Skip to content

Commit 59d9496

Browse files
authored
v0.7.8: security hardening, code hygiene, MSFT oauth provider, new atlassian assets and google calendar tools
2 parents 8c3706e + 6cbaf42 commit 59d9496

539 files changed

Lines changed: 40708 additions & 11811 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

.agents/skills/add-connector/SKILL.md

Lines changed: 65 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,8 @@ You are an expert at adding knowledge base connectors to Sim. A connector syncs
1212
When the user asks you to create a connector:
1313
1. Use Context7 or WebFetch to read the service's API documentation
1414
2. Determine the auth mode: **OAuth** (if Sim already has an OAuth provider for the service) or **API key** (if the service uses API key / Bearer token auth)
15-
3. Create the connector directory and config
16-
4. Register it in the connector registry
15+
3. Create the connector directory: a client-safe `meta.ts` (declarative metadata) plus the runtime module that spreads it
16+
4. Register it in BOTH the server registry and the client-safe meta registry
1717

1818
## Hard Rule: No Guessed Response Or Document Schemas
1919

@@ -32,13 +32,19 @@ If the source schema is unknown, do one of these instead:
3232

3333
## Directory Structure
3434

35+
Each connector is split into a client-safe metadata file and a server-only runtime file. This mirrors the `XBlockMeta` / `BLOCK_META_REGISTRY` split in `apps/sim/blocks` — client components (the knowledge UI) only need the metadata (icon, name, auth, config fields), so the runtime functions (which pull server-only helpers like `input-validation.server``undici``node:net`) must stay out of the client bundle.
36+
3537
Create files in `apps/sim/connectors/{service}/`:
3638
```
3739
connectors/{service}/
38-
├── index.ts # Barrel export
39-
└── {service}.ts # ConnectorConfig definition
40+
├── index.ts # Barrel export (re-exports the runtime connector)
41+
├── meta.ts # ConnectorMeta — client-safe declarative metadata
42+
└── {service}.ts # ConnectorConfig — spreads the meta + adds runtime functions
4043
```
4144

45+
- `meta.ts` exports `{service}ConnectorMeta: ConnectorMeta`. It imports ONLY the icon from `@/components/icons`, `import type { ConnectorMeta } from '@/connectors/types'`, and any pure-data constants. It must NEVER import server/runtime code.
46+
- `{service}.ts` exports `{service}Connector: ConnectorConfig`. It imports the meta via `import { {service}ConnectorMeta } from '@/connectors/{service}/meta'`, spreads it as the first property, and holds the runtime functions (which may import server-only helpers like `@/lib/knowledge/documents/utils`).
47+
4248
## Authentication
4349

4450
Connectors use a discriminated union for auth config (`ConnectorAuthConfig` in `connectors/types.ts`):
@@ -55,19 +61,17 @@ For services with existing OAuth providers in `apps/sim/lib/oauth/types.ts`. The
5561
### API key mode
5662
For services that use API key / Bearer token auth. The modal shows a password input with the configured `label` and `placeholder`. The API key is encrypted at rest using AES-256-GCM and stored in a dedicated `encryptedApiKey` column on the connector record. The sync engine decrypts it automatically — connectors receive the raw access token in `listDocuments`, `getDocument`, and `validateConfig`.
5763
58-
## ConnectorConfig Structure
64+
## Connector Structure (meta.ts + runtime)
65+
66+
The declarative metadata lives in `meta.ts` (`ConnectorMeta`). The runtime functions live in `{service}.ts` (`ConnectorConfig`), which spreads the meta as its first property.
5967
60-
### OAuth connector example
68+
### `meta.ts` — client-safe metadata
6169
6270
```typescript
63-
import { createLogger } from '@sim/logger'
6471
import { {Service}Icon } from '@/components/icons'
65-
import { fetchWithRetry } from '@/lib/knowledge/documents/utils'
66-
import type { ConnectorConfig, ExternalDocument, ExternalDocumentList } from '@/connectors/types'
67-
68-
const logger = createLogger('{Service}Connector')
72+
import type { ConnectorMeta } from '@/connectors/types'
6973

70-
export const {service}Connector: ConnectorConfig = {
74+
export const {service}ConnectorMeta: ConnectorMeta = {
7175
id: '{service}',
7276
name: '{Service}',
7377
description: 'Sync documents from {Service} into your knowledge base',
@@ -85,6 +89,26 @@ export const {service}Connector: ConnectorConfig = {
8589
// Supports 'short-input' and 'dropdown' types
8690
],
8791

92+
// Optional: tag definitions are metadata too — declare them here
93+
// tagDefinitions: [ ... ],
94+
}
95+
```
96+
97+
Keep `meta.ts` free of any server/runtime import. Only the icon, the `ConnectorMeta` type, and pure-data constants belong here.
98+
99+
### `{service}.ts` — runtime (OAuth example)
100+
101+
```typescript
102+
import { createLogger } from '@sim/logger'
103+
import { fetchWithRetry } from '@/lib/knowledge/documents/utils'
104+
import { {service}ConnectorMeta } from '@/connectors/{service}/meta'
105+
import type { ConnectorConfig, ExternalDocument, ExternalDocumentList } from '@/connectors/types'
106+
107+
const logger = createLogger('{Service}Connector')
108+
109+
export const {service}Connector: ConnectorConfig = {
110+
...{service}ConnectorMeta,
111+
88112
listDocuments: async (accessToken, sourceConfig, cursor) => {
89113
// Return metadata stubs with contentDeferred: true (if per-doc content fetch needed)
90114
// Or full documents with content (if list API returns content inline)
@@ -111,8 +135,11 @@ Only map fields in `listDocuments`, `getDocument`, `validateConfig`, and `mapTag
111135

112136
### API key connector example
113137

138+
The split is identical — `auth` lives in `meta.ts`, runtime functions in `{service}.ts`.
139+
114140
```typescript
115-
export const {service}Connector: ConnectorConfig = {
141+
// meta.ts
142+
export const {service}ConnectorMeta: ConnectorMeta = {
116143
id: '{service}',
117144
name: '{Service}',
118145
description: 'Sync documents from {Service} into your knowledge base',
@@ -126,6 +153,11 @@ export const {service}Connector: ConnectorConfig = {
126153
},
127154

128155
configFields: [ /* ... */ ],
156+
}
157+
158+
// {service}.ts
159+
export const {service}Connector: ConnectorConfig = {
160+
...{service}ConnectorMeta,
129161
listDocuments: async (accessToken, sourceConfig, cursor) => { /* ... */ },
130162
getDocument: async (accessToken, sourceConfig, externalId) => { /* ... */ },
131163
validateConfig: async (accessToken, sourceConfig) => { /* ... */ },
@@ -499,7 +531,9 @@ If the service already has an icon in `apps/sim/components/icons.tsx` (from a to
499531

500532
## Registering
501533

502-
Add one line to `apps/sim/connectors/registry.ts`:
534+
Register in BOTH registries, keeping the same alphabetical-by-id ordering in each.
535+
536+
1. **Server registry**`apps/sim/connectors/registry.server.ts` (server-only full registry; holds full connectors with runtime functions, imported by the sync engine and knowledge API routes):
503537

504538
```typescript
505539
import { {service}Connector } from '@/connectors/{service}'
@@ -510,6 +544,19 @@ export const CONNECTOR_REGISTRY: ConnectorRegistry = {
510544
}
511545
```
512546

547+
2. **Client-safe meta registry**`apps/sim/connectors/registry.ts` (imports each connector's `meta.ts` only, so client components can use it without pulling server-only code; the metadata counterpart to `BLOCK_META_REGISTRY`):
548+
549+
```typescript
550+
import { {service}ConnectorMeta } from '@/connectors/{service}/meta'
551+
552+
export const CONNECTOR_META_REGISTRY: ConnectorMetaRegistry = {
553+
// ... existing connector metas ...
554+
{service}: {service}ConnectorMeta,
555+
}
556+
```
557+
558+
`registry.ts` exports `CONNECTOR_META_REGISTRY: ConnectorMetaRegistry` plus the helpers `getConnectorMeta(id)` and `getAllConnectorMeta()`, importing each `@/connectors/{service}/meta` directly — never the runtime module. `registry.server.ts` exports `CONNECTOR_REGISTRY: ConnectorRegistry`.
559+
513560
## Reference Implementations
514561

515562
- **OAuth + contentDeferred**: `apps/sim/connectors/google-drive/google-drive.ts` — file download with metadata-based hash, `orderBy` for deterministic pagination
@@ -520,7 +567,8 @@ export const CONNECTOR_REGISTRY: ConnectorRegistry = {
520567

521568
## Checklist
522569

523-
- [ ] Created `connectors/{service}/{service}.ts` with full ConnectorConfig
570+
- [ ] Created `connectors/{service}/meta.ts` with `{service}ConnectorMeta: ConnectorMeta` (icon, name, auth, configFields, tagDefinitions) — no server/runtime imports
571+
- [ ] Created `connectors/{service}/{service}.ts` with `{service}Connector: ConnectorConfig` spreading the meta + runtime functions
524572
- [ ] Created `connectors/{service}/index.ts` barrel export
525573
- [ ] **Auth configured correctly:**
526574
- OAuth: `auth.provider` matches an existing `OAuthService` in `lib/oauth/types.ts`
@@ -542,4 +590,5 @@ export const CONNECTOR_REGISTRY: ConnectorRegistry = {
542590
- [ ] All external API calls use `fetchWithRetry` (not raw `fetch`)
543591
- [ ] All optional config fields validated in `validateConfig`
544592
- [ ] Icon exists in `components/icons.tsx` (or asked user to provide SVG)
545-
- [ ] Registered in `connectors/registry.ts`
593+
- [ ] Registered the full connector in `connectors/registry.server.ts`
594+
- [ ] Registered the meta in `connectors/registry.ts` (same alphabetical-by-id ordering as registry.server.ts)

.agents/skills/db-migrate/SKILL.md

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
---
2+
name: db-migrate
3+
description: Author or review a Drizzle DB migration for zero-downtime safety — expand/contract phasing, backward-compatibility with the deployed app version, and writing the `-- migration-safe` acknowledgment the check:migrations lint requires. Use when adding/editing files under `packages/db/migrations/` or changing `packages/db/schema.ts`.
4+
---
5+
6+
# DB Migrate Skill
7+
8+
You make schema changes that survive a deploy without downtime. The `check:migrations` lint (`scripts/check-migrations-safety.ts`) is the deterministic gate; you are the judgment that decides whether a flagged change is actually safe and writes the annotation that satisfies it.
9+
10+
## The window (why this matters)
11+
12+
A deploy runs the migration, then rolls out the new app image via blue/green. The two are **not atomic and cannot be** — during cutover the old task set keeps serving against the **already-migrated** schema. So:
13+
14+
> Every migration must be backward-compatible with the app version that is *already deployed*.
15+
16+
If a migration drops a column the old code still reads, renames one, or adds a `NOT NULL` the old inserts don't populate, the old code throws until traffic fully shifts — the downtime we're guarding against. You can't fix this by reordering the pipeline; the only fix is discipline.
17+
18+
## Expand / contract
19+
20+
Split every breaking change across **two deploys**:
21+
22+
1. **Expand** (this PR): additive, backward-compatible schema + code that tolerates *both* the old and new shape.
23+
2. **Contract** (a later PR, after expand is fully deployed): remove the old thing, now that nothing reads it.
24+
25+
Never put expand and contract in the same PR. If this PR both removes the code that used a column *and* drops the column, the old code is still live during cutover — split it.
26+
27+
### Per-operation playbook
28+
29+
| You want to | Do (deploy 1 = expand) | Do (deploy 2 = contract) |
30+
|---|---|---|
31+
| Add a required column | `ADD COLUMN` nullable or `DEFAULT`; code writes it | backfill, then `SET NOT NULL` |
32+
| Rename a column/table | add the new name; code dual-writes / reads new-then-old | drop the old name |
33+
| Drop a column/table | stop all reads/writes in code; ship it | `DROP` (annotate) |
34+
| Change a column type | add a new column of the new type; dual-write | backfill, swap reads, drop old |
35+
| Add FK / CHECK | `ADD CONSTRAINT ... NOT VALID` | `VALIDATE CONSTRAINT` separately |
36+
| Index an existing table | `COMMIT;` breakpoint → `SET lock_timeout = 0``CREATE INDEX CONCURRENTLY IF NOT EXISTS` (see `packages/db/scripts/migrate.ts`) ||
37+
| Drop an index | `COMMIT;` breakpoint → `DROP INDEX CONCURRENTLY` — plain `DROP INDEX` takes ACCESS EXCLUSIVE on the table ||
38+
| Backfill data | batched + idempotent `UPDATE` (keyset/`WHERE`, bounded) ||
39+
40+
A `CREATE INDEX`, `ADD COLUMN`, or `ADD CONSTRAINT` against a table **created in the same migration** is always safe (no rows, no live traffic) — the lint already suppresses those.
41+
42+
## Tracking the contract (don't let it rot)
43+
44+
The contract half is deferred to a later deploy — and that is exactly when it gets forgotten, leaving dead columns, orphaned tables, and `NOT NULL`s that never land. Every deferred contract must become a durable, greppable TODO.
45+
46+
When an expand defers a drop, leave a **`contract-pending`** marker on the legacy column/table in `packages/db/schema.ts` — that is the file you will be editing when you finally do the drop, so the reminder lives where the work happens:
47+
48+
```ts
49+
// contract-pending(after #5035 is fully deployed): drop once permission-check.ts stops reading it
50+
workspaceId: text('workspace_id'),
51+
```
52+
53+
Format: `contract-pending(<precondition>): <what to drop> — <why it's safe once the precondition holds>`. The precondition names the PR/release that removes the last reader and **must be fully deployed** before the contract ships.
54+
55+
- **The TODO list is a grep** — always accurate, never drifts: `grep -rn "contract-pending" packages/db apps/sim`. Run it when starting migration work to see what is owed.
56+
- For anything with a real owner or schedule, also open a tracking issue and put its number in the marker.
57+
- **Close the loop in the contract PR:** the contract migration's `-- migration-safe:` annotation references the expand, and you **delete the `contract-pending` marker** in the same PR:
58+
```sql
59+
-- migration-safe: contract of #5035 — workspace_id readers removed there, deployed 2026-06-10
60+
ALTER TABLE "permission_group" DROP COLUMN "workspace_id";
61+
```
62+
- An expand merged **without** a marker for the drop it defers, or a contract merged **without** removing its marker, is a bug — flag it in review.
63+
64+
## The judgment the lint can't do
65+
66+
The lint flags risky *shapes*; it cannot know whether a given drop is *safe right now*. For each flagged statement, do the work it can't:
67+
68+
1. **Is the dependency gone?** Grep the app for the table/column: search `apps/sim` and `packages` for the column name, the Drizzle field (camelCase), and the table object. If any live read/write remains, it is **not** safe — fix the code first.
69+
2. **Did the expand already ship?** The removal of that read/write must be in a deploy that is *already out*, not this same PR. If it's in this PR, split: land the code change now, do the destructive migration in a follow-up after it deploys.
70+
3. **Backfills:** confirm the `UPDATE`/`DELETE` is batched (bounded `WHERE`/keyset, not a single whole-table statement), idempotent (safe to replay — a failed migration re-runs unjournaled files from the top), and safe under concurrent writes from the still-live old app.
71+
72+
## Workflow
73+
74+
1. Edit `packages/db/schema.ts`, then `cd packages/db && bunx drizzle-kit generate` to produce the SQL. If this is an expand that defers a drop, leave a `contract-pending` marker on the legacy column (see "Tracking the contract"). If this is the contract, delete the marker it resolves.
75+
2. Hand-edit the generated SQL where the playbook requires it: `CONCURRENTLY` + `COMMIT;` breakpoint for indexes on existing tables, `NOT VALID` for constraints, batching for backfills.
76+
3. Run `bun run check:migrations` (base defaults to `origin/staging`).
77+
- **Hard errors** (`add-not-null-no-default`, `rename`, `index-not-concurrent`, `constraint-not-valid`, …): rewrite into expand/contract. Do **not** try to annotate them away — the lint won't accept it.
78+
- **Annotate tier** (`drop-table`, `drop-column`, `drop-default`, `set-not-null`, `alter-type`, `drop-index`): only after you've confirmed steps 1–3 above, add a comment on the line directly above the statement:
79+
```sql
80+
-- migration-safe: `secret` read removed in v0.6.1 (#1234), shipped two deploys ago
81+
ALTER TABLE "webhook" DROP COLUMN "secret";
82+
```
83+
The reason must be specific and name the PR/version that removed the dependency. An empty reason fails the lint.
84+
- **Warnings** (`data-backfill`): non-blocking, but confirm the batching/idempotency before merging.
85+
4. Verify locally: `cd packages/db && bun run db:migrate` against a dev DB.
86+
87+
## Hard rule
88+
89+
Never annotate a destructive statement just to make the lint pass. The annotation is a claim that you verified the old code no longer depends on it. If you can't make that claim truthfully, the change belongs in a later deploy — tell the user to split it.

.agents/skills/ship/SKILL.md

Lines changed: 11 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
22
name: ship
3-
description: Commit, push, and open a PR to staging in one shot
3+
description: Commit, push, and open a PR to staging in one shot — runs the cleanup pass and, when migrations changed, the db-migrate safety review first
44
---
55

66
# Ship Command
@@ -16,12 +16,17 @@ When the user runs `/ship`:
1616
- Types: `fix`, `feat`, `improvement`, `chore`
1717
- Scope: short identifier (e.g., `undo-redo`, `api`, `ui`)
1818
- Keep it concise
19-
3. **Run pre-ship checks** from the repo root before staging:
19+
3. **Run the cleanup pass** — only if the diff modifies UI code (any `.tsx` file, or anything under `apps/sim/components/`, `apps/sim/hooks/`, or `apps/sim/stores/`): `/cleanup`
20+
- The six code-quality skills (effects, memo, callbacks, state, React Query, emcn) only apply to React code, so skip this step entirely when no UI was touched. When it runs, it applies fixes so they land in this commit.
21+
4. **Run migration safety** — only if the diff touches `packages/db/migrations/**` or `packages/db/schema.ts`:
22+
- Run `/db-migrate` to review the migration for zero-downtime safety (expand/contract phasing, backward-compatibility with the deployed app version).
23+
- `bun run check:migrations origin/staging` must pass (staging is the PR base). Do not silence a flagged statement with a `-- migration-safe:` annotation unless `/db-migrate` confirmed the old code no longer depends on it; otherwise split the destructive change into a later deploy.
24+
5. **Run pre-ship checks** from the repo root before staging:
2025
- `bun run lint` to fix formatting issues
2126
- `bun run check:api-validation:strict` to catch boundary contract failures before CI
22-
4. **Stage and commit** the changes with the generated message
23-
5. **Push to origin** using the current branch name
24-
6. **Create a PR** to staging with a description in the user's voice
27+
6. **Stage and commit** the changes with the generated message
28+
7. **Push to origin** using the current branch name
29+
8. **Create a PR** to staging with a description in the user's voice
2530

2631
## Commit Message Format
2732

@@ -77,7 +82,7 @@ gh pr create --base staging --title "COMMIT_MESSAGE" --body "PR_BODY"
7782

7883
- Short, direct bullet points
7984
- No unnecessary explanation
80-
- "Tested manually" is acceptable for testing section; include lint and boundary validation results when run
85+
- "Tested manually" is acceptable for testing section; include lint, boundary validation, and (when migrations changed) `check:migrations` results when run
8186
- Checkboxes filled in appropriately
8287
- No screenshots section unless UI changes
8388

0 commit comments

Comments
 (0)