Changelog

Improvements

• improvement(logs): move per-block progress markers to Redis to cut write amplification
• improvement(clickhouse): expand block templates and skills, normalize tool versions
• perf(dev): SIM_DEV_MINIMAL_REGISTRY mode to slash local dev-server RAM
• improvement(execution): stop rewriting execution snapshots on reuse + skip redundant actor lookup
• perf(db): per-role Postgres connection-pool profiles
• improvement(webhooks): add trigger-age instrumentation + guard env decryption
• perf(trigger): cap concurrency on background DB tasks

Bug Fixes

• fix(webhooks): run inactive deployment-version cleanup inline on deploy
• fix(webhooks): cast json provider_config for atomic jsonb merge
• fix(sso): keep an exit affordance in edit mode when clean
• fix(security): gate credential-set invitation listing to admins and drop token
• fix(mcp): pin public IP-literal server URLs to block SSRF redirect bypass
• fix(copilot): gate post-tool output writes behind write permission
• fix(file-parsers): guard OOXML parsers against decompression-bomb memory exhaustion
• fix(security): cap KB document download size to prevent memory-exhaustion DoS
• fix(connectors): harden Zendesk connector against SSRF

Other Changes

• chore(data-drains): remove settings callout and unused InfoNote component

View changes on GitHub

Features

• feat(triggers): add Twilio SMS, Clerk, incident.io, Rootly, RevenueCat, Loops, and Sentry webhook triggers
• feat(uptimerobot): add UptimeRobot v3 integration
• feat(downdetector): add Downdetector outage-monitoring integration
• feat(rich-editor): rich markdown field + @ mentions for skill & deploy modals
• feat(settings): unify all settings pages under a shared SettingsPanel layout
• feat(access-control): page-based permission groups, tool-level deny-list, settings row-action consistency
• feat(thrive): add Thrive Learning integration (47 tools + block)
• feat(db): attribute Postgres connections by runtime via application_name

Improvements

• improvement(docs): align components with the platform design system
• refactor(emcn): consolidate date pickers onto the chip Calendar (range support + retire legacy DatePicker)
• improvement(docs): Ask AI chat grounded in the docs vector store
• improvement(docs): add Academy learning surface
• improvement(mothership): add workflow lint for custom tool/skills/mcp tool additions to agent block
• perf(frontend): bound logs DOM, kill editor re-render storms, lazy-load heavy deps

Bug Fixes

• fix(copilot): strip hosted apiKey on type-less edit ops + guard hosting.enabled
• fix(db): retry the migration connection on transient slot exhaustion
• fix(knowledge): document tag filter matches case-insensitively and by calendar day
• fix(copilot): strip platform-managed apiKey on hosted-tool blocks in edit_workflow

Other Changes

• chore(deps): bump undici to 7.28.0 and nodemailer to 9.0.1

View changes on GitHub

Features

• feat(salesforce): add Tooling API schema tools (custom field/object) + metadata query
• feat(file): workspace-scoped inline images + public-share cascade
• feat(gitlab): add repository, code-review, and CI job tools + validation fixes
• feat(secrets): ingest env secrets at container runtime instead of fanning into ECS taskdef
• feat(gitlab): support self-managed GitLab host across tools, block, triggers, webhook, and connector

Improvements

• refactor(realtime): type the socket event-handler boundary with @sim/realtime-protocol
• improvement(sandbox): mount workspace files by presigned URL instead of buffering bytes
• refactor(sse): consolidate client SSE readers behind a single typed primitive
• refactor(stores): model execution and workflow-diff state as status enums
• perf(workspace): server-prefetch home, knowledge, tables, and files list pages
• improvement(mistral): update OCR pricing to OCR 4 rate ($4/1,000 pages)
• improvement(pi): minor improvements to docs

Bug Fixes

• fix(workspace): add granular error boundaries to 7 more workspace segments
• fix(ssr): harden credential query-key factory + fetchers against the 'use client' stub bug
• fix(tables): SSR crash from tableKeys in a 'use client' module + drop redundant flushChunks

