feat(coda): add permission-aware knowledge connector by waleedlatif1 · Pull Request #7915 · simstudioai/sim

waleedlatif1 · 2026-09-17T04:30:48Z

Summary

Add Coda page and table syncing with bounded, resumable indexing and source permissions.
Add organization setup, Enterprise directory mapping, and setup and implementation docs.

Type of Change

New feature

Testing

238 focused tests pass. Live tests cover page and table edits, workspace and organization ingestion, search authorization, and unchanged-content embedding reuse. Application integration tests use real Coda, Postgres, and Redis with deterministic embeddings.

Lint, all 46 repository audits, generated-artifact checks, and all workspace type checks pass. Live Enterprise directory and cross-domain grant/revoke tests remain unverified because the available account has no Enterprise organization and blocks cross-domain sharing; those limitations and reproducible test commands are documented.

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

vercel · 2026-09-17T04:30:54Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Sep 17, 2026 5:27am UTC

cubic-dev-ai

All reported issues were addressed across 24 files

_{Tip: cubic can generate docs of your entire codebase and keep them up to date. Try it here.

Fix all with cubic | Re-trigger cubic}

greptile-apps · 2026-09-17T04:34:00Z

Confidence Score: 5/5

The PR appears safe to merge; no new actionable issue or outstanding previous finding remains.

Summary

Adds a permission-aware Coda knowledge connector with bounded, resumable page and table indexing, source ACL synchronization, Enterprise directory expansion, credential integration, tests, and setup documentation.

Supports ordinary and Enterprise Coda ingestion paths.
Preserves provider permissions for organization Search while documenting workspace-wide access separately.
Adds bounded pagination, deferred hydration, response validation, and reconciliation safeguards.
Registers Coda across connector, credential, deployment, search, and documentation surfaces.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Sim source configuration] --> B[Selected Coda service-account credential]
    B --> C[Framework resolves stored API token]
    C --> D{Enterprise organization ID?}
    D -->|No| E[Coda Public API]
    D -->|Yes| F[Coda Admin API]
    E --> G[Discover documents]
    E --> H[Read pages and base-table rows]
    E --> I[Resolve owner and direct-email ACLs]
    F --> J[Discover organization documents]
    F --> K[Read plaintext page exports]
    F --> L[Read ACLs and organization directory]
    G --> M[Bounded resumable listing]
    H --> N[Deferred content hydration]
    J --> M
    K --> N
    I --> O[Permission-aware knowledge index]
    L --> O
    M --> O
    N --> O
    O --> P[Authorized Sim Search results]

_{Reviews (4) · Last reviewed commit: "fix(coda): clarify workspace access in s..."}

waleedlatif1 · 2026-09-17T04:44:28Z

@greptile

waleedlatif1 · 2026-09-17T04:44:29Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-17T04:44:34Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 27 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Tip: cubic can generate docs of your entire codebase and keep them up to date. Try it here.

Re-trigger cubic}

waleedlatif1 · 2026-09-17T05:21:18Z

The summary-only "Incorrect Credential Visibility" finding points to codaAuthParams in apps/sim/tools/coda/utils.ts. This is a system-injected accessToken resolved from the selected stored credential, not a raw API-key input supplied to the tool. visibility: 'hidden' is the required boundary here: .agents/skills/add-tools/SKILL.md defines hidden parameters as system-injected, and apps/sim/tools/coda/coda.test.ts explicitly asserts that every Coda tool keeps this token hidden. The stored credential itself remains selectable through coda-service-account; this PR adds its catalog availability and tests. The auth parameter predates this PR and is unchanged. Making it user-visible would incorrectly expose an internal credential parameter. No code change is needed for that finding.

waleedlatif1 · 2026-09-17T05:26:08Z

@greptile

waleedlatif1 · 2026-09-17T05:26:09Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-17T05:26:15Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 27 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Tip: cubic can generate docs of your entire codebase and keep them up to date. Try it here.

Re-trigger cubic}

waleedlatif1 · 2026-09-17T05:30:46Z

@greptile Please re-evaluate the remaining summary-only token visibility finding against the actual credential path and the scoped repository rule:

apps/sim/tools/AGENTS.md says hidden is for system-injected parameters, while user-only is for values the user must provide to the tool. It does not classify visibility by the provider's token issuance protocol.
apps/sim/blocks/blocks/coda.ts:381 exposes the selected service-account credential as oauthCredential, rather than exposing a raw token field.
apps/sim/lib/oauth/credential-service.ts:755 resolves a stored token-service-account secret and returns accessToken: secret.apiToken; apps/sim/lib/oauth/token-resolution.ts:260 uses that authorized service-account resolution path.
apps/sim/tools/coda/utils.ts:211 therefore correctly describes the hidden token as resolved from the selected credential. This auth declaration is unchanged from staging. The existing all-tools test at apps/sim/tools/coda/coda.test.ts:421 enforces hidden visibility.

The distinction is stored credential selection versus an injected tool parameter. Changing this parameter to user-only would incorrectly add it to tool parameter surfaces (apps/sim/tools/params.ts:288). Please assess this as a false positive under the system-injected parameter rule. The workspace-access documentation finding is fixed in the latest commit; no credential visibility change is appropriate.

waleedlatif1 · 2026-09-17T05:30:48Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-17T05:30:53Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 27 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Tip: cubic can generate docs of your entire codebase and keep them up to date. Try it here.

Re-trigger cubic}

feat(coda): add permission-aware knowledge connector

ce7a6f5

vercel Bot deployed to Preview September 17, 2026 04:32 View deployment

cubic-dev-ai Bot reviewed Sep 17, 2026

View reviewed changes

Comment thread packages/deployment-config/src/integration-availability.ts

Comment thread apps/sim/lib/knowledge/__integration__/coda-live.integration.ts Outdated

fix(coda): refine setup docs and verification coverage

c703fa5

vercel Bot deployed to Preview September 17, 2026 04:46 View deployment

cubic-dev-ai Bot reviewed Sep 17, 2026

View reviewed changes

greptile-apps Bot reviewed Sep 17, 2026

View reviewed changes

Comment thread apps/docs/content/docs/search/coda.mdx

fix(coda): clarify workspace access in setup guide

6073100

cubic-dev-ai Bot reviewed Sep 17, 2026

View reviewed changes

vercel Bot deployed to Preview September 17, 2026 05:27 View deployment

cubic-dev-ai Bot reviewed Sep 17, 2026

View reviewed changes

waleedlatif1 merged commit 431355a into staging Sep 17, 2026
34 checks passed

waleedlatif1 deleted the codex/coda-knowledge-connector branch September 17, 2026 05:48

waleedlatif1 mentioned this pull request Sep 17, 2026

v0.8.41: library, coda connector, connector sync engine hardening #7922

Merged

Conversation

waleedlatif1 commented Sep 17, 2026

Summary

Type of Change

Testing

Checklist

Uh oh!

vercel Bot commented Sep 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

greptile-apps Bot commented Sep 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Summary

Uh oh!

waleedlatif1 commented Sep 17, 2026

Uh oh!

waleedlatif1 commented Sep 17, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 17, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

waleedlatif1 commented Sep 17, 2026

Uh oh!

waleedlatif1 commented Sep 17, 2026

Uh oh!

waleedlatif1 commented Sep 17, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 17, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

waleedlatif1 commented Sep 17, 2026

Uh oh!

waleedlatif1 commented Sep 17, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 17, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vercel Bot commented Sep 17, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

greptile-apps Bot commented Sep 17, 2026 •

edited

Loading