Merge remote-tracking branch 'origin/staging' into chore/sync-dev-with-staging-2026-10-23

Author: waleedlatif1

.claude/rules/sim-sandbox.md

@@ -2,6 +2,8 @@
 description: Isolated-vm sandbox worker security policy. Hard rules for anything that lives in the worker child process that runs user code.
 paths:
   - "apps/sim/lib/execution/isolated-vm-worker.cjs"
+  - "apps/sim/lib/execution/isolated-vm-host.cjs"
+  - "apps/sim/lib/execution/isolated-vm-remote.ts"
   - "apps/sim/lib/execution/isolated-vm.ts"
   - "apps/sim/lib/execution/sandbox/**"
   - "apps/sim/sandboxes/**"
@@ -75,7 +77,31 @@ payload or `ivm.Reference` wrapper in the worker:
 - [ ] Does the worker read a new env var? Add it to the `buildWorkerEnv()`
       allowlist in `isolated-vm.ts` **and** to the allowlist regression test in
       `isolated-vm.test.ts` — the worker does not inherit the app environment,
-      so an un-allowlisted var is simply absent in the child.
+      so an un-allowlisted var is simply absent in the child. If the app owns
+      its value, put it in `appWorkerEnv()` and add it with its accepted shape
+      to `CLIENT_WORKER_ENV` in `isolated-vm-host.cjs`, so a remote worker
+      gets the same value.
+- [ ] Does the host send the worker a new message type? Add it to
+      `ALLOWED_INBOUND_TYPES` in `isolated-vm-host.cjs`, or remote workers
+      never receive it.
+
+## Where the worker runs
+
+The pool in `isolated-vm.ts` opens each worker either as a local child process
+or, when `IVM_REMOTE_WORKER_URL` is set (with `IVM_REMOTE_WORKER_TOKEN`; a URL
+without a valid token fails executions rather than falling back) and the
+`isolated-vm-local-workers` kill switch is off, as a WebSocket connection to
+`isolated-vm-host.cjs`, which runs the
+same worker in a dedicated service that holds no platform credentials. Every
+rule in this file applies in both modes.
+
+- `fetch()` and brokers always run in the app. The host only relays the
+  worker's messages, so it needs no network access of its own and never gets
+  a broker implementation.
+- A remote target never falls back to a local child process. An unreachable
+  host fails executions with a system error; keep it that way.
+- Changes to the worker message protocol must stay compatible with the
+  previous release: the host and its clients roll out independently.
 
 ## What the worker *may* hold
 

.cursor/rules/sim-sandbox.mdc

@@ -1,6 +1,6 @@
 ---
 description: "Isolated-vm sandbox worker security policy. Hard rules for anything that lives in the worker child process that runs user code."
-globs: ["apps/sim/lib/execution/isolated-vm-worker.cjs","apps/sim/lib/execution/isolated-vm.ts","apps/sim/lib/execution/sandbox/**","apps/sim/sandboxes/**"]
+globs: ["apps/sim/lib/execution/isolated-vm-worker.cjs","apps/sim/lib/execution/isolated-vm-host.cjs","apps/sim/lib/execution/isolated-vm-remote.ts","apps/sim/lib/execution/isolated-vm.ts","apps/sim/lib/execution/sandbox/**","apps/sim/sandboxes/**"]
 ---
 
 <!-- Generated from .claude/rules/sim-sandbox.md by `bun run skills:sync`. Edit the source, not this file. -->
@@ -73,7 +73,31 @@ payload or `ivm.Reference` wrapper in the worker:
 - [ ] Does the worker read a new env var? Add it to the `buildWorkerEnv()`
       allowlist in `isolated-vm.ts` **and** to the allowlist regression test in
       `isolated-vm.test.ts` — the worker does not inherit the app environment,
-      so an un-allowlisted var is simply absent in the child.
+      so an un-allowlisted var is simply absent in the child. If the app owns
+      its value, put it in `appWorkerEnv()` and add it with its accepted shape
+      to `CLIENT_WORKER_ENV` in `isolated-vm-host.cjs`, so a remote worker
+      gets the same value.
+- [ ] Does the host send the worker a new message type? Add it to
+      `ALLOWED_INBOUND_TYPES` in `isolated-vm-host.cjs`, or remote workers
+      never receive it.
+
+## Where the worker runs
+
+The pool in `isolated-vm.ts` opens each worker either as a local child process
+or, when `IVM_REMOTE_WORKER_URL` is set (with `IVM_REMOTE_WORKER_TOKEN`; a URL
+without a valid token fails executions rather than falling back) and the
+`isolated-vm-local-workers` kill switch is off, as a WebSocket connection to
+`isolated-vm-host.cjs`, which runs the
+same worker in a dedicated service that holds no platform credentials. Every
+rule in this file applies in both modes.
+
+- `fetch()` and brokers always run in the app. The host only relays the
+  worker's messages, so it needs no network access of its own and never gets
+  a broker implementation.
+- A remote target never falls back to a local child process. An unreachable
+  host fails executions with a system error; keep it that way.
+- Changes to the worker message protocol must stay compatible with the
+  previous release: the host and its clients roll out independently.
 
 ## What the worker *may* hold
 

.github/actions/setup/action.yml

@@ -35,7 +35,7 @@ runs:
     - name: Setup Bun
       uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
       with:
-        bun-version: 1.4.2
+        bun-version: 1.4.4
 
     - name: Setup Node
       if: inputs.node-version != ''

.github/scripts/wait-for-ecs-cutover.sh

@@ -92,12 +92,15 @@ while [ -z "$DEPLOYMENT_ID" ] || [ "$DEPLOYMENT_ID" = 'None' ]; do
   DEPLOYMENT_ID=$(printf '%s\n' "$deploy_actions" | DEPLOY_STATE="$deploy_state" EXECUTION_ID="$EXECUTION_ID" python3 -c '
 import json, os, re, sys
 state = json.loads(os.environ["DEPLOY_STATE"])
-actions = json.load(sys.stdin)
+# The Deploy stage can also run sidecar actions (e.g. a CodeBuild image deploy); only the
+# CodeDeploy blue/green action carries the ECS cutover.
+actions = [a for a in json.load(sys.stdin)
+           if a.get("input", {}).get("actionTypeId", {}).get("provider") == "CodeDeployToECS"]
 if not state or state.get("latestExecution", {}).get("pipelineExecutionId") != os.environ["EXECUTION_ID"] or not actions:
     print("")
     sys.exit(0)
 if len({a["actionName"] for a in actions}) != 1:
-    raise SystemExit("ERROR: expected one Deploy action in the app pipeline")
+    raise SystemExit("ERROR: expected one CodeDeploy ECS action in the app pipeline Deploy stage")
 latest = max(actions, key=lambda a: a["startTime"])
 matches = [a["latestExecution"] for a in state.get("actionStates", [])
            if a["actionName"] == latest["actionName"]

.github/workflows/checks.yml

@@ -45,7 +45,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.2
+          bun-version: 1.4.4
       - name: Install only the pinned task planner
         continue-on-error: true
         run: bun install --global "turbo@$(jq -r .devDependencies.turbo package.json)"

.github/workflows/ci.yml

@@ -569,6 +569,9 @@ jobs:
       needs.promote.result == 'success' &&
       needs.trigger-upload.result == 'success' &&
       needs.promote.outputs.promoted == 'true'
+    outputs:
+      # The new app serves traffic; indexnow keys off this, not the later Trigger.dev promotion.
+      cutover: ${{ steps.cutover.outcome }}
     # Mostly waiting on the ECS cutover after a dependency install: the smallest runner is enough.
     runs-on: *runner-2vcpu
     # Leave setup/promotion headroom above the 70-minute cutover poll.
@@ -596,6 +599,7 @@ jobs:
       # An unchanged tag may belong to a failed or still-running earlier deploy.
       # Verify its latest cutover rather than treating tag equality as success.
       - name: Wait for ECS traffic cutover
+        id: cutover
         env:
           OVERALL_TIMEOUT: 4200
           APP_IMAGE_CHANGED: ${{ needs.promote.outputs.app_image_changed }}
@@ -636,6 +640,64 @@ jobs:
           fi
           bunx trigger.dev@4.5.16 promote "$VERSION" "${TARGET_ARGS[@]}"
 
