v0.5.69: kb upgrades, blog, copilot improvements, auth consolidation #2973

waleedlatif1 · 2026-01-24T18:25:16Z

fix(subflows): tag dropdown + resolution logic (fix(subflows): tag dropdown + resolution logic #2949)
chore(deps): bump posthog-js to 1.334.1 (chore(deps): bump posthog-js to 1.334.1 #2948)
fix(idempotency): add conflict target to atomicallyClaimDb query + remove redundant db namespace tracking (fix(idempotency): add conflict target to atomicallyClaimDb query + remove redundant db namespace tracking #2950)
improvement(kb): add document filtering, select all, and React Query migration (improvement(kb): add document filtering, select all, and React Query migration #2951)
improvement(logs): trace span, details (improvement(logs): trace span, details #2952)
feat(blog): v0.5 release post (feat(blog): v0.5 release post #2953)
feat(admin): add credits endpoint to issue credits to users (feat(admin): add credits endpoint to issue credits to users #2954)
improvement(copilot): fast mode, subagent tool responses and allow preferences (improvement(copilot): fast mode, subagent tool responses and allow preferences #2955)
fix(billing): handle missing userStats and prevent crashes (fix(billing): handle missing userStats and prevent crashes #2956)
fix(logs): refresh logic to refresh logs details (fix(logs): refresh logic to refresh logs details #2958)
fix(security): add authentication and input validation to API routes (fix(security): add authentication and input validation to API routes #2959)
improvement(helm): add internal ingress support and same-host path consolidation (improvement(helm): add internal ingress support and same-host path consolidation #2960)
feat(blog): enterprise post (feat(blog): enterprise post #2961)
fix(envvars): resolution standardized (fix(envvars): resolution standardized #2957)
fix(copilot): mask credentials fix (fix(copilot): mask credentials fix #2963)
improvement(webhooks): remove dead code (improvement(webhooks): remove dead code #2965)
fix(preview): subblock values (fix(preview): subblock values #2969)
fix(child-workflow): nested spans handoff (fix(child-workflow): nested spans handoff #2966)
fix(security): restrict API key access on internal-only routes (fix(security): restrict API key access on internal-only routes #2964)
fix(copilot): update copilot chat title (fix(copilot): fix copilot chat title #2968)
fix(hitl): fix condition blocks after hitl (fix(hitl): fix condition blocks after hitl #2967)
fix(notes): ghost edges (fix(notes): ghost edges #2970)
improvement(docs): loop and parallel var reference syntax (improvement(docs): loop and parallel var reference syntax #2975)
fix(blog): slash actions description (fix(blog): slash actions description #2976)
fix(auth): copilot routes (fix(auth): copilot routes #2977)
fix(copilot): fix edit summary for loops/parallels (fix(copilot): fix edit summary for loops/parallels #2978)
fix(integrations): hide spotify tool from toolbar (fix(integrations): hide spotify tool from toolbar #2544)
fix(landing): ui (fix(landing): ui #2979)
fix(edge-validation): race condition on collaborative add (fix(edge-validation): race condition on collaborative add #2980)
fix(variables): boolean type support and input improvements (fix(variables): boolean type support and input improvements #2981)

* fix(subflows): tag dropdown + resolution logic * fixes; * revert parallel change

…move redundant db namespace tracking (#2950) * fix(idempotency): add conflict target to atomicallyClaimDb query * delete needs to account for namespace * simplify namespace filtering logic * fix cleanup * consistent target

…migration (#2951) * improvement(kb): add document filtering, select all, and React Query migration * test(kb): update tests for enabledFilter and removed userId params * fix(kb): remove non-null assertion, add explicit guard

* improvement(action-bar): ordering * improvement(logs): details, trace span

* feat(blog): v0.5 post * improvement(blog): simplify title and remove code block header - Simplified blog title from "Introducing Sim Studio v0.5" to "Introducing Sim v0.5" - Removed language label header and copy button from code blocks for cleaner appearance Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * ack PR comments * small styling improvements * created system to create post-specific components * updated componnet * cache invalidation --------- Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

* feat(admin): add credits endpoint to issue credits to users * fix(admin): use existing credit functions and handle enterprise seats * fix(admin): reject NaN and Infinity in amount validation * styling * fix(admin): validate userId and email are strings

…eferences (#2955) * Improvements * Fix actions mapping * Remove console logs

* fix(billing): handle missing userStats and prevent crashes * fix(billing): correct import path for getFilledPillColor * fix(billing): add Number.isFinite check to lastPeriodCost

