Skip to content

v0.9.34: oauth reconnect conflicts, sandbox host drain, token sealing backfill, migrate guards - #9396

Merged
waleedlatif1 merged 17 commits into
mainfrom
staging
Oct 27, 2026
Merged

waleedlatif1 merged 17 commits into
mainfrom
staging

Conversation

@waleedlatif1

Copy link
Copy Markdown
Collaborator

waleedlatif1 and others added 17 commits October 26, 2026 15:19
…he-top-options-compare (#9380)

Co-authored-by: Sim Pi Agent <pi@sim.ai>
…9381)

* docs(library): update ai-agent-examples-by-department-and-industry

* Pi Babysit: address PR #9381 feedback

---------

Co-authored-by: Sim Pi Agent <pi@sim.ai>
* docs(library): update best-ai-workflow-builders

* Pi Babysit: address PR #9382 feedback

---------

Co-authored-by: Sim Pi Agent <pi@sim.ai>
… the run's job list (#9384)

The indexnow job resolved its diff base by listing each earlier main run's jobs at 100 per page, and GitHub's jobs API answers that page with HTTP 502 for every re-run workflow run. The first release scanned back to such a run and failed the step, so no submission ever recorded a success and every later run would fail the same way.

Look up the one `indexnow` check run per commit instead (small, and it counts every attempt), treat a lookup that errors as no success, and when no success is in view diff from the oldest run in view so URLs no submission ever covered are still sent.
* docs(changelog): prepare Sim adds an Amazon EC2 block

* improvement(changelog): lead with knowledge base portability

* fix(changelog): clarify workspace-readable export limits
* feat(tailscale): expand and validate API operations

* fix(tailscale): normalize controls and output schemas

* fix(tailscale): preserve operation switch defaults
…bodies stop validating every element (#9388)

* fix(deps): backport zod's leading collection size check so oversized bodies stop validating every element

* fix(deps): stop later checks from reading an oversized container's unparsed elements
… executions (#9389)

* fix(isolated-vm): drain worker host deploys without failing in-flight executions

- Retire each remote worker connection at a max age (IVM_REMOTE_WORKER_MAX_AGE_MS,
  default 2 min) so a host the load balancer deregistered stops getting new
  executions and drains before its deregistration delay cuts the connections
- Re-dispatch an execution whose connection closed before it was sent; one that
  may have reached the host is never re-run and fails with a clear error
- Cap raw bytes a host connection may send before authenticating (16 KiB)
- Return a cancelled call before reading the worker-target flag

* fix(isolated-vm): address review on host drain

- Keep counting a refused connection's bytes until its socket closes
- Skip a redispatch the caller cancelled in between
- Look up the owner's state after the admission waits
- Parse IVM_REMOTE_WORKER_MAX_AGE_MS strictly, falling back below 1s
- Hold the inspected execution open until the worker check finishes

* test(isolated-vm): report an execution that fails before it is held
…on instead of a 500 (#9391)

* fix(credentials): send a conflicting OAuth reconnect back with a reason instead of a 500

* fix(credentials): keep the refused grant's tokens on the identity's existing rows

* fix(credentials): keep stored scope and resume connectors on a refused reconnect
…ackfill (#9393)

* feat(db): add manual Trigger.dev task for the account token sealing backfill

* fix(db): reject seal-account-tokens payloads without a boolean dryRun
@waleedlatif1
waleedlatif1 requested a review from a team as a code owner October 27, 2026 06:48
@vercel

vercel Bot commented Oct 27, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
docs Ready Ready Preview Oct 27, 2026 6:48am UTC

Request Review

@greptile-apps

greptile-apps Bot commented Oct 27, 2026 •

Copy link
Copy Markdown
Contributor

RetriggerView in GreptileConfidence Score: 4/5

[High impact] The PR reaches workflow-driven tailnet administration and shared sandbox and credential paths.

The PR appears safe to merge, with a non-blocking gap in the IndexNow fallback.

Findings

  1. P2 Oldest page changes stay unsubmitted ▶

Summary

This release improves OAuth reconnect errors, sandbox host draining, and migration safety.

  • Tailscale workflows can manage more devices, users, and network settings.
  • OAuth reconnects return a reason when another credential uses the chosen account.
  • Sandbox workers finish active executions as old connections drain.
  • Operators can run a manual task to seal existing account tokens.
  • Migration runs queue by environment and only use that environment's branch.
  • Zod checks collection size limits before parsing every item.
  • App, PII, and realtime images are prepared to run with a read-only root filesystem.
  • Chat text spacing and switch values are handled more consistently.
  • Integration guides and library articles are refreshed and repeated sections are consolidated.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[OAuth callback] --> B{Chosen account already backs another credential?}
  B -->|Yes| C[Update existing account tokens]
  C --> D[Discard reconnect draft]
  D --> E[Return with conflict reason]
  B -->|No| F[Create account row]
  F --> G[Move sibling credentials]
  G --> H[Complete reconnect]
Loading

Reviews (1) · Last reviewed commit: "fix(ci): only migrate an environment fro..." · Reviewed by Greptile

Comment thread .github/workflows/ci.yml

@cubic-dev-ai cubic-dev-ai Bot left a comment •

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All reported issues were addressed across 99 files

This PR changes a database schema or migrates data. Ultrareviews find 2.4x more serious bugs than standard reviews. Comment @cubic-dev-ai ultrareview to run one.

Turn on auto-fix | Re-trigger cubic

Comment thread apps/sim/lib/execution/isolated-vm-host.cjs
Comment thread apps/sim/background/seal-account-tokens.ts
Comment thread apps/sim/blocks/blocks/tailscale.ts
Comment thread apps/sim/tools/tailscale/utils.ts
Comment thread .github/workflows/ci.yml
Comment thread apps/sim/lib/credentials/draft-processor.ts
Comment thread apps/sim/tools/tailscale/set_dns_configuration.ts
Comment thread apps/sim/tools/tailscale/update_tailnet_settings.ts
Comment thread apps/sim/tools/tailscale/update_tailnet_settings.ts
Comment thread apps/sim/tools/tailscale/update_split_dns.ts
Comment thread apps/sim/scripts/test-isolated-vm-remote-e2e.ts Dismissed
@waleedlatif1
waleedlatif1 merged commit 0721dd6 into main Oct 27, 2026
147 checks passed

This branch was successfully deployed

1 active deployment
Preview — 4af6c5e6 Deployed Oct 27, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants