Merge remote-tracking branch 'origin/staging' into worktree-sim-native-kb-connectors

Author: mzxchandra

.agents/skills/ship/SKILL.md

@@ -69,7 +69,8 @@ When the user runs `/ship`:
   for s in check:boundaries check:api-validation:strict check:desktop-bridge check:desktop-ipc \
            check:utils check:zustand-v5 \
            check:react-query check:client-boundary check:bare-icons check:icon-paths \
-           check:realtime-prune check:tool-registry-boundary tool-metadata:check \
+           check:realtime-prune check:tool-registry-boundary check:tool-request-boundary \
+           tool-metadata:check \
            integration-catalog:check skills:check agent-stream-docs:check; do
     ( bun run "$s" >"/tmp/ship-audit-${s//:/-}.log" 2>&1; echo "$? $s" >>/tmp/ship-audit-results ) &
   done

.claude/commands/ship.md

@@ -68,7 +68,8 @@ When the user runs `/ship`:
   for s in check:boundaries check:api-validation:strict check:desktop-bridge check:desktop-ipc \
            check:utils check:zustand-v5 \
            check:react-query check:client-boundary check:bare-icons check:icon-paths \
-           check:realtime-prune check:tool-registry-boundary tool-metadata:check \
+           check:realtime-prune check:tool-registry-boundary check:tool-request-boundary \
+           tool-metadata:check \
            integration-catalog:check skills:check agent-stream-docs:check; do
     ( bun run "$s" >"/tmp/ship-audit-${s//:/-}.log" 2>&1; echo "$? $s" >>/tmp/ship-audit-results ) &
   done

.cursor/commands/ship.md

@@ -63,7 +63,8 @@ When the user runs `/ship`:
   for s in check:boundaries check:api-validation:strict check:desktop-bridge check:desktop-ipc \
            check:utils check:zustand-v5 \
            check:react-query check:client-boundary check:bare-icons check:icon-paths \
-           check:realtime-prune check:tool-registry-boundary tool-metadata:check \
+           check:realtime-prune check:tool-registry-boundary check:tool-request-boundary \
+           tool-metadata:check \
            integration-catalog:check skills:check agent-stream-docs:check; do
     ( bun run "$s" >"/tmp/ship-audit-${s//:/-}.log" 2>&1; echo "$? $s" >>/tmp/ship-audit-results ) &
   done

apps/docs/content/docs/en/platform/enterprise/self-hosted.mdx

@@ -23,7 +23,10 @@ ENTERPRISE_ENABLED=true
 NEXT_PUBLIC_ENTERPRISE_ENABLED=true
 ```
 
-That turns on organizations, permission groups, SSO, whitelabeling, audit logs, session policies, data retention, data drains, workspace forks, sandboxes, and the inbox.
+That turns on organizations, permission groups, SSO, whitelabeling, audit logs,
+session policies, data retention, data drains, workspace forks, the Sandbox
+entitlement, and the inbox. Sandboxes remain unavailable until their remote
+provider and dedicated Function base are configured.
 
 ### Turning one feature off
 
@@ -95,9 +98,16 @@ NEXT_PUBLIC_SANDBOXES_ENABLED=true
 ```
 
 `SANDBOXES_ENABLED` grants the server-side self-hosted entitlement.
-`NEXT_PUBLIC_SANDBOXES_ENABLED` exposes remote Python and Shell plus custom
-sandbox management in the browser. Set the public flag only after the selected
-provider has credentials and a valid immutable Function base configured.
+`NEXT_PUBLIC_SANDBOXES_ENABLED` projects provider readiness to the browser and
+exposes Shell plus custom Sandbox management. Set the public flag only after the
+selected provider has credentials and a valid immutable Function base configured.
+The Function language value itself is never conditioned on these flags, so a
+saved Python block cannot be silently serialized or executed as JavaScript.
+
+JavaScript without `import` or `require` does not use this remote provider and
+continues to run in the local isolated VM when all Sandbox flags are off. Python,
+Shell, JavaScript with external imports, and selected custom Sandboxes fail with
+an explicit configuration error until the remote Function base is ready.
 
