v0.9.22: docs overhaul, geo and mcp improvements

.agents/skills/add-block/SKILL.md

@@ -350,7 +350,7 @@ sourceIds.forEach((id) => delete params[id])   // subblock ids are deleted
 if (chosen !== undefined) params[group.canonicalId] = chosen
 ```
 
-So by the time `tools.config.params(inputs)` runs (`executor/handlers/generic/generic-handler.ts`),
+So by the time `tools.config.params(inputs)` runs (`executor/handlers/generic/handler.ts`),
 `params.uploadFile` and `params.fileRef` are **gone** and the value is under `params.file`. Reading a
 subblock id there yields `undefined` and silently sends no file.
 
@@ -359,7 +359,7 @@ and the first non-empty advanced value in advanced mode, so a stale value in the
 never leak. `normalizeFileInput` then handles the JSON string that advanced-mode template resolution
 produces.
 
-Note that `generic-handler` merges rather than replaces (`{ ...inputs, ...transformedParams }`), so
+Note that `generic/handler` merges rather than replaces (`{ ...inputs, ...transformedParams }`), so
 omitting a key from the returned object does not strip it from what the tool receives. Tools simply
 ignore params they do not declare.
 

.agents/skills/add-integration/SKILL.md

@@ -657,8 +657,8 @@ File Downloads and Generated Files.
 | Helper | Location | Purpose |
 |--------|----------|---------|
 | `normalizeFileInput` | `@/blocks/utils` | Normalize file params in block config |
-| `processFilesToUserFiles` | `@/lib/uploads/utils/file-utils` | Convert raw inputs to UserFile[] |
-| `downloadFileFromStorage` | `@/lib/uploads/utils/file-utils.server` | Get file Buffer from UserFile |
+| `processFilesToUserFiles` | `@/lib/uploads/utils/file` | Convert raw inputs to UserFile[] |
+| `downloadFileFromStorage` | `@/lib/uploads/utils/file.server` | Get file Buffer from UserFile |
 | `FileToolProcessor` | `@/executor/utils/file-tool-processor` | Executor-side; stores declared file outputs (not called by tools) |
 | `isUserFile` | `@/lib/core/utils/user-file` | Type guard for UserFile objects |
 | `FileInputSchema` | `@/lib/uploads/utils/file-schemas` | Zod schema for file validation |

.agents/skills/add-managed-cli/SKILL.md

@@ -15,7 +15,7 @@ Read these live sources before editing; do not copy their current entries into t
 2. `apps/sim/lib/execution/remote-sandbox/cli-tools.server.ts` — server-only recipes and recipe helpers.
 3. `apps/sim/lib/execution/remote-sandbox/cli-tools.test.ts` — catalog and supply-chain invariants.
 4. `apps/sim/lib/execution/remote-sandbox/cli-tools-boundary.test.ts` — client/server import boundary.
-5. `apps/sim/lib/execution/remote-sandbox/sandbox-spec.ts` — content-addressed hash inputs.
+5. `apps/sim/lib/execution/remote-sandbox/spec.ts` — content-addressed hash inputs.
 
 Read `resolve.ts` and `e2b.ts` only when changing provisioning mechanics. A normal catalog addition should not require UI, API, database, resolver, or provider edits; those paths derive from the registries.
 
@@ -114,7 +114,7 @@ Never commit downloaded artifacts or credentials.
 bun run --cwd apps/sim test \
   lib/execution/remote-sandbox/cli-tools.test.ts \
   lib/execution/remote-sandbox/cli-tools-boundary.test.ts \
-  lib/execution/remote-sandbox/sandbox-spec.test.ts \
+  lib/execution/remote-sandbox/spec.test.ts \
   lib/execution/remote-sandbox/resolve.test.ts \
   'app/workspace/[workspaceId]/settings/components/sandboxes/utils.test.ts'
 ```

