Skip to content

v0.5.101: circular dependency mitigation, confluence enhancements, google tasks and bigquery integrations, workflow lock#3349

Merged
waleedlatif1 merged 20 commits intomainfrom
staging
Feb 26, 2026
Merged

v0.5.101: circular dependency mitigation, confluence enhancements, google tasks and bigquery integrations, workflow lock#3349
waleedlatif1 merged 20 commits intomainfrom
staging

Conversation

@waleedlatif1
Copy link
Collaborator

@waleedlatif1 waleedlatif1 commented Feb 26, 2026

icecrasher321 and others added 14 commits February 25, 2026 08:41
…3332)

* fix(call-chain): x-sim-via propagation for API blocks and MCP tools

* addres bugbot comment
* feat(google-sheets): add filter support to read operation

* ran lint
* feat(google-translate): add Google Translate integration

* fix(google-translate): api key as query param, fix docsLink, rename tool file
#3338)

* feat(google): add missing tools for Gmail, Drive, Sheets, and Calendar

* fix(google-drive): remove dead transformResponse from move tool
* feat(confluence): return page content in get page version tool

* lint
* feat(api): audit log read endpoints for admin and enterprise

* fix(api): address PR review — boolean coercion, cursor validation, detail scope

* ran lint
* feat(workflow): lock/unlock workflow from context menu and panel

* lint

* fix(workflow): prevent duplicate lock notifications, no-op guard, fix orphaned JSDoc

* improvement(workflow): memoize hasLockedBlocks to avoid inline recomputation

* feat(google-translate): add Google Translate integration (#3337)

* feat(google-translate): add Google Translate integration

* fix(google-translate): api key as query param, fix docsLink, rename tool file

* feat(google): add missing tools for Gmail, Drive, Sheets, and Calendar (#3338)

* feat(google): add missing tools for Gmail, Drive, Sheets, and Calendar

* fix(google-drive): remove dead transformResponse from move tool

* feat(confluence): return page content in get page version tool (#3344)

* feat(confluence): return page content in get page version tool

* lint

* feat(api): audit log read endpoints for admin and enterprise (#3343)

* feat(api): audit log read endpoints for admin and enterprise

* fix(api): address PR review — boolean coercion, cursor validation, detail scope

* ran lint

* unified list of languages for google translate

* fix(workflow): respect snapshot view for panel lock toggle, remove unused disableAdmin prop

* improvement(canvas-menu): remove lock icon from workflow lock toggle

* feat(audit): record audit log for workflow lock/unlock
* feat(confluence): add get user by account ID tool

* feat(confluence): add missing tools for tasks, blog posts, spaces, descendants, permissions, and properties

Add 16 new Confluence operations: list/get/update tasks, update/delete blog posts,
create/update/delete spaces, get page descendants, list space permissions,
list/create/delete space properties. Includes API routes, tool definitions,
block config wiring, OAuth scopes, and generated docs.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(confluence): add missing OAuth scopes to auth.ts provider config

The OAuth authorization flow uses scopes from auth.ts, not oauth.ts.
The 9 new scopes were only added to oauth.ts and the block config but
not to the actual provider config in auth.ts, causing re-auth to still
return tokens without the new scopes.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* lint

* fix(confluence): fix truncated get_user tool description in docs

Remove apostrophe from description that caused MDX generation to
truncate at the escape character.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(confluence): address PR review feedback

- Move get_user from GET to POST to avoid exposing access token in URL
- Add 400 validation for missing params in space-properties create/delete
- Add null check for blog post version before update to prevent TypeError

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* feat(confluence): add missing response fields for descendants and tasks

- Add type and depth fields to page descendants (from Confluence API)
- Add body field (storage format) to task list/get/update responses

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* lint

* fix(confluence): use validatePathSegment for Atlassian account IDs

validateAlphanumericId rejects valid Atlassian account IDs that contain
colons (e.g. 557058:6b9c9931-4693-49c1-8b3a-931f1af98134). Use
validatePathSegment with a custom pattern allowing colons instead.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* ran lint