 Mothership's `function_execute` and `run_code` tools use Mothership's separate
 shell image, including for JavaScript without imports. If the deployment uses

apps/docs/content/docs/en/platform/self-hosting/index.mdx

@@ -119,12 +119,11 @@ Sim is self-contained for the core editor and execution engine. A few features r
 | **Agent blocks** | An API key for at least one model provider | Or a self-hosted OpenAI-compatible endpoint: Ollama, vLLM, or LiteLLM. |
 | **Chat module** | `COPILOT_API_KEY` from sim.ai | Set `NEXT_PUBLIC_CHAT_DISABLED=true` to hide the module instead. |
 | **Integrations** | Your own OAuth app per service | See [Integrations & OAuth](/platform/self-hosting/integrations-oauth). |
-| **Function / Pi blocks at scale** | Optional E2B or Daytona key | Without one, code runs in the in-process isolated-vm sandbox. See [Security](/platform/self-hosting/security). |
+| **Remote Function / Pi execution** | Optional E2B or Daytona key | Without one, JavaScript Function code that has no `import` or `require` still runs in the in-process isolated VM. Python, Shell, JavaScript with external imports, custom Function Sandboxes, and Pi require a configured remote provider. See [Security](/platform/self-hosting/security). |
 
 <FAQ items={[
   { question: "What are the minimum requirements to self-host Sim?", answer: "At minimum you need 2 CPU cores, 12 GB RAM, 20 GB SSD storage, and Docker 20.10 or later. Memory is typically the constraining factor due to workflow execution (isolated-vm sandboxing), file processing, and vector operations (pgvector)."},
   { question: "What are the required environment variables for production?", answer: "Three secrets are required: BETTER_AUTH_SECRET (authentication), ENCRYPTION_KEY (data encryption), and INTERNAL_API_SECRET (service-to-service auth). Generate each with openssl rand -hex 32. You also need to set NEXT_PUBLIC_APP_URL and BETTER_AUTH_URL to your domain."},
   { question: "Can I use Sim with local AI models?", answer: "Yes. Sim supports Ollama for local model inference. Use docker-compose.ollama.yml instead of docker-compose.prod.yml. It offers both GPU (with NVIDIA support) and CPU-only profiles, and automatically pulls gemma3:4b as a starter model." },
 ]} />
 
-

apps/docs/content/docs/en/platform/self-hosting/security.mdx

@@ -115,7 +115,9 @@ Workflows can execute user-authored JavaScript and Python. Know which sandbox yo
 | **E2B** | `E2B_ENABLED=true`, `E2B_API_KEY` | Remote sandbox per execution. Strongest isolation; requires outbound access to E2B. |
 | **Daytona** | `SANDBOX_PROVIDER=daytona`, `DAYTONA_API_KEY` | Remote sandbox per execution. |
 
-Python execution and the tooling-dependent blocks require a remote sandbox provider — the in-process isolate runs JavaScript only.
+Python, Shell, JavaScript with external imports, and tooling-dependent blocks
+require a remote sandbox provider. JavaScript without `import` or `require`
+continues to run in the in-process isolate when no remote provider is configured.
 
 <Callout type="warn">
   With the default in-process sandbox, treat everyone who can author a workflow as someone running code in your app container's security context. If your Sim instance is open to a wide or partly-trusted audience, use a remote sandbox provider and enable the NetworkPolicy egress restrictions.

apps/docs/content/docs/en/workflows/blocks/function.mdx

@@ -16,7 +16,11 @@ The **Function block** runs your own JavaScript, Python, or Shell code as one st
 
 ### Code
 
-JavaScript is the default. Python and Shell appear when a remote sandbox provider is enabled. Reference an earlier output directly, with no quotes around the tag, and read an environment variable with `{{VAR}}`:
+JavaScript is the default. The language field is part of the saved workflow and is
+never removed when Sandbox configuration changes. Python remains available as a
+language choice; Shell and custom Sandbox controls appear when a remote Function
+sandbox provider is enabled. Reference an earlier output directly, with no quotes
+around the tag, and read an environment variable with `{{VAR}}`:
 
 <Tabs items={['JavaScript', 'Python', 'Shell']}>
   <Tab value="JavaScript">
@@ -98,6 +102,13 @@ on a self-hosted instance, build and configure the provider's dedicated
 generate are captured as images automatically.
 </Callout>
 
+<Callout type="info">
+If no remote provider is configured, JavaScript without `import` or `require`
+continues to run in Sim's local isolated VM. Missing E2B or Daytona configuration
+does not disable that path. Remote-only code fails with an explicit configuration
+error; Sim does not reinterpret Python or Shell as JavaScript.
+</Callout>
+
 The dedicated Function base has the same runtime and universal package contract
 on E2B and Daytona. It includes this data-science stack; use a workspace sandbox
 when another dependency must be present:
@@ -128,7 +139,9 @@ Create and edit sandboxes in **Settings → Sandboxes**. Only workspace admins c
 create or edit them. On sim.ai they need an active Max or Enterprise plan;
 self-hosted deployments turn them on with `SANDBOXES_ENABLED` (see
 [self-hosted enterprise](/platform/enterprise/self-hosted)). The section is
-hidden when a deployment has no sandbox provider configured.
+usable only when the deployment also has a remote provider and immutable Function
+base configured. The Function block hides its custom Sandbox selector when that
+runtime is unavailable.
 
 1. **Name** the sandbox — `bigquery-etl`, `scraping`, whatever the job is.
 2. Pick the **language**. This selects pip or npm for the dependency list. Python
@@ -363,8 +376,9 @@ The lazy `sim.files` and `sim.values` helpers are available only in JavaScript f
 - **Use stdout to debug.** `console.log()`, `print()`, and ordinary shell output land in `<function.stdout>` and the run logs.
 
 <FAQ items={[
-  { question: "What languages does the Function block support?", answer: "JavaScript, Python, and Shell. JavaScript is the default. Python and Shell appear when a remote sandbox provider is enabled." },
+  { question: "What languages does the Function block support?", answer: "JavaScript, Python, and Shell. JavaScript is the default. Python remains a stable saved language choice; Shell and custom Sandbox controls appear when a remote sandbox provider is enabled. Python and Shell execution require that provider." },
   { question: "When does code run locally vs. in a sandbox?", answer: "JavaScript without external imports runs in a local isolated sandbox for speed. JavaScript that uses import or require, Python, and Shell run in the configured remote sandbox." },
+  { question: "Does JavaScript still work without E2B or Daytona?", answer: "Yes. JavaScript without import or require runs in Sim's local isolated VM and does not require a remote provider. JavaScript with external imports, Python, Shell, and custom Sandboxes require E2B or Daytona and fail explicitly when it is unavailable." },
   { question: "How do I reference outputs from other blocks inside my code?", answer: "Use angle-bracket syntax directly, like <agent.content> or <api.data>, with no quotes around the tag — Sim replaces it with the real value before execution. For environment variables, use double curly braces: {{API_KEY}}." },
   { question: "What does the Function block return?", answer: "Two outputs: result and stdout. Use return in JavaScript, assign __sim_result__ in Python, or print an __SIM_RESULT__= marker in Shell to set result. Ordinary console, print, and command output goes to stdout." },
   { question: "Can I make HTTP requests from a Function block?", answer: "Yes. fetch() is available in JavaScript with async/await. In Python, use requests or httpx. In Shell, use curl or a CLI available on the selected sandbox." },

apps/sim/app/api/function/execute/route.test.ts

@@ -218,7 +218,7 @@ describe('Function Execute API Route', () => {
       expect(data).toHaveProperty('error', 'Unauthorized')
     })
 