.agents/skills/add-trigger/SKILL.md

@@ -108,7 +108,7 @@ export function build{Service}Outputs(): Record<string, TriggerOutput> {
 
 ```typescript
 import { {Service}Icon } from '@/components/icons'
-import { buildTriggerSubBlocks } from '@/triggers'
+import { buildTriggerSubBlocks } from '@/triggers/subblocks'
 import { build{Service}ExtraFields, build{Service}Outputs, {service}SetupInstructions, {service}TriggerOptions } from '@/triggers/{service}/utils'
 import type { TriggerConfig } from '@/triggers/types'
 

.agents/skills/migrate-application-operation/SKILL.md

@@ -47,7 +47,7 @@ Read these files completely before editing:
 - `apps/sim/lib/api/server/routes/internal-json-route.ts`
 - `apps/sim/lib/api/server/routes/v2-json-route.ts`
 - `apps/sim/lib/auth/internal-delegation.ts`
-- `apps/sim/lib/mothership/application/application-adapter.ts`
+- `apps/sim/lib/mothership/application/adapter.ts`
 - `apps/sim/lib/mothership/auth/application-delegation.ts`
 
 Use the file domain only as a representative golden slice:

.claude/rules/sim-content-delivery.md

@@ -0,0 +1,104 @@
+---
+description: How stored content (workspace files, run files, knowledge, table rows) reaches Chat's model, and the per-path policy. Read before changing a use case, route or Chat surface that returns such content.
+paths:
+  - "apps/sim/lib/core/application/**"
+  - "apps/sim/lib/mothership/content-delivery/**"
+  - "apps/sim/lib/workspace-files/application/**"
+  - "apps/sim/lib/knowledge/application/**"
+  - "apps/sim/lib/table/application/**"
+  - "apps/sim/lib/workflows/application/**"
+  - "apps/sim/lib/mothership/chat/application/**"
+  - "apps/sim/lib/**/application/operations.ts"
+  - "apps/sim/lib/mothership/agent-cli/**"
+  - "apps/sim/lib/mothership/tools/**"
+  - "apps/sim/app/api/v2/**"
+---
+
+# Sim Content Delivery to Chat
+
+Content derived from a provenance-bearing store reaches Chat's model only after **each item** it
+came from is admitted by the gate of the surface it leaves through. The stores are workspace files
+(and their versions), run files, knowledge documents and chunks, and table rows. "Derived" covers
+bytes, text, excerpts, chunks, cells, previews, base64, archives, rendered or compiled output,
+error text that quotes content, and public links. Counts, ordering, and match locations are ordinary
+metadata; this boundary protects supported literal secret values, not arbitrary inference. Intentional
+human uploads remain ordinary input and are not scanned.
+
+Only Copilot principals (`delegated` / `organization_delegated` with `serviceId: 'copilot'`) are
+classified. Every other caller is admitted without a provenance read, so the UI, API keys, MCP and
+the workflow executor see byte-identical results.
+
+## The pieces
+
+- `lib/core/application/content-delivery.ts`: the primitive.
+  - `admitContent(principal, sources)` returns per-item verdicts. `requireAdmittedContent` is the
+    single-item form and throws `ContentRefusedError` (403).
+  - `admitWrittenContent` is for a committed write that returns content. A refusal or gate failure
+    does not undo the write: audit and effects run, then the operation answers with the refusal.
+    Settled tool results use the same deferral, but do not claim that a mutation was saved.
+  - A source is `{ kind, id, provenance, view }`. `view` is `'complete'` (text whose every entry
+    may appear), `{ derived: value }` (only entries occurring in `value`), `'opaque'` (bytes no
+    redaction reaches: binary, base64, archives, images, public links), or `'excerpt'` (text already
+    cut before admission, where a secret fragment cannot be redacted). Both gates withhold an
+    excerpt with known secret entries; raw opaque bytes may still enter the workbench with history.
+  - `redactBeforeCutting` projects complete text before selecting a line window. The session gate
+    creates the existing redactor from the operation's bounded evidence only when a cut needs it;
+    ordinary byte reads do not decrypt a second time or reload history.
+- Gates, installed by the surface: the **registry gate** (Chat tools, CLI, mounts) imports entries
+  into the registry egress projects with; the **session gate** (run_code sandbox proxy) records
+  them into the workbench history. Neither admits `unknown`, with one exception: the CLI's direct
+  single-file download (`files get`) admits it under `unknown: 'taint'`, which latches the call's
+  registry so the whole output is withheld and the workbench copy stays unknown. It needs a
+  registry to latch; without one it refuses. One refused item never latches the shared registry.
+- `observeContentOutsideModel` reads for Chat without classifying, for content that never reaches
+  the model (the user's own edit preview; a derived file that carries its sources' provenance).
+  Name why at each use.
+
+## Rules
+
+1. **Every operation that admits Copilot declares `contentDelivery`**: `'sourced'` when its result
+   can carry content from a store, `'none'` otherwise. Definition throws
+   without it, and `copilot-route-inventory.test.ts` lists every Chat-reachable route without one.
+2. **A `sourced` use case accounts for what it returns**, before it loads content: call
+   `admitContent` (with `[]` when this call returns none). Otherwise Chat gets
+   `ContentDeliveryUnaccountedError`, and the transports turn the response into a 403.
+3. **Classify before loading bytes**, and exclude refused items per item. Withhold a whole result
+   only when its items cannot be separated (one file, one render, one compile).
+4. **A new `sourced` route needs a case in `lib/mothership/__integration__/content-delivery.integration.ts`.**
+   `copilot-content-routes.json` lists them; the suite fails for a listed route it does not drive.
+   Refresh the list with `vitest run lib/api/server/routes/copilot-route-inventory.test.ts --update=all`.
+5. **Do not reach a store's bytes around a use case for Chat.** A helper that reads content for
+   Chat goes through the gated use case, or names `observeContentOutsideModel` and why.
+
+## Policy
+
+U = `unknown`, E = exact with secret entries, R/C = unrecorded or clean. Each item is decided on its
+own unless noted.
+
+| Path | U | E | R / C |
+|---|---|---|---|
+| File download (CLI `files get`) | Delivered once; invocation withheld from the model; workbench copy stays unknown | Redacted | Delivered |
+| File download (run_code proxy) | Refused before bytes enter workbench history | Recorded in workbench history | Delivered |
+| Requested mounts | Refused before code executes, listed in `excludedInputs`; later calls remain usable | Recorded in workbench history | Delivered |
+| File text, version text, `files read`, grep | 403 | Redacted (grep redacts before clipping) | Delivered |
+| Bulk download zip | Left out, reported in the archive manifest | Left out (opaque), reported in the archive manifest | Included |
+| `files search` | Match location kept; clipped preview withheld | Same; read/grep provides safely redacted text | Returned |
+| File edit (`PATCH` content) | 403 before reading | Diagnostics redacted | Unchanged |
+| Chat public share activation, and seeing an existing link (any surface, run_code included) | 403 | 403 (a link leaves every gate) | Shares |
+| Rendered view, streamed image, inline attachments | Refused | Refused (opaque) | Delivered |
+| Doc compile | Actual file read refused | Evidence imported before broker bytes/errors return | Compiles, including dynamic file references |
+| Run file download | 403 | Redacted | Delivered |
+| Run read / execute / resume `base64` | `base64` removed, descriptor kept | Same | Inlined (sync runs only) |
+| KB chunks, search, documents, tags | Item dropped (single read: 403) | Redacted | Delivered |
+| KB export | Stream fails before refused source bytes; no successful archive receipt | Refused (opaque) | Streams originals/chunks with admission at each source |
+| Table export download | Existing unsupported Chat operation | | |
+| Table rows, query, read, `table_selection` | Row dropped (single read: 403) | Redacted | Delivered |
+| Row search | Locations returned without cell values | Same | Returned |
+| Table import from a file | Rows stored unknown | Per-cell entries; a row whose coercion rewrote a secret, or whose raw cells cannot be checked, is stored unknown | Exact-empty, as before |
+| `tools execute` | Settled result withheld, with no automatic retry | Named masking through the existing registry | Returned, subject to existing tool authorization |
+
+Search pagination and aggregate totals retain their database meaning even when an item or preview is
+withheld. Do not scan unrelated table rows or whole document collections to conceal counts.
+A refused requested mount stops code before it runs, avoiding an older file at the same sandbox path.
+Registry admission commits only when the complete item fits the existing capacity; a refused item
+must not consume capacity or permanently disable the parent registry.

.claude/rules/sim-imports.md

@@ -9,7 +9,7 @@ paths:
 
 ## Absolute Imports
 
-**Always use absolute imports.** Never use relative imports, except that a barrel `index.ts` re-exports its own siblings relatively (`export { X } from './x'`).
+**Always use absolute imports.** Never use relative imports, except that a barrel `index.ts` re-exports its own siblings relatively (`export { X } from './x'`). `check:source-conventions` ratchets this per file.
 
 ```typescript
 // ✓ Good

.claude/rules/sim-sandbox.md

@@ -4,7 +4,7 @@ paths:
   - "apps/sim/lib/execution/isolated-vm-worker.cjs"
   - "apps/sim/lib/execution/isolated-vm.ts"
   - "apps/sim/lib/execution/sandbox/**"
-  - "apps/sim/sandbox-tasks/**"
+  - "apps/sim/sandboxes/**"
 ---
 
 # Sim Sandbox — Worker Security Policy
@@ -40,7 +40,7 @@ about what must **never** live in that process.
    validation.
 
 4. **Nothing that runs in the isolate is trusted, even if we wrote it**. The
-   task `bootstrap` and `finalize` strings in `apps/sim/sandbox-tasks/` execute
+   task `bootstrap` and `finalize` strings in `apps/sim/sandboxes/` execute
    inside the isolate. They must treat `globalThis` as adversarial — no pulling
    values from it that might have been mutated by user code. The hardening
    script in `executeTask` undefines dangerous globals before user code runs.

.claude/rules/sim-styling.md

@@ -16,7 +16,8 @@ paths:
 3. **Exact values over approximations** - `h-[26px]`, not `h-6`. But **type size is
    always a named token** (`text-sm`, `text-caption`) — never `text-[14px]`, which
    sets font-size only and inherits a different line-height. The scale is under
-   "Text Scale" below.
+   "Text Scale" below. `check:source-conventions` ratchets literal sizes the scale
+   names, and style objects whose every value is static.
 4. **Transitions** - `transition-colors` for interactive states
 
 ## Conditional Classes

.claude/rules/sim-testing.md

@@ -65,6 +65,17 @@ screenshot. Write it to a caller-supplied path (`<SUITE>_REPORT_PATH`) and have
 disposable, seeds with SQL, exercises the real HTTP boundary, cleans up its fixtures, and writes
 the report.
 
+## Flaky tests
+
+A daily job (`.github/workflows/ci-flakes.yml`) files a `ci-flake` issue for every test or job
+that failed on a CI attempt and passed when the same commit was re-run, and reopens it if the
+flake recurs after it was closed. Fix the nondeterminism it names: pin the clock
+(`vi.useFakeTimers({ toFake: ['Date'] })` + `vi.setSystemTime`), give each test its own ids and
+rows, wait on the condition rather than a delay, and keep cold imports out of a test's timeout by
+importing statically. Never add a retry, a skip, or a longer timeout to make one pass; raise a
+budget only when its run history shows the budget itself is wrong, and record that evidence
+beside it.
+
 ## Unit test mechanics
 
 ### Structure