* update mock

* upgrade turborepo

* fix(confluence): reject empty update body for space PUT

Return 400 when neither name nor description is provided for space
update, instead of sending an empty body to the Confluence API.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(confluence): remove spaceId requirement for create_space and fix list_tasks pagination

- Remove create_space from spaceId condition array since creating a space
  doesn't require a space ID input
- Remove list_tasks from generic supportsCursor array so it uses its
  dedicated handler that correctly passes assignedTo and status filters
  during pagination

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* ran lint

* fixed type errors

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
…s for loop support (#3346)

* fix(terminal): thread executionOrder through child workflow SSE events for loop support

* ran lint

* fix(terminal): render iteration children through EntryNodeRow for workflow block expansion

IterationNodeRow was rendering all children as flat BlockRow components,
ignoring nodeType. Workflow blocks inside loop iterations were never
rendered as WorkflowNodeRow, so they had no expand chevron or child tree.

* fix(terminal): add childWorkflowBlockId to matchesEntryForUpdate

Sub-executors reset executionOrderCounter, so child blocks across loop
iterations share the same blockId + executionOrder. Without checking
childWorkflowBlockId, updateConsole for iteration N overwrites entries
from iterations 0..N-1, causing all child blocks to be grouped under
the last iteration's workflow instance.
* feat(bigquery): add Google BigQuery integration

* fix(bigquery): add auth provider, fix docsLink and insertedRows count

* fix(bigquery): set pageToken visibility to user-or-llm for pagination

* fix(bigquery): use prefixed export names to avoid aliased imports

* lint

* improvement(bigquery): destructure tool outputs with structured array/object types

* lint
* feat(google-tasks): add Google Tasks integration

* fix(google-tasks): return actual taskId in delete response

* fix(google-tasks): use absolute imports and fix registry order

* fix(google-tasks): rename list-task-lists to list_task_lists for doc generator

* improvement(google-tasks): destructure task and taskList outputs with typed schemas

* ran lint

* improvement(google-tasks): add wandConfig for due date timestamp generation
@vercel
Copy link

vercel bot commented Feb 26, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment
Project Deployment Actions Updated (UTC)
docs Skipped Skipped Feb 26, 2026 10:53pm

Request Review

* feat(sidebar): add lock/unlock to workflow registry context menu

* docs(tools): add manual descriptions to google_books and table

* docs(tools): add manual descriptions to google_bigquery and google_tasks

* fix(sidebar): avoid unnecessary store subscriptions and fix mixed lock state toggle

* fix(sidebar): use getWorkflowLockToggleIds utility for lock toggle

Replaces manual pivot-sorting logic with the existing utility function,
which handles block ordering and no-op guards consistently.

* lint
…alues (#3347)

buildUnifiedStartOutput and buildIntegrationTriggerOutput first populate
output with schema-coerced structuredInput values (via coerceValue), then
iterate workflowInput and unconditionally overwrite those keys with raw
strings. This causes typed values (arrays, objects, numbers, booleans)
passed to child workflows to arrive as stringified versions.

Add a structuredKeys guard so the workflowInput loop skips keys already
set by the coerced structuredInput, letting coerceValue's type-aware
parsing (JSON.parse for objects/arrays, Number() for numbers, etc.)
take effect.

Fixes #3105

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
)

* feat(devin): add devin integration for autonomous coding sessions

* lint

* improvement(devin): update tool names and add manual docs description

* improvement(devin): rename tool files to snake_case and regenerate docs

* regen docs

* fix(devin): remove redundant Number() conversions in tool request bodies
@waleedlatif1
Copy link
Collaborator Author

@greptile

Copy link

@cursor cursor bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 2 potential issues.

Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

@greptile-apps
Copy link
Contributor

greptile-apps bot commented Feb 26, 2026

Greptile Summary

This release bundles multiple significant features and improvements across the Sim platform. The changes include four new integrations (Devin, Google BigQuery, Google Tasks, Google Translate), comprehensive security enhancements with a new input validation library, workflow lock/unlock functionality, audit log API endpoints, Confluence enhancements, and important bug fixes.

Major Changes:

  • New Integrations: Devin autonomous coding integration, Google BigQuery for data warehousing, Google Tasks for task management, and Google Translate for language translation
  • Security Enhancements: New comprehensive input validation library (input-validation.ts) with validators for SSRF prevention, path traversal protection, and injection attacks. Applied across Confluence and other user-facing APIs
  • Workflow Lock Feature: Complete implementation of workflow locking with UI controls in canvas menu and sidebar, notifications for locked workflows, and permission-based access controls
  • Audit Logs: New enterprise audit log API endpoints (/api/v1/audit-logs and /api/v1/admin/audit-logs) with proper authorization, pagination, and filtering
  • Confluence Enhancements: Added operations for user lookup, space management, task management, and blogpost operations. Page version endpoint now returns content alongside metadata
  • Circular Dependency Fix: Increased MAX_CALL_CHAIN_DEPTH from 10 to 25 and fixed start block bug preventing raw workflowInput from overwriting schema-coerced typed values
  • Database Optimization: Migration drops 8 redundant indexes and adds a partial index on workflow_execution_logs for running executions

Credential Handling: All new integrations follow proper credential visibility patterns - OAuth tokens use hidden visibility, user-provided API keys (Devin) use user-only visibility per custom rules.

Confidence Score: 5/5

  • This PR is safe to merge with high confidence
  • All changes demonstrate high code quality with proper security practices, comprehensive input validation, correct OAuth/credential handling following established patterns, thorough permission checks, and well-structured implementations. The security enhancements significantly improve the platform's resilience against SSRF and injection attacks. No critical issues, logic errors, or security vulnerabilities were identified.
  • No files require special attention - all implementations follow best practices

Important Files Changed

Filename Overview
apps/sim/lib/core/security/input-validation.ts New comprehensive input validation library for SSRF and injection prevention
apps/sim/app/api/v1/audit-logs/route.ts New audit log API endpoint with proper authorization and pagination
apps/sim/blocks/blocks/devin.ts New Devin integration block configuration with proper API key handling
apps/sim/blocks/blocks/google_bigquery.ts New Google BigQuery integration block with OAuth support
apps/sim/blocks/blocks/google_tasks.ts New Google Tasks integration block with OAuth support
apps/sim/executor/utils/start-block.ts Fixed bug preventing raw workflowInput from overwriting schema-coerced values
apps/sim/app/workspace/[workspaceId]/w/[workflowId]/workflow.tsx Workflow lock/unlock UI implementation with notifications and permission checks
apps/sim/lib/execution/call-chain.ts Increased MAX_CALL_CHAIN_DEPTH from 10 to 25 for circular dependency mitigation
packages/db/migrations/0160_classy_tyger_tiger.sql Database optimization: dropped 8 redundant indexes, added partial index for running executions
apps/sim/blocks/blocks/confluence.ts Enhanced Confluence block with new operations for users, spaces, tasks, and blogposts

Last reviewed commit: e07963f

Copy link
Contributor

@greptile-apps greptile-apps bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

158 files reviewed, no comments

Edit Code Review Agent Settings | Greptile

…fix space update (#3356)

- Add body-format=storage to GET-before-PUT for page and blogpost updates
  (without this, Confluence v2 API does not return body content, causing
  the fallback to erase content when only updating the title)
- Fetch current space name when updating only description (Confluence API
  requires name on PUT, so we preserve the existing name automatically)
@waleedlatif1 waleedlatif1 merged commit 4fd0989 into main Feb 26, 2026
26 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants