v0.6.30: slack trigger enhancements, secrets performance, polling refactors, drag resources in mothership by waleedlatif1 · Pull Request #4038 · simstudioai/sim

waleedlatif1 · 2026-04-08T05:18:20Z

feat(posthog): Add tracking on mothership abort (feat(posthog): Add tracking on mothership abort #4023)
fix(login): fix captcha headers for manual login (fix(login): fix captcha headers for manual login #4025)
feat(slack): add subtype field and signature verification to Slack trigger (feat(slack): add subtype field and signature verification to Slack trigger #4030)
improvement(secrets): parallelize save mutations and add admin visibility for workspace secrets (improvement(secrets): parallelize save mutations and add admin visibility for workspace secrets #4032)
feat(chat): drag workflows and folders from sidebar into chat input (feat(chat): drag workflows and folders from sidebar into chat input #4028)
feat(athena): add AWS Athena integration (feat(athena): add AWS Athena integration #4034)
fix(admin): delete workspaces on ban (fix(admin): delete workspaces on ban #4029)
feat(ui): Add copy button for code blocks in mothership (feat(ui): Add copy button for code blocks in mothership #4033)
refactor(polling): consolidate polling services into provider handler pattern (refactor(polling): consolidate polling services into provider handler pattern #4035)
fix(manual): mock payloads nested recursion (fix(manual): mock payloads nested recursion #4037)
fix(kb): show 'pending' instead of past date for overdue next sync (fix(kb): show 'pending' instead of past date for overdue next sync #4039)
feat(secrets): allow admins to view and edit workspace secret values (feat(secrets): allow admins to view and edit workspace secret values #4040)
improvement(kb): deferred content fetching and metadata-based hashes for connectors (improvement(kb): deferred content fetching and metadata-based hashes for connectors #4044)

Co-authored-by: Theodore Li <[email protected]>

* fix(signup): fix turnstile key loading * fix(login): fix captcha header passing * Catch user already exists, remove login form captcha --------- Co-authored-by: Theodore Li <[email protected]>

…igger (#4030) * feat(slack): add subtype field and signature verification to Slack trigger * fix(slack): guard against NaN timestamp and align null/empty-string convention

…lity for workspace secrets (#4032) * improvement(secrets): parallelize save mutations and add admin visibility for workspace secrets * fix(secrets): sequence workspace upsert/delete to avoid read-modify-write race * fix(secrets): use Promise.allSettled to ensure credential invalidation after all mutations settle

…4028) * feat(chat): drag workflows and folders from sidebar into chat input * fix(chat): fix effectAllowed, stale atInsertPosRef, and drag-enter overlay for resource drags * feat(chat): add task dragging and visible drag ghost for sidebar items * feat(sidebar): add drag ghost with icons and task icon to context chips * refactor(types): narrow ChatMessageContext.kind to ChatContextKind union and add workflowBorderColor utility * feat(user-input): support Tab to select resource in mention dropdown * fix(user-input): narrow ChatContext discriminated union before accessing workflowId * fix(colors): overload workflowBorderColor to accept string | undefined * fix(colors): simplify workflowBorderColor to single string | undefined signature * fix(chat): remove resource panel tab when context mention is deleted from input * fix(chat): use resource ID for context removal identity check * fix(chat): add folder/task cases to resource resolver, task key to existingResourceKeys, and use workflowBorderColor in drag ghost * revert(chat): remove folder/task from resolveResourceFromContext — no panel UI for these types * fix(chat): add chatId to stored context types and workflow.color to drag callback deps * fix(chat): guard chatId before adding task key to existingResourceKeys

* feat(athena): add AWS Athena integration * fix(athena): address PR review comments - Fix variable shadowing: rename inner `data` to `rowData` in row mapper - Fix first-page maxResults off-by-one: request maxResults+1 to compensate for header row - Add missing runtime guard for queryString in create_named_query - Move athena registry entries to correct alphabetical position * fix(athena): alphabetize registry keys and add type re-exports - Reorder athena_* registry keys to strict alphabetical order - Add type re-exports from index.ts barrel * fix(athena): cap maxResults at 999 to prevent overflow with header row adjustment The +1 adjustment for the header row on first-page requests could produce MaxResults=1001 when user requests 1000, exceeding the AWS API hard cap of 1000.

* fix(admin): delete workspaces on ban * Fix lint * Wait until workspace deletion to return ban success --------- Co-authored-by: Theodore Li <[email protected]>

* Add copy button for code blocks in mothership * Move to shared copy code button * Handle react node case for copy * fix(copy-button): address PR review feedback - Await clipboard write and clear timeout on unmount in CopyCodeButton - Fix hover bg color matching container bg (surface-4 -> surface-5) - Extract extractTextContent to shared util at lib/core/utils/react-node-text.ts Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]> * Fix lint --------- Co-authored-by: Theodore Li <[email protected]> Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>

) This reverts commit 609ba61.

… pattern (#4035) * refactor(polling): consolidate polling services into provider handler pattern Eliminate self-POST anti-pattern and extract shared boilerplate from 4 polling services into a clean handler registry mirroring lib/webhooks/providers/. - Add processPolledWebhookEvent() to processor.ts for direct in-process webhook execution, removing HTTP round-trips that caused Lambda 403/timeout errors - Extract shared utilities (markWebhookFailed/Success, fetchActiveWebhooks, runWithConcurrency, resolveOAuthCredential, updateWebhookProviderConfig) - Create PollingProviderHandler interface with per-provider implementations - Consolidate 4 identical route files into single dynamic [provider] route - Standardize concurrency to 10 across all providers - No infra changes needed — Helm cron paths resolve via dynamic route Co-Authored-By: Claude Opus 4.6 <[email protected]> * polish(polling): extract lock TTL constant and remove unnecessary type casts - Widen processPolledWebhookEvent body param to accept object, eliminating `as unknown as Record<string, unknown>` double casts in all 4 handlers - Extract LOCK_TTL_SECONDS constant in route, tying maxDuration and lock TTL to a single value Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix(polling): address PR review feedback - Add archivedAt filters to fetchActiveWebhooks query, matching findWebhookAndWorkflow in processor.ts to prevent polling archived webhooks/workflows - Move provider validation after auth check to prevent provider enumeration by unauthenticated callers - Fix inconsistent pollingIdempotency import path in outlook.ts to match other handlers Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix(polling): use literal for maxDuration segment config Next.js requires segment config exports to be statically analyzable literals. Using a variable reference caused build failure. Co-Authored-By: Claude Opus 4.6 <[email protected]> --------- Co-authored-by: Claude Opus 4.6 <[email protected]>

vercel · 2026-04-08T05:18:27Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview, Comment	Apr 8, 2026 8:03am

cursor · 2026-04-08T05:18:29Z

PR Summary

Medium Risk
Adds a new AWS Athena tool surface (docs, block config, and internal API routes that accept AWS credentials) and refactors webhook polling routing, so mistakes could affect external integrations and sensitive request handling. Remaining changes are mostly UI/UX improvements (copy buttons, drag/drop, styling) with moderate regression risk.

Overview
Adds a new AWS Athena integration across docs, icons/mappings, integration catalog, a new AthenaBlock, and a set of internal Next.js API routes under api/tools/athena/* to start/inspect/stop queries and manage named queries.

Improves chat/workspace UX by adding CopyCodeButton to code blocks, enabling drag-and-drop of workflows/folders/tasks from the sidebar into the chat input (including multi-select + custom drag ghost), and centralizing workflow border styling via workflowBorderColor.

Operational/auth tweaks and refactors include consolidating webhook polling endpoints into a single provider route (api/webhooks/poll/[provider]) backed by a polling registry/orchestrator, fixing signup captcha header wiring, updating ban handling to disable user resources, and enhancing credentials/env-var saving (parallelized mutations, admin-only reveal on focus, and targeted cache invalidation).

^{Reviewed by Cursor Bugbot for commit a591d7c. Configure here.}

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit a591d7c. Configure here.}

apps/sim/app/workspace/[workspaceId]/home/home.tsx

greptile-apps · 2026-04-08T05:23:42Z

Greptile Summary

This is a large, multi-feature release (v0.6.30) bundling several independent improvements: Slack trigger signature verification and subtype field, a polling refactor into a clean provider-handler pattern, parallelised secrets save mutations with admin visibility for workspace secrets, drag-and-drop workflows/folders into chat, the AWS Athena integration (block + 8 tools + 8 API routes), admin workspace deletion on ban, a copy button for mothership code blocks, and miscellaneous bug fixes.

Key changes:

Slack: HMAC-SHA256 signature verification is correctly implemented using a constant-time compare (safeCompare), timestamp skew check (5 min), and v0= prefix validation. The new subtype field is properly propagated through formatInput.
Polling refactor: PollingProviderHandler interface cleanly replaces the old service classes. The dynamic [provider] route replaces four separate routes. runWithConcurrency correctly implements bounded parallelism.
Athena integration: All 8 operations are well-structured with Zod validation, checkInternalAuth, and the @aws-sdk/client-athena SDK. AWS credentials use visibility: 'user-only' (correct per policy). The get-query-results route correctly handles the Athena header-row offset.
Admin visibility for secrets: Admins can view plaintext workspace secret values on focus; non-admins see bullet characters. The admin check is done via workspacePermissions.
One P2 finding: CopyCodeButton.handleCopy is missing a try/catch around navigator.clipboard.writeText().
One P2 finding: all 8 Athena API routes return HTTP 500 for Zod validation errors (client mistakes), where HTTP 400 would be more appropriate.

Confidence Score: 5/5

Safe to merge — all findings are P2 style/improvement suggestions with no blocking logic errors.

The two issues found are both P2: missing try/catch in CopyCodeButton (UX-only impact) and Zod validation errors returning HTTP 500 instead of 400 in the Athena routes (no data loss or security consequence). The security-critical Slack signature verification is correctly implemented with constant-time comparison and replay protection. The polling refactor is architecturally clean and functionally equivalent to the old per-provider routes. No regressions in existing behaviour are introduced.

apps/sim/components/ui/copy-code-button.tsx (clipboard error handling), apps/sim/app/api/tools/athena/*/route.ts (Zod error status codes)

Vulnerabilities

Slack signature verification: Correctly implemented — HMAC-SHA256 with constant-time safeCompare, 5-minute timestamp skew check, and v0= prefix validation. Replay attack window is limited to 5 minutes per Slack spec.
AWS credentials: Athena tool params use visibility: 'user-only' (not hidden), consistent with the project policy for user-provided API keys.
Athena API routes: All routes call checkInternalAuth before processing; credentials are passed through the tool layer and never persisted.
No SQL injection risk in Athena routes; queries are passed directly to the Athena API which handles execution in AWS's sandbox.
No secrets or tokens are exposed in logs across the new files.

Important Files Changed

Filename	Overview
apps/sim/lib/webhooks/providers/slack.ts	Signature verification (HMAC-SHA256 + constant-time compare + timestamp skew), subtype field, and file download are all correctly implemented.
apps/sim/lib/webhooks/polling/orchestrator.ts	Clean delegation to provider-handler pattern; `runWithConcurrency` bounded parallelism is correctly implemented.
apps/sim/app/api/webhooks/poll/[provider]/route.ts	Dynamic provider route with cron auth, Redis lock, and correct TTL matching `maxDuration`.
apps/sim/components/ui/copy-code-button.tsx	Missing try/catch around `navigator.clipboard.writeText()` — clipboard failures are silently swallowed, leaving the user without feedback.
apps/sim/blocks/blocks/athena.ts	All 8 operations, conditions, required fields, and type coercions look correct. AWS credentials use `password: true`.
apps/sim/app/api/tools/athena/start-query/route.ts	Auth check, Zod validation, and AWS SDK usage are all correct; Zod errors return HTTP 500 instead of 400 (same in all 8 Athena routes).
apps/sim/app/api/tools/athena/get-query-results/route.ts	Header-row offset logic (`+1` on first page, `slice(1)`) is correct; pagination token handling is proper.
apps/sim/triggers/slack/webhook.ts	Trigger config with new `signingSecret`, `botToken`, `includeFiles` fields and updated `subtype` output definition looks complete and correct.
apps/sim/lib/webhooks/polling/utils.ts	Shared utilities (OAuth resolution, failure tracking, config update, concurrency runner) are well-factored and correctly implemented.
apps/sim/hooks/queries/environment.ts	Query key factory, signal forwarding, staleTime, and onSettled invalidation all follow project patterns correctly.

Sequence Diagram

sequenceDiagram
    participant Cron as Cron Job
    participant Route as /api/webhooks/poll/[provider]
    participant Redis as Redis Lock
    participant Orch as pollProvider()
    participant Registry as PollingRegistry
    participant Handler as ProviderHandler (gmail/outlook/imap/rss)
    participant DB as Database
    participant Proc as processPolledWebhookEvent

    Cron->>Route: GET /api/webhooks/poll/gmail
    Route->>Route: verifyCronAuth()
    Route->>Route: VALID_POLLING_PROVIDERS.has(provider)
    Route->>Redis: acquireLock(provider-polling-lock, TTL=180s)
    Redis-->>Route: locked=true
    Route->>Orch: pollProvider("gmail")
    Orch->>Registry: getPollingHandler("gmail")
    Registry-->>Orch: gmailPollingHandler
    Orch->>DB: fetchActiveWebhooks("gmail")
    DB-->>Orch: [webhook1, webhook2, ...]
    loop runWithConcurrency (max 10)
        Orch->>Handler: pollWebhook({ webhookData, workflowData, requestId, logger })
        Handler->>DB: resolveOAuthCredential()
        DB-->>Handler: accessToken
        Handler->>Handler: fetch new emails/items
        Handler->>Proc: processPolledWebhookEvent() [idempotency wrapped]
        Proc-->>Handler: result
        Handler->>DB: updateWebhookProviderConfig() / markWebhookSuccess()
        Handler-->>Orch: 'success' | 'failure'
    end
    Orch-->>Route: PollSummary { total, successful, failed }
    Route->>Redis: releaseLock()
    Route-->>Cron: 200 OK + summary

_{Reviews (1): Last reviewed commit: "fix(manual): mock payloads nested recurs..." | Re-trigger Greptile}

apps/sim/components/ui/copy-code-button.tsx

apps/sim/app/api/tools/athena/start-query/route.ts

…4039)

…4040) * feat(secrets): allow admins to view and edit workspace secret values * fix(secrets): cross-browser masking and grid layout for non-admin users

* fix: address PR review comments on staging release - Add try/catch around clipboard.writeText() in CopyCodeButton - Add missing folder and past_chat cases in resolveResourceFromContext - Return 400 for ZodError instead of 500 in all 8 Athena API routes Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix(api): return 400 for Zod validation errors across 27 API routes Routes using z.parse() were returning 500 for ZodError (client input validation failures). Added instanceof z.ZodError check to return 400 before the generic 500 handler, matching the established pattern used by 115+ other routes. Affected services: CloudWatch (7), CloudFormation (7), DynamoDB (6), Slack (3), Outlook (2), OneDrive (1), Google Drive (1). Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix(api): add success:false to ZodError responses for consistency 7 routes used { success: false, error: ... } in their generic error handler but our ZodError handler only returned { error: ... }. Aligned the ZodError response shape to match. Co-Authored-By: Claude Opus 4.6 <[email protected]> --------- Co-authored-by: Claude Opus 4.6 <[email protected]>