…2959) * fix(security): add authentication and input validation to API routes * moved utils * remove extraneous commetns * removed unused dep

…nsolidation (#2960) * improvement(helm): add internal ingress support and same-host path consolidation * improvement(helm): clean up ingress template comments Simplify verbose inline Helm comments and section dividers to match the minimal style used in services.yaml. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(helm): add missing copilot path consolidation for realtime host When copilot.host equals realtime.host but differs from app.host, copilot paths were not being routed. Added logic to consolidate copilot paths into the realtime rule for this scenario. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * improvement(helm): follow ingress best practices - Remove orphan comments that appeared when services were disabled - Add documentation about path ordering requirements - Paths rendered in order: realtime, copilot, app (specific before catch-all) - Clean template output matching industry Helm chart standards --------- Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

* feat(blog): enterprise post * added more images, styling * more content * updated v0-5 post * remove unused transition --------- Co-authored-by: Vikhyath Mondreti <vikhyath@simstudio.ai>

* fix(envvars): resolution standardized * remove comments * address bugbot * fix highlighting for env vars * remove comments * address greptile * address bugbot

* Fix copilot masking * Clean up * Lint

* fix(webhooks): subscription recreation path * improvement(webhooks): remove dead code * fix tests * address bugbot comments * fix restoration edge case * fix more edge cases * address bugbot comments * fix gmail polling * add warnings for UI indication for credential sets

* fix(child-workflow): nested spans handoff * remove overly defensive programming * update type check * type more code * remove more dead code * address bugbot comments

* fix(security): restrict API key access on internal-only routes * test(security): update function execute tests for checkInternalAuth * updated agent handler * move session check higher in checkSessionOrInternalAuth * extracted duplicate code into helper for resolving user from jwt

vercel · 2026-01-24T18:25:20Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Review	Updated (UTC)
docs	Skipped		Jan 24, 2026 9:52pm

waleedlatif1 · 2026-01-24T18:25:30Z

@cursor review

waleedlatif1 · 2026-01-24T18:25:34Z

@greptile

greptile-apps · 2026-01-24T18:29:08Z

Greptile Summary

This release consolidates 21 PRs spanning security hardening, feature improvements, and bug fixes across authentication, knowledge bases, copilot, billing, and infrastructure.

Key Changes:

Security improvements: Consolidates authentication with route-specific policies (checkInternalAuth, checkSessionOrInternalAuth, checkHybridAuth), restricts function execution and tool routes from external access, adds SSRF protection with DNS validation and IP pinning for webhooks, implements prototype pollution prevention with safeAssign utility
Bug fixes: Resolves nested workflow span handoff in error cases, fixes condition blocks incorrectly pausing after HITL by filtering _pauseMetadata, standardizes environment variable resolution to eliminate double-resolution bugs, adds defensive validation for missing userStats to prevent billing crashes, fixes idempotency conflicts with proper conflict targets
Knowledge base enhancements: Adds document filtering (All/Enabled/Disabled) and select-all for bulk operations, migrates tag definitions to React Query for better caching
Copilot improvements: Implements fast mode for subagents, improves tool response management, adds preference support, fixes credential masking latency
Infrastructure: Adds internal ingress template for private load balancers, cleans up dead webhook code, adds admin credits endpoint for user credit issuance
Content: Publishes v0.5 release and enterprise blog posts

Architecture Note: The authentication consolidation is well-designed with three clear patterns: checkInternalAuth for executor-only routes (blocks all external access), checkSessionOrInternalAuth for UI+executor routes (blocks external access keys), and checkHybridAuth for public routes (allows all methods). This prevents privilege escalation while maintaining backward compatibility.

Confidence Score: 4/5

This PR is generally safe to merge with minor attention to a few areas
The PR contains significant security improvements and bug fixes across 272 files from 21 consolidated PRs. The authentication consolidation is well-architected and the security additions (SSRF protection, prototype pollution prevention, route access restrictions) follow best practices. Bug fixes address real issues (nested spans, HITL condition blocks, billing crashes, idempotency). However, the large scope (272 files) increases merge risk, and some areas like the child workflow error handling add complexity. The changes appear well-tested based on PR descriptions, but the volume warrants careful deployment monitoring.
Pay close attention to apps/sim/lib/auth/hybrid.ts for authentication flow changes and apps/sim/executor/handlers/workflow/workflow-handler.ts for error handling complexity. Monitor apps/sim/lib/billing/core/usage.ts for defensive validation edge cases.

Important Files Changed

Filename	Overview
apps/sim/lib/auth/hybrid.ts	Consolidates authentication logic with three new functions: `checkInternalAuth` (executor-only), `checkSessionOrInternalAuth` (UI + executor), and `checkHybridAuth` (all methods). Clean separation of concerns for route-specific authentication requirements.
apps/sim/tools/safe-assign.ts	Adds prototype pollution protection by filtering dangerous keys (`__proto__`, `constructor`, `prototype`) during object assignment operations with user-controlled data.
apps/sim/lib/a2a/push-notifications.ts	Adds SSRF protection using DNS validation and IP pinning for webhook URLs. Validates URLs before making HTTP requests to prevent internal network access.
apps/sim/app/api/function/execute/route.ts	Migrated from `checkHybridAuth` to `checkInternalAuth` to block API key access. This route is now executor-only, preventing external API key abuse for code execution.
apps/sim/executor/handlers/workflow/workflow-handler.ts	Improved error handling for child workflows. Now properly captures and passes trace spans even when child workflow fails, fixing nested spans handoff issue #2966.
apps/sim/executor/handlers/condition/condition-handler.ts	Filters `_pauseMetadata` from source output to prevent condition blocks from incorrectly pausing after HITL blocks. Fixes #2967.
apps/sim/lib/billing/core/usage.ts	Adds defensive validation and `ensureUserStatsExists()` function to handle missing userStats records. Prevents crashes from `toFixed is not a function` errors.
apps/sim/lib/core/idempotency/service.ts	Adds conflict target to `atomicallyClaimDb` query and removes redundant namespace tracking. Prevents insertion errors that could terminate webhook execution.

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

* fix(notes): ghost edges * fix deployed state fallback * fallback * remove UI level checks * annotation missing from autoconnect source check

* improvement(docs): loop and parallel var reference syntax * fix(blog): slash actions description

* Fix copilot auth * Fix * Fix * Fix

apps/sim/app/(landing)/components/hero/components/landing-canvas/landing-block/tag.tsx

* fix(variables): boolean type support and input improvements * fix formatting

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

cursor · 2026-01-24T21:58:22Z

apps/sim/app/(landing)/studio/page.tsx

          if (a.featured && !b.featured) return -1
          if (!a.featured && b.featured) return 1
-          return 0
+          return new Date(b.date).getTime() - new Date(a.date).getTime()


Blog post sorting only applied on page 1

Medium Severity

The sorting logic for blog posts is only applied when pageNum === 1. On subsequent pages, posts remain in their original order from getAllPostMeta() (sorted by date only). This inconsistency means featured posts sorted to the top on page 1 may reappear on later pages in their date order, causing duplicates or unexpected ordering when paginating.

