Repository navigation
v0.9.22: docs overhaul, geo and mcp improvements - #9040
Merged
Merged
Conversation
…8996) * improvement(workflow): scope the editor by props instead of the URL The workflow editor read workspaceId/workflowId from useParams() all over its tree, so it only worked mounted at /workspace/[workspaceId]/w/[workflowId]. - WorkflowScopeProvider + useWorkflowScope/useScopedWorkflowId supply the ids; <Workflow> takes them as required props and the route page passes them in. - Previews (Preview, PreviewWorkflow, PreviewEditor) scope SubBlocks to the workspace with no workflow; /w renders Panel under a null-workflow scope. - The socket room is only what mounted editors request: Workflow always joins its workflowId and releases it on unmount; the route-param fallback is gone. - Editor navigation goes through useResourceRouter so a containing pane can intercept it. - useWand, SkillModal and the custom-tool generation hooks take workspaceId explicitly, since they also render outside the editor. Claude-Session: https://claude.ai/code/session_01UMjSAnE9M7r86o5P19ash5 * fix(workflow): release socket room requests per mount, scope previews to the enclosing editor - joinWorkflow returns a release for its own mount token, so unmounting one of two editors on the same workflow can no longer drop the other's room; leaveWorkflow is gone - PreviewScope inherits the enclosing editor's workspace before the workspace host - TSDoc on useWorkflowScope Claude-Session: https://claude.ai/code/session_01UMjSAnE9M7r86o5P19ash5
…th benchmark tooling (#8637) * feat(mothership): authorize private cross-workspace memory scopes * feat(desktop): add gated macOS computer use * fix(desktop): preserve generated computer-use contracts * fix(desktop): cancel computer use when its renderer exits * fix(desktop): complete native computer tool lifecycle * fix(desktop): support rich editors and verified Mac input batches * fix: preserve desktop observations through recovery and report app focus * Gate Search Assistant integration lookups with AppConfig (#8301) * Enable read-only integration lookups for Search Assistant * Preserve inherited tool versions in generated integration docs * Align provider tests with Search read-only operations * Gate Search integration tools with AppConfig * Preserve dev test runner isolation during promotion * Default Plan chats to independently saved Opus 5.5 Medium preferences * Remove default Mship execution cutoff and expose Slack agent prerequisites * fix(catalog): preserve credential gates for automation discovery * Add workspace specification benchmarks with isolated Plan evaluation * Add private knowledge graph selection in settings * Retain benchmark run history with comparisons and human review * chore: redeploy Sim after benchmark configuration update * Add superuser benchmark console with selected-user execution * Inspect benchmark workspaces incrementally and search generated specs * Remove benchmark cutoffs and renew active stage leases * Generate benchmark redactions from exact passages * Create owned conversations for every benchmark execution * Preserve partial benchmark answers for human review * Grade benchmark mechanics with verified reference resolution * Reconcile Plan feature with staging contracts and validation gates * Expose the Graphiti rollout gate through authorized memory scope * Share benchmark super-user eligibility with Plan and knowledge graphs * fix(plan): address eligibility, benchmark state and desktop review findings * feat: compare benchmark planner models with saved scores * test: align Plan composer and desktop fixtures with staging * fix(desktop): keep disabled computer use dormant * fix(plan): enforce benchmark and native action admission * fix(plan): preserve secret metadata during benchmark reads * fix(plan): isolate embedded CLI and checkpoint benchmark stages * fix(desktop): bound native requests and completion images * fix(plan): revalidate access and retain benchmark state * fix(plan): qualify persisted effort integration fixtures * fix(db): reconcile benchmark migrations with staging retirement * fix(db): preserve table change log in benchmark migration chain * fix(benchmarks): delete artifacts with their execution target * fix(mothership): isolate benchmark state and preserve tool completions * fix(desktop): preserve action evidence in unload completions * fix(desktop): keep projected parent references valid * fix(computer): preserve uncertainty and label permission controls * test(mothership): await actual tool cancellation completion * fix(plan): resolve review findings and trigger initialization * docs(triggers): point Linq guidance at the builder module * fix(plan): preserve fork scope and benchmark redaction boundaries * fix(plan): retry retained completions and guard benchmark drafts * fix(computer): stop completion delivery at identity reset --------- Co-authored-by: Vikhyath Mondreti <vikhyath@simstudio.ai>
…#8998) * fix(mothership): grant gated entitlements to organization Build chats Organization chats in Build or Plan work in the organization's workspaces, but the dashboards, tests and changelog entitlements only declared a workspace evaluator, so an organization owner was never granted them and the worker hid those commands (for example, the agent could not create a native dashboard from org home). Each now also grants on the organization's rollout flag; the gated operations still check the workspace they run against. Assistant turns are unchanged (no entitlements). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Lrd1NLD9qx2KBLVnw32c3E * test(mothership): cover each organization entitlement rollout Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QP1Q5MoymJi3ufphqFZfVE --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…ith relevance search (#9001) * improvement(search): rank an overflowing Confluence all-terms match with relevance search A plain Confluence query runs an all-terms text ~ search. When more pages match every word than fit on one page, Confluence orders them by raw term matches, so on a large site the right page is often not on the page returned. That page is now fetched from siteSearch, the relevance search behind Confluence's own search box, which weights titles and rarer words. An all-terms match that fits on one page, date-sorted listings, and native CQL are unchanged; the underfilled case keeps its existing relevance fallback. A relevance-ranked page reports hasMore without a cursor, since a cursor would continue a different query. * fix(search): give Jira and Confluence site pages the same shape * fix(search): keep the all-terms Confluence page when relevance ranking fails A provider error on the optional relevance request (rate limit, refusal) now keeps the all-terms page and its cursor instead of failing the site, and with it the account's other sites. Cancellation and transport errors still propagate. Relevance-ranked and ranking-unavailable pages are reported as partial. * fix(search): keep the all-terms Confluence page on any non-cancellation ranking failure The client's own request timeout and transport failures surface as plain errors, so keeping the page only for provider errors still dropped it on a slow relevance request. Any failure other than cancellation (an AbortSignal reason) now keeps the all-terms page. * fix(search): honor a caller cancellation of any reason during Confluence relevance ranking * test(search): drive Confluence ranking failures through the test client The failure cases re-mocked the client with an optional call that could return undefined, which the test type check rejects. The helper now takes the relevance result or a throwing function, and the provider-refusal and timeout cases share one table test. * fix(search): give provider searches the session cancellation, whatever its reason A search stopped with a non-error abort reason (a string) surfaced from the HTTP client unchanged, so the relevance-ranking fallback treated it as a ranking failure and returned results after the stop. Provider searches now carry the account session's signal, and the fallback checks it instead of the error's type.
…ed UI projection (#9002) * improvement(mothership): load chat transcripts as windows from a stored UI projection Chat reads returned every message's full content, tool-call params included, so opening or refreshing a long chat read and shipped tens of MB. Messages now store the chat UI's projection beside their content, the page opens on the newest window, and older history loads in behind it. * fix(mothership): keep older chat history loading through review findings Move the older-page loader out of the server-importable query module, keep a permanent page failure across reloads, bound 404 retries, cap find matches from the newest message, bound cursor seq, count only landed backfill writes, regenerate the schema mock, and skip the trigger test on push-built databases. * fix(mothership): bound chat find match allocation to the match limit
…ounts from the catalog (#9003) * fix(docs): return 404 for unknown docs paths and derive integration counts from the catalog - Pass the bundled OpenAPI specs to fumadocs in memory instead of by file path; serverless functions don't ship the spec files, so every non-prerendered docs route failed with a 500 - Set dynamicParams = false on the docs page and llms.mdx route so unknown paths are a static 404 - Generate catalog totals and derive every public integration claim from them in one unit (integrations, actions, triggers) instead of the hardcoded "1,000+" and stale comparison counts - Add a "Calling the Sim API" section to the docs llms.txt and clarify X-API-Key vs Bearer in the API docs - Redirect /triggers/api to the API deployment page * fix(seo): keep JSON-LD integration claims to the count the pages show
* feat(changelog): cover October 13 product releases * fix(changelog): frame the complete rounded operation menu