…for connectors (#4044) * improvement(kb): deferred content fetching and metadata-based hashes for connectors * fix(kb): remove message count from outlook contentHash to prevent list/get divergence * fix(kb): increase outlook getDocument message limit from 50 to 250 * fix(kb): skip outlook messages without conversationId to prevent broken stubs * fix(kb): scope outlook getDocument to same folder as listDocuments to prevent hash divergence * fix(kb): add missing connector sync cron job to Helm values The connector sync endpoint existed but had no cron job configured to trigger it, meaning scheduled syncs would never fire. Co-Authored-By: Claude Opus 4.6 <[email protected]> --------- Co-authored-by: Claude Opus 4.6 <[email protected]>

TheodoreSpeaks and others added 11 commits April 7, 2026 18:30

feat(posthog): Add tracking on mothership abort (#4023)

d0d3581

Co-authored-by: Theodore Li <[email protected]>

fix(login): fix captcha headers for manual login (#4025)

0f602f7

* fix(signup): fix turnstile key loading * fix(login): fix captcha header passing * Catch user already exists, remove login form captcha --------- Co-authored-by: Theodore Li <[email protected]>

feat(slack): add subtype field and signature verification to Slack tr…

e0f5cf8

…igger (#4030) * feat(slack): add subtype field and signature verification to Slack trigger * fix(slack): guard against NaN timestamp and align null/empty-string convention

fix(admin): delete workspaces on ban (#4029)

712e58a

* fix(admin): delete workspaces on ban * Fix lint * Wait until workspace deletion to return ban success --------- Co-authored-by: Theodore Li <[email protected]>

Revert "fix(sockets): joining currently deleted workflow (#4004)" (#4036

2760b4b

) This reverts commit 609ba61.

fix(manual): mock payloads nested recursion (#4037)

a591d7c

cursor bot reviewed Apr 8, 2026

View reviewed changes

apps/sim/app/workspace/[workspaceId]/home/home.tsx Show resolved Hide resolved

greptile-apps bot reviewed Apr 8, 2026

View reviewed changes

apps/sim/components/ui/copy-code-button.tsx Show resolved Hide resolved

apps/sim/app/api/tools/athena/start-query/route.ts Show resolved Hide resolved

fix(kb): show 'pending' instead of past date for overdue next sync (#…

7b81a76

…4039)

vercel bot temporarily deployed to Preview April 8, 2026 05:35 Inactive

feat(secrets): allow admins to view and edit workspace secret values (#…

9282d1b

…4040) * feat(secrets): allow admins to view and edit workspace secret values * fix(secrets): cross-browser masking and grid layout for non-admin users

vercel bot temporarily deployed to Preview April 8, 2026 06:40 Inactive

vercel bot temporarily deployed to Preview April 8, 2026 07:26 Inactive

waleedlatif1 merged commit d7da35b into main Apr 8, 2026
13 of 14 checks passed

vercel bot deployed to Preview April 8, 2026 08:03 View deployment

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

v0.6.30: slack trigger enhancements, secrets performance, polling refactors, drag resources in mothership#4038

v0.6.30: slack trigger enhancements, secrets performance, polling refactors, drag resources in mothership#4038
waleedlatif1 merged 15 commits intomainfrom
staging

waleedlatif1 commented Apr 8, 2026 •

edited

Loading

Uh oh!

vercel bot commented Apr 8, 2026 •

edited

Loading

Uh oh!

cursor bot commented Apr 8, 2026 •

edited

Loading

Uh oh!

cursor bot left a comment

Uh oh!

Uh oh!

greptile-apps bot commented Apr 8, 2026

Vulnerabilities

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

waleedlatif1 commented Apr 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vercel bot commented Apr 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor bot commented Apr 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

greptile-apps bot commented Apr 8, 2026

Greptile Summary

Confidence Score: 5/5

Vulnerabilities

Important Files Changed

Sequence Diagram

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

waleedlatif1 commented Apr 8, 2026 •

edited

Loading

vercel bot commented Apr 8, 2026 •

edited

Loading

cursor bot commented Apr 8, 2026 •

edited

Loading