v0.8.36: sim search, provenance improvements

[waleedlatif1]

• fix(auth): exclude retired organization columns from adapter queries (fix(auth): exclude retired organization columns from adapter queries #7813)
• fix(knowledge): store compact vector search candidates (fix(knowledge): store compact vector search candidates #7815)
• fix(copilot): import the block registry statically in context resolution (fix(copilot): import the block registry statically in context resolution #7816)
• fix(webhooks): authorize credential references on webhook upsert (fix(webhooks): authorize credential references on webhook upsert #7800)
• fix(provenance): bind durable reads to their source snapshots (fix(provenance): bind durable reads to their source snapshots #7814)
• feat(files): add zip file-type icon (feat(files): add zip file-type icon #7819)
• improvement(sidebar): allow dragging the sidebar slightly narrower than the default (improvement(sidebar): allow dragging the sidebar slightly narrower than the default #7820)
• fix(ci): republish the CLI when its workflow or bundled workspace code changes (fix(ci): republish the CLI when its workflow or bundled workspace code changes #7821)
• fix(cli): read the telemetry token per call so tests don't depend on the publish job's env (fix(cli): read the telemetry token per call so tests don't depend on the publish job's env #7822)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Sep 14, 2026 9:40pm UTC

[greptile-apps]

Confidence Score: 4/5

The behavior appears sound, but the webhook credential authorization must be moved behind the repository’s required application-operation boundary before merging.

Findings

1.  Route owns protected authorization ▶

Summary

This release improves durable provenance binding, webhook credential validation, knowledge-search candidate storage, Better Auth compatibility, and Copilot secret/context resolution.

• Captures table-row and uploaded-file provenance against the exact database/content snapshots read.
• Adds a transactionally maintained compact binary projection for vector-search candidates and a resumable backfill.
• Validates credentials used by webhook subscription lifecycle operations and removes client-controlled provider user identities.
• Projects retired organization columns out of Better Auth-generated queries.
• Refreshes environment-secret metadata when Copilot resolves variables and statically loads the block registry.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  EmbeddingWrite[Embedding insert or update] --> SyncTrigger[Projection sync trigger]
  SyncTrigger --> CandidateTable[(embedding_search)]
  CandidateTable --> ANN[Compact binary ANN]
  ANN --> Rerank[Full-vector reranking]
  Rerank --> AuthorizedResults[Authorized search results]

  RowRead[Table row read or write] --> Snapshot[Repeatable-read or write transaction]
  Snapshot --> ReturnedValues[Returned row values]
  Snapshot --> Provenance[Bound provenance capture]

  WebhookRequest[Webhook upsert request] --> Route[Webhook route]
  Route --> CredentialCheck[Credential authorization]
  CredentialCheck --> Subscription[Subscription and polling lifecycle]

Loading

_{Reviews (1) · Last reviewed commit: "fix(provenance): bind durable reads to t..."}