…te (#8941) * test(mothership): record non-Chat responses of shared content routes before gating Seeds one clean, secret-bearing, unknown and unrecorded item per content store and snapshots every shared content route as an API-key caller sees it, before any Chat delivery gate changes. * fix(mothership): admit stored content to Chat per item through one gate Content from workspace files, run files, knowledge and table rows now reaches Chat's model only after each item is classified and admitted by the gate of the surface it leaves through: the registry gate (Chat tools, CLI, mounts) or the session gate (run_code sandbox proxy). Unknown items are excluded per item instead of withholding whole results; items with recorded secrets are redacted where text, refused where opaque. Non-Chat callers are unchanged. Every operation that admits Copilot declares contentDelivery, and a sourced use case must account for what it returns, or Chat's transports refuse the response. Closes the bulk-download, search, run-file, base64, knowledge, share, export, table and tools-execute paths, and redacts grep lines before clipping them. * fix(mothership): address review round on content delivery Committed writes answer saved-not-shown instead of a retryable error, keep their panel refresh, and account per operation. Chat streams pin inline bytes off, taint needs a registry, compile admits before its cache, owned files bind to their context, and count/truncation oracles are closed for Chat in knowledge, files search and row search. Table selection cells are projected before escaping and coerced import cells keep their taint. * fix(mothership): close sharing, line-window and snapshot gaps in content delivery Chat may share or see links only to clean files whatever the surface, text is redacted before a line window cuts it, accounting follows a decision, cached compiles and knowledge metadata bind to the versions they show, row-search matches classify at their matched revision, and table counts follow admitted rows. * fix(mothership): refuse Chat table predicates over unsafe cells A table read whose rows, counts, cursor or affected count depend on cell values is refused for Chat, before the predicate runs, when the table has an unvouched row or a secret in a referenced column. Inline run-file bytes are collected per storage key, and table-selection fallbacks are projected. * fix(mothership): keep content delivery scoped and consistent * fix(mothership): preserve protection across content transformations * fix(mothership): preserve file read semantics * fix(mothership): preserve sharing and search semantics * fix(mothership): bind media admission to loaded files * fix(mothership): preserve content revisions and archive budgets * fix(mothership): preserve partial downloads during compilation * fix(sandbox): preserve broker error identity --------- Co-authored-by: Vikhyath Mondreti <vikhyath@simstudio.ai>
* docs(library): update sim-vs-dedicated-chatbot-builders * Pi Babysit: address PR #9012 feedback --------- Co-authored-by: Sim Pi Agent <pi@sim.ai>
…mmunication-explained (#9009) Co-authored-by: Sim Pi Agent <pi@sim.ai>
…-examples (#9008) Co-authored-by: Sim Pi Agent <pi@sim.ai>
… API in Sim (#9007) * feat(library): How to Give AI Agents Live Web Search with the You.com API in Sim * fix(library): use canonical Sim links in You.com post --------- Co-authored-by: Sim Pi Agent <pi@sim.ai> Co-authored-by: Waleed Latif <walif6@gmail.com>
…markdown for AI crawlers (#9006) * improvement(seo): fix soft 404s, per-integration freshness, and docs markdown for AI crawlers * test(seo): crawl the production build for landing SEO regressions * chore(landing): remove the post and author loading skeletons the slug pages no longer use * fix(seo): resolve docs slugs through the catalog, keep API pages negotiable, and harden the crawler suite * fix(docs): carry the landing-page backlink into integration markdown * test(seo): match the visible date attribute case-insensitively
* feat(projects): add project identity and lifecycle foundation * feat(projects): create projects with their initial environment * docs(projects): record project files follow-up * docs(projects): explain project and workspace creation flows * fix(projects): stage activation after compatible writers deploy * feat(projects): enforce membership after the staged backfill * fix(projects): retry writes after concurrent membership changes * fix(projects): align integration fixtures with membership constraints * refactor(projects): prepare compatible writers for the SQL backfill * refactor(projects): backfill through bounded SQL migration batches * fix(projects): clean up automatically created fixture Projects * fix(projects): backfill only families missing membership * fix(projects): bound the trigger installation lock window * fix(workflows): guard restore against concurrent workspace archive * fix(projects): keep workflow lifecycle guards at workspace scope * fix(workflows): guard restore against concurrent workspace archive * fix(projects): close lifecycle races and surface rollout conflicts * fix(workflows): return not found when import loses archive race * fix(projects): tighten rollout checks and deduplicate lifecycle validation * test(projects): detect missing lifecycle validation calls * test(projects): verify concurrent lifecycle lock contention * feat: establish durable file ownership and rollout compatibility Add canonical entity ownership while preserving legacy workspace writers. Make storage accounting, lifecycle cleanup, search, document artifacts, and realtime transport tolerate project-owned data