+  # Production only, once the new app serves traffic: submit the library and comparison URLs this
+  # push changed to IndexNow. Best effort: nothing depends on it, and a failure never fails the run.
+  indexnow:
+    name: indexnow
+    needs: [promote, trigger-promote]
+    if: >-
+      !cancelled() &&
+      github.event_name == 'push' &&
+      github.ref == 'refs/heads/main' &&
+      needs.promote.outputs.promoted == 'true' &&
+      needs.trigger-promote.outputs.cutover == 'success'
+    runs-on: *runner-2vcpu
+    timeout-minutes: 5
+    continue-on-error: true
+    permissions:
+      contents: read
+      actions: read
+      checks: read
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: 1.4.4
+
+      # Diff from the last earlier main commit whose `indexnow` check succeeded, not the previous
+      # push: a push that never deployed, or whose submission failed, would otherwise drop its
+      # changed URLs for good. The check-runs lookup asks for this one check per commit, so it
+      # stays small and counts every attempt of a re-run; a lookup that errors counts as no
+      # success. With no success in view, the base is the oldest run in view, so URLs that no
+      # submission ever covered are sent now. The diff needs only the two trees, so that one
+      # commit is fetched alone; an all-zero `before` (the branch's first push) has no base,
+      # which the script skips.
+      - name: Submit changed URLs to IndexNow
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PUSH_BEFORE: ${{ github.event.before }}
+        run: |
+          BASE_SHA=""
+          OLDEST_SHA=""
+          while read -r head_sha; do
+            OLDEST_SHA="$head_sha"
+            if succeeded="$(gh api "repos/$GITHUB_REPOSITORY/commits/$head_sha/check-runs?check_name=indexnow&filter=all" \
+              --jq '[.check_runs[] | select(.conclusion == "success")] | length')" && [[ "$succeeded" -gt 0 ]]; then
+              BASE_SHA="$head_sha"
+              break
+            fi
+          done < <(gh api "repos/$GITHUB_REPOSITORY/actions/workflows/ci.yml/runs?branch=main&event=push&per_page=30" \
+            --jq ".workflow_runs[] | select(.id < $GITHUB_RUN_ID) | .head_sha")
+          BASE_SHA="${BASE_SHA:-${OLDEST_SHA:-$PUSH_BEFORE}}"
+          echo "Submitting URLs changed in $BASE_SHA..$GITHUB_SHA"
+          if [[ ! "$BASE_SHA" =~ ^0+$ ]]; then
+            git fetch --no-tags --depth=1 origin "$BASE_SHA"
+          fi
+          bun scripts/ping-indexnow.ts "$BASE_SHA" "$GITHUB_SHA"
+
   # Build ARM64 images for GHCR (main branch only, runs in parallel with
   # tests). Pushes only the immutable sha tag — latest-arm64/version-arm64
   # are applied by ghcr after the gate, so a failing run

.github/workflows/desktop-e2e.yml

@@ -79,7 +79,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.2
+          bun-version: 1.4.4
 
       # Electron, electron-builder and Playwright download their binaries on every cold install. All
       # three caches are keyed by version inside, so an older entry restored by prefix is harmless.
@@ -151,7 +151,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.2
+          bun-version: 1.4.4
 
       # Electron, electron-builder and Playwright download their binaries on every cold install. All
       # three caches are keyed by version inside, so an older entry restored by prefix is harmless.
@@ -213,7 +213,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.2
+          bun-version: 1.4.4
 
       - name: Setup Node
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6

.github/workflows/desktop-release.yml

@@ -143,7 +143,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.2
+          bun-version: 1.4.4
 
       - name: Setup Node
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6

.github/workflows/helm.yml

@@ -62,7 +62,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.2
+          bun-version: 1.4.4
 
       # Docker Compose and Kubernetes must run the same background jobs on the
       # same schedules; this fails the build if the two drift apart. The script
@@ -286,7 +286,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.2
+          bun-version: 1.4.4
 
       # Derives appVersion rather than checking it, so the published chart cannot
       # be pinned to an older Sim than the release it ships with. The committed
@@ -481,7 +481,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.2
+          bun-version: 1.4.4
 
       # Derives appVersion rather than checking it, so the published chart cannot
       # be pinned to an older Sim than the release it ships with. The committed

apps/desktop/package.json

@@ -9,7 +9,7 @@
   "type": "module",
   "main": "dist/main.cjs",
   "engines": {
-    "bun": ">=1.4.2",
+    "bun": ">=1.4.4",
     "node": ">=20.0.0"
   },
   "scripts": {