…2973) * fix(subflows): tag dropdown + resolution logic (#2949) * fix(subflows): tag dropdown + resolution logic * fixes; * revert parallel change * chore(deps): bump posthog-js to 1.334.1 (#2948) * fix(idempotency): add conflict target to atomicallyClaimDb query + remove redundant db namespace tracking (#2950) * fix(idempotency): add conflict target to atomicallyClaimDb query * delete needs to account for namespace * simplify namespace filtering logic * fix cleanup * consistent target * improvement(kb): add document filtering, select all, and React Query migration (#2951) * improvement(kb): add document filtering, select all, and React Query migration * test(kb): update tests for enabledFilter and removed userId params * fix(kb): remove non-null assertion, add explicit guard * improvement(logs): trace span, details (#2952) * improvement(action-bar): ordering * improvement(logs): details, trace span * feat(blog): v0.5 release post (#2953) * feat(blog): v0.5 post * improvement(blog): simplify title and remove code block header - Simplified blog title from Introducing Sim Studio v0.5 to Introducing Sim v0.5 - Removed language label header and copy button from code blocks for cleaner appearance Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * ack PR comments * small styling improvements * created system to create post-specific components * updated componnet * cache invalidation --------- Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> * feat(admin): add credits endpoint to issue credits to users (#2954) * feat(admin): add credits endpoint to issue credits to users * fix(admin): use existing credit functions and handle enterprise seats * fix(admin): reject NaN and Infinity in amount validation * styling * fix(admin): validate userId and email are strings * improvement(copilot): fast mode, subagent tool responses and allow preferences (#2955) * Improvements * Fix actions mapping * Remove console logs * fix(billing): handle missing userStats and prevent crashes (#2956) * fix(billing): handle missing userStats and prevent crashes * fix(billing): correct import path for getFilledPillColor * fix(billing): add Number.isFinite check to lastPeriodCost * fix(logs): refresh logic to refresh logs details (#2958) * fix(security): add authentication and input validation to API routes (#2959) * fix(security): add authentication and input validation to API routes * moved utils * remove extraneous commetns * removed unused dep * improvement(helm): add internal ingress support and same-host path consolidation (#2960) * improvement(helm): add internal ingress support and same-host path consolidation * improvement(helm): clean up ingress template comments Simplify verbose inline Helm comments and section dividers to match the minimal style used in services.yaml. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(helm): add missing copilot path consolidation for realtime host When copilot.host equals realtime.host but differs from app.host, copilot paths were not being routed. Added logic to consolidate copilot paths into the realtime rule for this scenario. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * improvement(helm): follow ingress best practices - Remove orphan comments that appeared when services were disabled - Add documentation about path ordering requirements - Paths rendered in order: realtime, copilot, app (specific before catch-all) - Clean template output matching industry Helm chart standards --------- Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> * feat(blog): enterprise post (#2961) * feat(blog): enterprise post * added more images, styling * more content * updated v0-5 post * remove unused transition --------- Co-authored-by: Vikhyath Mondreti <vikhyath@simstudio.ai> * fix(envvars): resolution standardized (#2957) * fix(envvars): resolution standardized * remove comments * address bugbot * fix highlighting for env vars * remove comments * address greptile * address bugbot * fix(copilot): mask credentials fix (#2963) * Fix copilot masking * Clean up * Lint * improvement(webhooks): remove dead code (#2965) * fix(webhooks): subscription recreation path * improvement(webhooks): remove dead code * fix tests * address bugbot comments * fix restoration edge case * fix more edge cases * address bugbot comments * fix gmail polling * add warnings for UI indication for credential sets * fix(preview): subblock values (#2969) * fix(child-workflow): nested spans handoff (#2966) * fix(child-workflow): nested spans handoff * remove overly defensive programming * update type check * type more code * remove more dead code * address bugbot comments * fix(security): restrict API key access on internal-only routes (#2964) * fix(security): restrict API key access on internal-only routes * test(security): update function execute tests for checkInternalAuth * updated agent handler * move session check higher in checkSessionOrInternalAuth * extracted duplicate code into helper for resolving user from jwt * fix(copilot): update copilot chat title (#2968) * fix(hitl): fix condition blocks after hitl (#2967) * fix(notes): ghost edges (#2970) * fix(notes): ghost edges * fix deployed state fallback * fallback * remove UI level checks * annotation missing from autoconnect source check * improvement(docs): loop and parallel var reference syntax (#2975) * fix(blog): slash actions description (#2976) * improvement(docs): loop and parallel var reference syntax * fix(blog): slash actions description * fix(auth): copilot routes (#2977) * Fix copilot auth * Fix * Fix * Fix * fix(copilot): fix edit summary for loops/parallels (#2978) * fix(integrations): hide from tool bar (#2544) * fix(landing): ui (#2979) * fix(edge-validation): race condition on collaborative add (#2980) * fix(variables): boolean type support and input improvements (#2981) * fix(variables): boolean type support and input improvements * fix formatting --------- Co-authored-by: Vikhyath Mondreti <vikhyathvikku@gmail.com> Co-authored-by: Emir Karabeg <78010029+emir-karabeg@users.noreply.github.com> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> Co-authored-by: Siddharth Ganesan <33737564+Sg312@users.noreply.github.com> Co-authored-by: Vikhyath Mondreti <vikhyath@simstudio.ai>

icecrasher321 and others added 21 commits January 22, 2026 17:57

fix(subflows): tag dropdown + resolution logic (#2949)

aa99db6

* fix(subflows): tag dropdown + resolution logic * fixes; * revert parallel change

chore(deps): bump posthog-js to 1.334.1 (#2948)

f765b83

improvement(logs): trace span, details (#2952)

1467862

* improvement(action-bar): ordering * improvement(logs): details, trace span

improvement(copilot): fast mode, subagent tool responses and allow pr…

efef91e

…eferences (#2955) * Improvements * Fix actions mapping * Remove console logs

fix(billing): handle missing userStats and prevent crashes (#2956)

7f4edc8

* fix(billing): handle missing userStats and prevent crashes * fix(billing): correct import path for getFilledPillColor * fix(billing): add Number.isFinite check to lastPeriodCost

fix(logs): refresh logic to refresh logs details (#2958)

6464cfa

fix(security): add authentication and input validation to API routes (#…

f44594c

…2959) * fix(security): add authentication and input validation to API routes * moved utils * remove extraneous commetns * removed unused dep

feat(blog): enterprise post (#2961)