before feature activation. Keep Project file user/API/tool entry points in the stacked feature change. * test: align file ownership fixtures and validation reports * refactor: persist file owners with native foreign keys * fix(db): parenthesize the file owner search index expression * test(projects): update new workspace fixtures for enforcement * fix(files): harden ownership lifecycle and realtime admission * test(files): complete Project detachment database fixture * test(files): seed required Project memberships in integration fixtures * fix(files): resolve lifecycle and search review findings * fix(realtime): fence file joins by owner-qualified room * fix(files): retain shared resources after creator deletion Keep durable workspace and Project files and file folders with a nullable live creator while preserving other creator cascades and native owner constraints. Require a creator at insertion and remove the original-creator snapshot schema and backfill. Accept missing creator attribution throughout workspace metadata, v2 serialization and UI, and authorize canonical shared file delivery against current membership. Preserve stored version authors independently. Exercise account departure/deletion, retained storage and history, rollback, and concurrent writes against real PostgreSQL. * fix(files): reconcile creator handoff with project ownership Keep shared file and folder creator references non-null by transferring them to validated successors during departure and account deletion. Discover Project-only references from prior departures, retain attribution while an environment still grants access, and transfer ownership and storage payers atomically when the final access is removed. Recheck the selected membership under lock before handoff so a concurrent replacement grant and its creator attribution remain untouched. Reconcile the unreleased creator migration and restore non-null API/CLI contracts. Integrates lifecycle 817191c and membership race fix be01225 into the file foundation. * fix(files): preserve upload history across creator handoff * fix(files): align lifecycle fixtures and conflict responses * fix(files): preserve empty history and order lifecycle locks * fix(files): retry restore names claimed by legacy writers * fix(files): make staged cleanup safe across database failures * fix(files): clean staged content after rejected commits * fix(ci): resolve manual audit base from the open pull request * fix(tests): create Project membership in desktop and CLI fixtures * fix(files): bound affected subtrees and preserve fenced revisions * fix(ci): pin the current pull request base branch * fix(files): require workspace owners for workspace-scoped files * fix(db): make file ownership provisioning replay safe * fix(tests): restore Project enforcement fixtures after migration renumbering * fix(tests): scope migration probes and align remaining Project fixtures * feat(projects): prepare workspace project column compatibility * test(projects): clean up compatibility fixtures atomically * feat(projects): move membership to workspace column with rollout bridge * test(projects): align transfer mocks with workspace membership * test(projects): provision required membership in transfer unit fixtures * improvement(workspaces): present API responses explicitly * feat(projects): prepare legacy membership with a resumable operator tool * fix(projects): support PostgreSQL 16 column migration * fix(projects): allow multi-batch copies to finish * fix(projects): support PostgreSQL 16 preparation and current fixtures * fix(projects): reconcile memberships during schema push * fix(projects): enforce safe schema push provisioning * test(projects): provision newly merged workspace fixtures * fix(projects): use the direct connection for push reconciliation * test(billing): wait for parked transactions before racing writers * test(billing): freeze the clock for exact deadline assertions * fix(projects): close operator verification and contention gaps * test(billing): stabilize member ledger timeout checks * fix(projects): await cleanup and bound backfill artifacts * fix(projects): honor operator cancellation and status exits * fix(projects): reject verification of conflicted plans * fix(projects): defer archive repair on database contention * fix(projects): coordinate read-only maintenance commands * ci(projects): use the standard PostgreSQL test coverage * fix(projects): support trigger-free column rollout * fix(projects): run bounded membership backfill before enforcement * test(projects): verify column-only archive repair assignment * fix(projects): retain healthy indexes during schema push * ci(projects): use standard integration coverage for enforcement * fix(projects): correct rollout fixtures and schema-push index * fix(projects): reconcile assigned environments before enforcement * fix(projects): preserve backfill repair and resume guarantees Lock and verify effective legacy memberships before materializing reviewed assignments and applying the shared detach policy. Reject resume reports whose code hash differs before changing their checkpoint. Isolate local pubsub subscriber failures so healthy archive subscribers