View changes on GitHub

Features

• feat(file): include public share status in File read output
• feat(file): add Manage Sharing operation to the File block
• feat(pii): publish PII image to GHCR and add Presidio sidecar to Helm chart
• feat(data-retention): workspace-level overrides for retention and PII
• feat(billing): unify upgrade routing with reason context + storage/tables limit emails
• feat(guardrails): PII redaction via Presidio sidecar (native VIN, per-rule language)
• feat(pii): build & own combined PII (analyzer + anonymizer) image
• feat(pi): add pi coding agent harness
• feat(trigger): add trigger-eu-region flag to switch runs to eu-central-1
• feat(providers): add Sakana AI provider with Fugu models

Improvements

• improvement(access-controls): ui/ux improvements
• improvement(pi): prompting to ensure harness knows push is deterministic
• refactor(frontend-arch): migrate server state to React Query, collapse duplicate workflow-state cache, granular error boundaries

Bug Fixes

• fix(enrichment): stop PDL billing on no-match via required-field gating
• fix(skills): fix skills icon showing up
• fix(trigger): mark cpu-features external to fix deploy build
• fix(pii): listen on 5001 to avoid app :3000 collision (awsvpc)

View changes on GitHub

Features

• feat(url-state): adopt nuqs for type-safe URL query-param state

Bug Fixes

• fix(state): align server/client state with best practices (query-key bugs, persist hygiene, useState)
• fix(mcp): missing isDeployed in contract breaking settings, parameter overrides lack of clarity

View changes on GitHub

Features

• feat(triggers): add GitLab, PagerDuty, and Zendesk webhook triggers
• feat(connectors): add Google Meet knowledge base connector
• feat(scheduled-tasks): expose Google Calendar-style recurrence options
• feat(pii): gate data retention PII redaction behind feature flag
• feat(files): inline rich markdown editor
• feat(files): password, email-OTP, and SSO auth for public file shares
• feat(vfs): add lazy vfs + remove dynamic fields for prompt caching hits
• feat(enrichment): add enrichment details sidebar with cost + provider cascade
• feat(logs): redact PII from workflow logs via configurable rules
• feat(tables): raise per-plan table limits (free 5/50k, pro 100/100k, max 1k/500k)
• feat(files): public share links for workspace files
• feat(mship): add parallel subagents, improve streaming performance

Improvements

• improvement(path): append, patch snapshot based streaming
• improvement(scheduled-tasks): render prompt chips in task details and align weekday picker
• improvement(rich-md-editor): stabilize bubble-menu plugin key + comment cleanup
• improvement(rich-md-editor): streaming, performance, minor bugfixes
• improvement(auth): make Microsoft emailVerified derivation total
• improvement(access-controls): default workspace experience includes all members
• improvement(access-controls): docs, terminology, fix delete bug
• improvement(governance): derived access
• improvement(workspaces): auto-add without invite if part of organization
• improvement(block): table empty-state filter/sort builders + upsert conflict-column selection
• improvement(misc): add more sportmonks tools, improvestreaming ux

Bug Fixes

• fix(files): render embedded workspace images in markdown
• fix(rich-md-editor): stop the editor flashing during an agent rewrite
• fix(auth): close nOAuth account takeover via email-based OAuth linking
• fix(uploads): close multipart storage-quota bypass via quota-exempt contexts
• fix(file-decompress): enforce decompression caps on inflated stream, not declared zip size
• fix(executor): stop HITL error edges from firing on successful resume
• fix(files): only show Share in context menu for files, not folders
• fix(mship): add folder rename tools and locked workflow status

View changes on GitHub

Features

• feat(files): stream large CSV previews and add import-as-table
• feat(connectors): use resource selectors for KB connector config
• feat(google): Maps Pollen/Solar, Custom Search expansion, and live-API fixes across Google integrations
• feat(search): actions, fuzzy matching, and highlighting in cmd+k palette
• feat(integrations): hosted email-enrichment providers + cascade wiring
• feat(file): add Compress and Decompress operations to the File block

Improvements

• improvement(mothership): user_table speed parity — limit bounds, background import/delete/update jobs
• improvement(knowledge): align connected-sources rows and move source chip left of filter/sort
• improvement(tables): versioned CSV snapshot cache for table mounts + parallel multipart uploader
• improvement(supabase): add Edge Functions tool; correct storage output shapes + harden tools
• improvement(search): align cmd+k action icons + highlight with the design system
• improvement(integrations): validate BigQuery/Forms/PageSpeed + regenerate integration docs
• perf(db): logs-list index, drop redundant indexes, replica routing, hot-path write cleanups
• improvement(models): add DeepSeek V4 + Mistral Medium 3.5, fix Codestral context window
• improvement(execution, connectors): offload large function inputs, increase connector limits + better error propagation
• perf(execution): parallelize preflight gates, cache deployed state, memoize Anthropic client
• improvement(models): sort model dropdown by latest release date within each provider

Bug Fixes

• fix(tables): enforce row limits against the current plan, not a frozen per-table cap
• fix(resource): left-align table filter/sort when there's no search
• fix(copilot): mount input tables with display-name CSV headers, not column IDs
• fix(azure): replace Azure DevOps icon with Azure icon and remove AzureDevOpsIcon
• fix(realtime): debounce the reconnecting toast to stop transient-blip flashes
• fix(locks): enforce workflow/folder locks on the agent + close manual-UI create gaps
• fix(sidebar): prefetch chats + workflows so cold loads don't flash skeletons
• fix(input-format): field not editable race condition

Other Changes

• chore(deps): remove unused dependencies and harden CI supply chain

View changes on GitHub

Features

• feat(providers): support large agent-block attachments via Files APIs and remote URLs

Improvements

• improvement(providers): tighten Gemini and vLLM agent-attachment ceilings

Bug Fixes

• fix(kb): canonicalize knowledge-base upload keys
• fix(realtime): re-check workspace role on mutating socket events
• fix(chat): autoscroll follow-ups — re-engage threshold + keep end-of-turn options in view
• fix(chat): keep autoscroll pinned when the virtualizer re-scrolls during streaming

View changes on GitHub

Features

• feat(scheduled-tasks): migrate jobs agent to scheduled tasks agent
• feat(google-calendar): wire freebusy, align tools with API v3, add calendar + sharing tools
• feat(feature-flags): migrate 3 env-flags to AppConfig-backed runtime flags
• feat(grafana): validate integration and add folder, health, and contact-point tools
• feat(feature-flags): AppConfig-backed gated feature flags
• feat(ci): mship companion pr check
• feat(db): zero-downtime migration safety lint + db-migrate skill
• feat(auth): OAuth-only signup with Microsoft provider
• feat(jsm): add Atlassian Assets (Insight/CMDB) tools for asset management
• feat(copilot): server-side mothership tool/vfs/file metrics

Improvements

• improvement(perm-groups): allow workspace filter for permission groups
• refactor(connectors): split client metadata from server runtime
• improvement(ci): fix companion regex
• improvement(ci): rename companion tags to be more descriptive
• refactor(table): split the 5.3k-line service.ts god-file into per-concern modules

Bug Fixes

• fix(scheduled-tasks): fix scheduled tasks schema validation
• fix(providers): allow HTTP for self-hosted vLLM endpoints
• fix(providers): pin vLLM provider endpoint to validated IP
• fix(webhooks): cap request body size on public webhook receivers
• fix(uploads): authorize internal file URLs before download
• fix(credential-sets): stop leaking open-invite tokens to all users
• fix(providers): pin Azure OpenAI/Anthropic endpoints to validated IP
• fix(execute): reject only cross-site session execution (CSRF guard)

Other Changes

• chore(deps): bump js-yaml to 4.2.0 and nodemailer to 8.0.9 in apps/sim

View changes on GitHub

Features

• feat(square): add Square integration with 34 commerce operations
• feat(context-dev): add Context.dev web + brand data integration

Improvements

• refactor(sim): consolidate record guards + pure utils into @sim/utils
• improvement(mship): add enrichment tool, clean up dead tools
• Revert "improvement(mship): clean up dead tools, add enrichments"
• improvement(mship): clean up dead tools, add enrichments
• improvement(scheduled-tasks): move recurrence into modal body as a section
• refactor(providers,executor): deepen three shallow modules

Bug Fixes

• Revert "fix(execute): block cross-origin session-authenticated workflow runs"
• fix(access-control): exempt legacy blocks
• fix(execute): block cross-origin session-authenticated workflow runs
• fix(billing): deploy modal gates on workspace entitlement, not viewer plan
• Revert "fix(realtime): re-validate socket role and evict revoked collaborator…"
• fix(realtime): re-validate socket role and evict revoked collaborators

View changes on GitHub