428781c

* feat(blog): enterprise post * added more images, styling * more content * updated v0-5 post * remove unused transition --------- Co-authored-by: Vikhyath Mondreti <vikhyath@simstudio.ai>

fix(envvars): resolution standardized (#2957)

b913cff

* fix(envvars): resolution standardized * remove comments * address bugbot * fix highlighting for env vars * remove comments * address greptile * address bugbot

fix(copilot): mask credentials fix (#2963)

2329468

* Fix copilot masking * Clean up * Lint

fix(preview): subblock values (#2969)

0f9b6ad

fix(child-workflow): nested spans handoff (#2966)

211a7ac

* fix(child-workflow): nested spans handoff * remove overly defensive programming * update type check * type more code * remove more dead code * address bugbot comments

fix(copilot): update copilot chat title (#2968)

9c3e663

fix(hitl): fix condition blocks after hitl (#2967)

8574e6c

cursor bot reviewed Jan 24, 2026

View reviewed changes

fix(notes): ghost edges (#2970)

8429040

* fix(notes): ghost edges * fix deployed state fallback * fallback * remove UI level checks * annotation missing from autoconnect source check

vercel bot temporarily deployed to Preview January 24, 2026 19:20 Inactive

improvement(docs): loop and parallel var reference syntax (#2975)

fc7f56e

vercel bot deployed to Preview January 24, 2026 19:38 View deployment

fix(blog): slash actions description (#2976)

6868325

* improvement(docs): loop and parallel var reference syntax * fix(blog): slash actions description

vercel bot temporarily deployed to Preview January 24, 2026 19:46 Inactive

fix(auth): copilot routes (#2977)

3bbf7f5

* Fix copilot auth * Fix * Fix * Fix

vercel bot temporarily deployed to Preview January 24, 2026 20:26 Inactive

fix(copilot): fix edit summary for loops/parallels (#2978)

9f91694

vercel bot temporarily deployed to Preview January 24, 2026 20:36 Inactive

fix(integrations): hide from tool bar (#2544)

4d84465

vercel bot temporarily deployed to Preview January 24, 2026 20:45 Inactive

fix(landing): ui (#2979)

c7db48e

vercel bot temporarily deployed to Preview January 24, 2026 21:04 Inactive

fix(edge-validation): race condition on collaborative add (#2980)

841cb63

vercel bot temporarily deployed to Preview January 24, 2026 21:19 Inactive

cursor bot reviewed Jan 24, 2026

View reviewed changes

apps/sim/app/(landing)/components/hero/components/landing-canvas/landing-block/tag.tsx Show resolved Hide resolved

fix(variables): boolean type support and input improvements (#2981)

bcf6dc8

* fix(variables): boolean type support and input improvements * fix formatting

vercel bot temporarily deployed to Preview January 24, 2026 21:52 Inactive

cursor bot reviewed Jan 24, 2026

View reviewed changes

waleedlatif1 merged commit 2b74a26 into main Jan 24, 2026
25 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

v0.5.69: kb upgrades, blog, copilot improvements, auth consolidation #2973

v0.5.69: kb upgrades, blog, copilot improvements, auth consolidation #2973

Uh oh!

waleedlatif1 commented Jan 24, 2026 •

edited

Loading

Uh oh!

vercel bot commented Jan 24, 2026 •

edited

Loading

Uh oh!

waleedlatif1 commented Jan 24, 2026

Uh oh!

waleedlatif1 commented Jan 24, 2026

Uh oh!

greptile-apps bot commented Jan 24, 2026

Uh oh!

cursor bot left a comment

Uh oh!

Uh oh!

cursor bot left a comment

Uh oh!

cursor bot Jan 24, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

v0.5.69: kb upgrades, blog, copilot improvements, auth consolidation #2973

v0.5.69: kb upgrades, blog, copilot improvements, auth consolidation #2973

Uh oh!

Conversation

waleedlatif1 commented Jan 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vercel bot commented Jan 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

waleedlatif1 commented Jan 24, 2026

Uh oh!

waleedlatif1 commented Jan 24, 2026

Uh oh!

greptile-apps bot commented Jan 24, 2026

Greptile Summary

Confidence Score: 4/5

Important Files Changed

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor bot Jan 24, 2026

Choose a reason for hiding this comment

Blog post sorting only applied on page 1

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

waleedlatif1 commented Jan 24, 2026 •

edited

Loading

vercel bot commented Jan 24, 2026 •

edited

Loading