still receive notifications. Extend existing CLI and real-database integration coverage for mixed memberships, concurrent and stale connector changes, unchanged mismatched reports, replay, and local subscriber delivery. * test(projects): align fixture lifecycle with enforced project ownership * test(projects): skip archive repair suite when Redis is unset * chore(projects): normalize enforcement SQL whitespace * feat(projects): commit membership authority before reconciliation * fix(projects): switch membership authority after compatible rollout * test(projects): guard optional authority fixtures explicitly * test(projects): seed authority in billing lock-order mock * fix(projects): bound authority barriers and verify push replay * fix(projects): pin operator schema and pace detach repairs * docs(projects): record native constraint rollout decisions * refactor(projects): replace integrity triggers with native foreign keys * fix(projects): recognize completed rollout without its marker * fix(projects): retire rollout marker with legacy membership * test(projects): model expansion authority in workspace move fixtures * fix(projects): keep repair reads compatible with expansion schema * fix(projects): retain project name for workspace archival * docs(projects): consolidate permanent storage rules in README * fix(files): remove stale membership imports and trigger fixture * Bound historical Project repair fixture to compatible script migrations * Address ownership lifecycle and realtime review findings * Use compatible array copies for document identity sorting * Keep foundation owned-file creation on its available billing API * refactor: name the projects flag fallback PROJECTS * test: cover ordinary PR and squash push audit bases * ci: restore upstream audit base selection * fix(db): retry public share backfill contention without losing progress * refactor(db): fold creator lifetime guard into file ownership migration * test(files): narrow recorded database insert values * fix(files): preserve owned content and generated search delivery * fix(files): preserve active artifact indexing and narrow helpers * refactor(files): narrow ownership triggers and enforce folder edges with foreign keys * fix(realtime): preserve replacement documents during delayed joins * fix(files): provision composite folder keys before references * fix(db): correct dependency patch offsets for clean installs
…atic inline styles, db access in API routes, and bare route handlers (#9013) Adds check:source-conventions, a per-file shrink-only ratchet for five written conventions nothing enforced, and bans the inline toRecord/toRecordOrNull forms in check:utils.
Retirement no longer arms the bucket-wide Project storage inventory, which deleted every project/<id>/ prefix without a row in this database. The database is not the authority for a bucket another deployment shares or for a bucket that outlives a point-in-time restore, so the inventory could permanently delete live Project files. The reconcile event stays registered with a no-op handler so rows already armed drain to completed, and the processor no longer revives dead-lettered inventory rows. Per-project immediate and post-TTL sweeps are unchanged. The Azure prefix listing no longer includes uncommitted blobs: deleteIfExists cannot remove them, so a page of them kept the sweep continuing until Azure garbage-collected the blocks.
…ncy rows (#9024) * fix(file-search): find an owner's stale dependencies from its dependency rows The dispatcher's dependency reconcile and its queue-delete check tested every ready revision of each queued owner against its dependency manifest, so a large owner cost two full walks of its ready files per pass inside the 10s dispatch statement budget. file_search_dependency now carries its build's owner (entity_type, entity_id), set by a BEFORE INSERT/UPDATE trigger from the build so the deployed app's inserts stay addressable, backfilled in 0428, and indexed concurrently by (entity_type, entity_id, build_id). Both queries now start from the owner's stale dependency rows and join to its ready revisions by build. A revision whose build has no dependency rows can never be stale, and a revision only points at a build of its own owner, so the selected rows are unchanged. Also corrects the backfill-page comment that still named the old workspace keyset index. * fix(db): run the push-path dependency backfill after the trigger DDL commits * fix(file-search): type the owner-index test seed and share the queued-owner predicate
* fix(projects): fence file writers with a shared Project lock lockWorkspaceProject now takes the Project key shared, so file writers in one Project no longer serialize against each other while exclusive holders (fork, split, archive, payer transfer, departure, account deletion, retention) still fence them. lockWorkspaceProjectExclusive keeps the old semantics for requireForkProject, splitForkProject, and archiveWorkspace. Organization departure takes the departing workspaces' Project locks before rewriting workspace owners, matching the writers' Project -> workspace row -> payer order instead of inverting it. Payer transfer skips zero-byte contributions before the destination payer check, locks Projects in one ordered call instead of one-by-one and twice, and drops the test-only changeWorkspaceStoragePayersInTx entry point. * fix(files): lock the workspace row before bulk archive and folder restore Their multi-row deleted_at updates fire the search-index trigger, which upserts the dispatch queue row before later file rows are locked. A concurrent content write holds the workspace row and a file row and then waits on that queue row, so the two could deadlock. The exclusive Project lock used to hide this; take the workspace row first, the order every file writer uses. * fix(files): lock the workspace row before path-based folder delete archives file rows
…9023) * fix(files): keep file search and compiled-doc reads off write locks - Copilot search delivery no longer takes the Project mutex, the org-wide permission-group lock, or FOR UPDATE on permission rows; the transaction only reads, and admission runs after commit. - A matched file that changed between search and delivery gets unknown provenance (preview withheld) instead of failing the whole search; a file moved out of the folder scope is dropped; owned-input checks run only for current sources. - Serving a compiled doc skips the locked search requeue when the current revision is already built from the artifact, bounds the locked path with a 1s lock_timeout, and never fails a read whose bytes were fetched. - Index coverage derives pending files as the remainder so the dependency check runs once per ready file. - Document reference scanning skips sources with no reference marker and loads the TypeScript compiler on first parse; unparseable doc source is indexed as source text again. * fix(files): validate search delivery against one snapshot and count returned hits Run the Copilot delivery validation at repeatable read so the folder scope and the file rows come from one snapshot, and report count as the hits actually returned after out-of-scope hits are dropped. * refactor(files): move rendered-artifact search requeue into artifact-ready Route the bounded requeue through configureFileSearchTransaction so it carries the same statement and transaction guards as every other file search transaction, keep the lock-free pre-check private, drop the redundant require cache, and use line comments inside function bodies.
* chore(files): tighten #8609 follow-ups - restore the fail-closed onError assertion in billing-attribution.test - drop knip ignores for contracts/projects and v2/uploads; delete unused v2 upload type aliases - resolve folderPath targets against active folders only - remove dead null-owner fallbacks and redundant NOT NULL guards - keep a retired-upload cleanup failure from replacing the part-write error - mark NOT VALID owner checks and the legacy keyset index contract-pending; fix keyset TSDoc - align PROJECTS in env.ts * chore(db): word the legacy keyset index marker as a retirement, not a table drop * refactor(files): reuse the active folder path index and drop dead owner fallbacks * test(billing): prove payer subscription lookup failures fail closed
…ared (#9029) Co-authored-by: Sim Pi Agent <pi@sim.ai>
…26 (#9030) Co-authored-by: Sim Pi Agent <pi@sim.ai>
* refactor(files): unify mutation accounting and retention * feat(project-files): add core storage and realtime operations * feat(files): unify document read subscriptions and write capabilities * fix(files): resolve capability type and artifact checks * fix(docs): hide unreleased Project file references * fix(files): address review admission and collaboration gaps * test(cli): load canonical documentation in suite setup * fix(files): bound seed reads and preserve browser snapshots * fix(files): keep read provenance private unless requested * fix(files): classify raw Project downloads as opaque
…run, not a 500 (#9047) A synchronous resume whose resumed run failed in-band (a block error) let the engine's error escape executeResumeWorkflow, and the v2 resume route mapped it to INTERNAL_ERROR. The sync branch now settles an error that carries the run's partial result as a failed sync result classified like a sync execute; errors with no run behind them still throw. The legacy resume route keeps its 400 error body for a failed run.
…9045) * fix(knowledge): serialize chunk date tags on the internal chunk read * test(knowledge): parse the presented chunk body directly
…network origin (#9049) * fix(uploads): sign transfers for in-process v2 callers that carry no network origin * test(uploads): give the MCP fixture request a client address
…adable usage ledger (#9046) * fix(resume): retry automatic resumes after read deadlines and an unreadable usage ledger * fix(resume): keep the stack on the usage-status failure log * fix(resume): log usage-status failures with the logger's redacted stack
The folder reorder route checked folder locks inside its transaction but through the global pool, checking out a second connection while the transaction held one. assertFolderMutable now takes an optional executor and the route passes its transaction handle, so the ancestry walk reads on the held connection and under the folder-tree advisory lock.
