete skill directory so bundled resources remain
- * available.
+ *   Claude receives the complete skill directory so bundled resources remain
+ *   available.
+ *
+ * Rules — canonical source of truth: `.claude/rules/<name>.md`
+ *   frontmatter: `description`, optional `paths` list; then the body. Claude
+ *   reads these directly.
+ *
+ *   Projection (generated — do not hand-edit):
+ *   - `.cursor/rules/<name>.mdc` — same body under Cursor's frontmatter:
+ *     `description`, and `globs` from `paths` or `alwaysApply: true` when the
+ *     rule has none.
  *
  * Usage:
  *   bun run scripts/sync-skills.ts           # write projections
  *   bun run scripts/sync-skills.ts --check   # fail (exit 1) if any projection is stale
  */
-import { lstat, mkdir, readdir, readFile, readlink, rm, rmdir, symlink } from 'node:fs/promises'
+import {
+  lstat,
+  mkdir,
+  readdir,
+  readFile,
+  readlink,
+  rm,
+  rmdir,
+  symlink,
+  writeFile,
+} from 'node:fs/promises'
 import { dirname, isAbsolute, relative, resolve, sep } from 'node:path'
 import { fileURLToPath } from 'node:url'
 
@@ -29,6 +48,8 @@ const CANONICAL_DIR = resolve(ROOT, '.agents/skills')
 const CLAUDE_SKILLS_DIR = resolve(ROOT, '.claude/skills')
 const LEGACY_CLAUDE_COMMANDS_DIR = resolve(ROOT, '.claude/commands')
 const LEGACY_CURSOR_COMMANDS_DIR = resolve(ROOT, '.cursor/commands')
+const CANONICAL_RULES_DIR = resolve(ROOT, '.claude/rules')
+const CURSOR_RULES_DIR = resolve(ROOT, '.cursor/rules')
 
 interface Skill {
   name: string
@@ -73,6 +94,110 @@ async function loadCanonicalSkills(): Promise<Skill[]> {
   return skills
 }
 
+interface Rule {
+  name: string
+  description: string
+  paths: string[]
+  body: string
+}
+
+/** Parse a canonical rule: `description`, optional `paths` list, then the body. */
+function parseRule(name: string, raw: string): Rule {
+  if (!raw.startsWith('---\n')) {
+    throw new Error(`${name}: rule must start with a '---' frontmatter block`)
+  }
+  const end = raw.indexOf('\n---\n', 4)
+  if (end === -1) throw new Error(`${name}: unterminated frontmatter block`)
+  const frontmatter = raw.slice(4, end).split('\n')
+  const body = raw.slice(end + '\n---\n'.length).replace(/^\n+/, '')
+
+  let description: string | undefined
+  const paths: string[] = []
+  let inPaths = false
+  for (const entry of frontmatter) {
+    if (entry.startsWith('description:')) {
+      description = entry.slice('description:'.length).trim()
+      inPaths = false
+    } else if (entry === 'paths:') {
+      inPaths = true
+    } else if (inPaths && /^\s+- /.test(entry)) {
+      paths.push(
+        entry
+          .replace(/^\s+- /, '')
+          .trim()
+          .replace(/^"(.*)"$/, '$1')
+      )
+    } else {
+      inPaths = false
+    }
+  }
+  if (!description) throw new Error(`${name}: missing 'description' in frontmatter`)
+  if (!isPlainYamlScalar(description)) {
+    throw new Error(
+      `${name}: 'description' must be a plain YAML string (no leading quote or indicator, no ': ' or ' #', and not a bare boolean, null, number, or date) so both Claude and Cursor parse it`
+    )
+  }
+  return { name, description, paths, body }
+}
+
+/**
+ * Whether a value survives as an unquoted YAML plain scalar. The canonical rule
+ * frontmatter is written by hand and read by Claude as-is, so a description that
+ * needs quoting would silently break its `paths` there too; refuse it at the
+ * source instead of only quoting the projection.
+ */
+function isPlainYamlScalar(value: string): boolean {
+  if (value !== value.trim()) return false
+  if (/^[-?:,[\]{}#&*!|>'"%@`]/.test(value)) return false
+  if (value.includes(': ') || value.includes(' #')) return false
+  if (value.endsWith(':')) return false
+  return !IMPLICITLY_TYPED_SCALAR.test(value)
+}
+
+/**
+ * Plain scalars a YAML 1.1 or 1.2 reader resolves to something other than a
+ * string: booleans, null, integers (decimal, hex, octal, binary, underscored),
+ * floats (including .inf/.nan), and dates or timestamps.
+ */
+const IMPLICITLY_TYPED_SCALAR = new RegExp(
+  [
+    '^(?:',
+    '~|null|true|false|yes|no|on|off|y|n',
+    '|[-+]?(?:0b[01_]+|0o?[0-7_]+|0x[0-9a-f_]+|[0-9][0-9_]*(?::[0-5]?[0-9])*)',
+    '|[-+]?(?:[0-9][0-9_]*)?\\.[0-9_]*(?:e[-+]?[0-9]+)?',
+    '|[-+]?[0-9][0-9_]*(?:\\.[0-9_]*)?e[-+]?[0-9]+',
+    '|[-+]?\\.(?:inf|nan)',
+    '|[0-9]{4}-[0-9]{1,2}-[0-9]{1,2}(?:[tT ].*)?',
+    ')$',
+  ].join(''),
+  'i'
+)
+
+async function loadCanonicalRules(): Promise<Rule[]> {
+  const entries = await readdir(CANONICAL_RULES_DIR)
+  const rules: Rule[] = []
+  for (const file of entries.filter((f) => f.endsWith('.md')).sort()) {
+    const raw = await readFile(resolve(CANONICAL_RULES_DIR, file), 'utf8')
+    rules.push(parseRule(file.slice(0, -'.md'.length), raw))
+  }
+  return rules
+}
+
+/** Render the Cursor `.mdc` projection of a canonical rule. */
+function renderCursorRule(rule: Rule): string {
+  const scope = rule.paths.length > 0 ? `globs: ${JSON.stringify(rule.paths)}` : 'alwaysApply: true'
+  return [
+    '---',
+    `description: ${JSON.stringify(rule.description)}`,
+    scope,
+    '---',
+    '',
+    `<!-- Generated from .claude/rules/${rule.name}.md by \`bun run skills:sync\`. Edit the source, not this file. -->`,
+    '',
+    rule.body,
+  ].join('\n')
+}
+
 /** Find generated Claude links whose canonical skill no longer exists. */
 async function findOrphanedClaudeLinks(expectedPaths: ReadonlySet<string>): Promise<string[]> {
   const entries = await readdir(CLAUDE_SKILLS_DIR, { withFileTypes: true }).catch(
@@ -150,6 +275,29 @@ async function main() {
     if (!check) await rm(path)
   }
 
+  const rules = await loadCanonicalRules()
+  const expectedCursorRules = new Set<string>()
+  for (const rule of rules) {
+    const path = resolve(CURSOR_RULES_DIR, `${rule.name}.mdc`)
+    expectedCursorRules.add(path)
+    const rendered = renderCursorRule(rule)
+    const current = await readFile(path, 'utf8').catch(() => null)
+    if (current === rendered) continue
+    stale.push(path.replace(`${ROOT}/`, ''))
+    if (!check) {
+      await mkdir(dirname(path), { recursive: true })
+      await writeFile(path, rendered)
+    }
+  }
+  const cursorRuleFiles = await readdir(CURSOR_RULES_DIR).catch(() => [] as string[])
+  for (const file of cursorRuleFiles) {
+    if (!file.endsWith('.mdc')) continue
+    const path = resolve(CURSOR_RULES_DIR, file)
+    if (expectedCursorRules.has(path)) continue
+    stale.push(`${path.replace(`${ROOT}/`, '')} (orphaned)`)
+    if (!check) await rm(path)
+  }
+
   if (!check) {
     for (const path of [LEGACY_CLAUDE_COMMANDS_DIR, LEGACY_CURSOR_COMMANDS_DIR]) {
       await rmdir(path).catch((error: unknown) => {
@@ -163,19 +311,21 @@ async function main() {
   if (check) {
     if (stale.length > 0) {
       console.error(
-        `✗ ${stale.length} skill projection(s) are stale — run \`bun run skills:sync\`:\n` +
+        `✗ ${stale.length} skill/rule projection(s) are stale — run \`bun run skills:sync\`:\n` +
           stale.map((p) => `    ${p}`).join('\n')
       )
       process.exit(1)
     }
-    console.log(`✓ ${skills.length} canonical skills available to Claude and Cursor`)
+    console.log(
+      `✓ ${skills.length} canonical skills and ${rules.length} canonical rules available to Claude and Cursor`
+    )
     return
   }
 
   console.log(
     stale.length === 0
-      ? `✓ ${skills.length} skills already in sync — nothing to write`
-      : `✓ updated ${stale.length} skill surface(s) from ${skills.length} canonical skills`
+      ? `✓ ${skills.length} skills and ${rules.length} rules already in sync — nothing to write`
+      : `✓ updated ${stale.length} surface(s) from ${skills.length} canonical skills and ${rules.length} canonical rules`
   )
 }
 
diff --git a/scripts/vitest.config.ts b/scripts/vitest.config.ts
new file mode 100644
index 00000000000..b80735697ea
--- /dev/null
+++ b/scripts/vitest.config.ts
@@ -0,0 +1,21 @@
+import { fileURLToPath } from 'node:url'
+import { defineConfig } from 'vitest/config'
+
+/**
+ * Repo-level scripts have their own suites. One invocation for all of them
+ * replaces eighteen sequential `vitest run <file>` processes, each of which
+ * paid its own startup. `scripts/openapi` keeps its own config and runs under
+ * `check:openapi`.
+ *
+ * Lives here rather than as a root `vitest.config.ts`: Vitest walks up from a
+ * package's directory looking for that name, so a root config would silently
+ * replace the defaults of every workspace package that has none of its own.
+ * The root is pinned so `bun run test:scripts` behaves the same from any cwd.
+ */
+export default defineConfig({
+  test: {
+    root: fileURLToPath(new URL('..', import.meta.url)),
+    environment: 'node',
+    include: ['scripts/*.test.ts'],
+  },
+})
diff --git a/vitest.scripts.config.ts b/vitest.scripts.config.ts
deleted file mode 100644
index 80d14604d7b..00000000000
--- a/vitest.scripts.config.ts
+++ /dev/null
@@ -1,18 +0,0 @@
-import { defineConfig } from 'vitest/config'
-
-/**
- * Repo-level scripts have their own suites. One invocation for all of them
- * replaces eleven sequential `vitest run <file>` processes, each of which paid
- * its own startup. `scripts/openapi` keeps its own config and runs under
- * `check:openapi`.
- *
- * Deliberately not named `vitest.config.ts`: Vitest walks up from a package's
- * directory looking for that name, so a root config would silently replace
- * the defaults of every workspace package that has none of its own.
- */
-export default defineConfig({
-  test: {
-    environment: 'node',
-    include: ['scripts/*.test.ts'],
-  },
-})