…rvice outage to non-500 statuses (#9051) * fix(api): map MCP reauth redirect, deleted-account visit, and task service outage to non-500 statuses * fix(api): type the discover route test call and keep POST refresh per-server
* fix(appconfig): share the polled snapshot with Trigger.dev runs Every Trigger.dev run starts a fresh process, and each new AppConfig session is billed for the full configuration it receives. Profiles that opt in (feature-flags, block-visibility, access-control) are now published to Redis by app processes (latest validatedAt wins), and a cold cache inside a Trigger.dev run adopts a snapshot under 120s old (tolerating 5s of clock skew) instead of opening a session. Missing, stale, unreadable, or unparseable snapshots fall back to polling as before. Trigger.dev runs never publish, and strict snapshots (outbound routing) never use the shared copy. * test(appconfig): guard the Redis URL, reuse flushMacrotask, await the older publish
* fix(byok): preserve credential ownership on lookup failures * fix(byok): isolate enterprise entitlement test fixtures
…t workflow-result race (#9056) * fix(logging): log expected outcomes below ERROR and acknowledge a lost workflow-result race - Cancelling a run that already finished is a caller-facing refusal (409 / v2 no-op), so it logs at info. Unclassified failures stay at error. - The PostHog ingest proxy logs a client disconnect at info and answers 499, the same way withRouteHandler does. Upstream failures stay at error with a 502. - A client workflow result that loses the settlement CAS to the server recording the execution's outcome now re-reads the call and gets the stored outcome back. It used to get a 500. The genuine update-failure log no longer lets its completion text overwrite the log message. - An unresolved Stripe price on enterprise or legacy pro/team plans is expected, because those prices are not in the catalog. It logs at info. Catalog plans still log at error. The duplicate warn in onSubscriptionUpdate is removed. * refactor: share legacy-plan check, classify cancel refusals through asOrchestrationError Keep unresolved prices at ERROR when a legacy plan moves to a new price, cover the execution-mismatch 404 on a lost workflow race, and drop the redundant unstub hook. * fix(billing): treat only a real price swap as a legacy plan price change previous_attributes.items is present on seat-only quantity updates too, so compare the previous item price ids with the current ones instead.
* fix(mothership): surface actionable workbench file read failures * chore(lint): drop VfsPathError from unused-exports baseline * fix(mothership): classify workbench staging failures apart from source reads * fix(mothership): report a workbench socket path as not a regular file
…proxy body limit (#9057)
* fix(mothership): drop queued tab adds the server already removed A server-applied remove effect cleared the tab locally but left the client's queued add for the same resource in the persistence queue, so the next flush re-posted it and hydration re-projected the tab. The deleted resource then went out as an open tab on every later message. The remove effect now discards that pending add (the server already removed it, so no client delete is sent). Active-tab resolution now logs a missing resource at info and a revoked one at warn instead of error; other failures still log at error. * fix(mothership): type the stale-tab regression test's stream events * fix(mothership): close in-flight and recovery gaps for server-removed tabs An add already in flight when the server's removal arrives can commit after it, so the queue now schedules a compensating delete ordered after that write settles. Queued or failed adds are still dropped with no delete. Recovered remove effects (replay or deferred batch) now discard the queued add too; previously the recovery path returned before the discard ran. * fix(mothership): gate the stale-tab test stream on the client's add, not the clock * fix(mothership): use the shared deferred helper in stale-tab tests * fix(mothership): a server restore cancels a pending compensating delete An upsert effect means the server stored the resource again, so a client delete still waiting behind an in-flight add must not run. The queue drops that removal the same way a newer add does; nothing is written since the server already holds the resource. * fix(mothership): scope stale-tab fix to queued and failed adds Drops the in-flight compensating delete and the restore cancel path: each added a new client/server ordering hazard. A server remove effect, live or on recovery, now only discards a queued or failed client add for that resource; a write already in flight is left untouched.
…d for non-charging file operations (#9058)
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.