-    it.concurrent('should use isolated-vm for secure sandboxed execution', async () => {
+    it('runs import-free JavaScript in isolated-vm without a remote provider', async () => {
       const req = createMockRequest('POST', {
         code: 'return "test"',
       })
@@ -229,6 +229,9 @@ describe('Function Execute API Route', () => {
       expect(response.status).toBe(200)
       expect(data.success).toBe(true)
       expect(data.output.result).toBe('test')
+      expect(mockExecuteInIsolatedVM).toHaveBeenCalledTimes(1)
+      expect(mockExecuteInSandbox).not.toHaveBeenCalled()
+      expect(mockExecuteShellInSandbox).not.toHaveBeenCalled()
     })
 
     it('does not accept a Mothership sandbox profile from the request body', async () => {

apps/sim/app/api/guardrails/validate/route.test.ts

@@ -435,4 +435,31 @@ describe('POST /api/guardrails/validate', () => {
     await expect(res.json()).resolves.toEqual({ error: 'Failed to resolve billing attribution' })
     expect(mockValidateHallucination).not.toHaveBeenCalled()
   })
+
+  /**
+   * The signal now reaches the scoring model, so cancellation is reachable here.
+   * `passed: false` would read to a consumer as the guardrail rejecting the content,
+   * blocking a run that was abandoned rather than judged.
+   */
+  it('reports a cancelled run as cancellation rather than a failed guardrail', async () => {
+    mockAuthorizeCredentialUse.mockResolvedValue({ ok: true })
+    mockValidateHallucination.mockRejectedValueOnce(
+      Object.assign(new Error('The operation was aborted.'), { name: 'AbortError' })
+    )
+
+    const res = await POST(
+      createMockRequest('POST', {
+        validationType: 'hallucination',
+        input: 'test input',
+        knowledgeBaseId: 'kb-1',
+        model: 'openai/gpt-4o',
+        workflowId: 'wf-1',
+      })
+    )
+
+    expect(res.status).toBe(499)
+    const json = await res.json()
+    expect(json.success).toBe(false)
+    expect(json.output?.passed).toBeUndefined()
+  })
 })

apps/sim/app/api/guardrails/validate/route.ts

@@ -28,6 +28,7 @@ import {
   ProviderNotAllowedError,
 } from '@/ee/access-control/utils/permission-check'
 import type { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
+import { isAbortError } from '@/providers/streaming-tool-loop-shared'
 import { getProviderFromModel } from '@/providers/utils'
 
 const logger = createLogger('GuardrailsValidateAPI')
@@ -316,7 +317,8 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
       auth.userId,
       billingAttribution,
       requestId,
-      resolvedSecretTraceRegistry
+      resolvedSecretTraceRegistry,
+      request.signal
     )
 
     /**
@@ -371,6 +373,19 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
       },
     })
   } catch (error: any) {
+    /**
+     * A cancelled run must not be reshaped into a verdict. `passed: false` here reads
+     * to a consumer as the guardrail rejecting the content, so an abandoned run would
+     * block content that was never actually judged. 499 matches the convention the
+     * workflow execute route already uses for a client-cancelled request.
+     */
+    if (isAbortError(error)) {
+      logger.info(`[${requestId}] Guardrails validation cancelled by client`)
+      return NextResponse.json(
+        { success: false, error: 'Client cancelled request' },
+        { status: 499 }
+      )
+    }
     logger.error(`[${requestId}] Guardrails validation failed`, { error })
     return NextResponse.json({
       success: true,
@@ -431,7 +446,8 @@ async function executeValidation(
   actorUserId: string,
   billingAttribution: BillingAttributionSnapshot | undefined,
   requestId: string,
-  resolvedSecretTraceRegistry: ResolvedSecretTraceRegistry | undefined
+  resolvedSecretTraceRegistry: ResolvedSecretTraceRegistry | undefined,
+  abortSignal: AbortSignal | undefined
 ): Promise<{
   passed: boolean
   error?: string
@@ -488,6 +504,7 @@ async function executeValidation(
       billingAttribution,
       requestId,
       resolvedSecretTraceRegistry,
+      abortSignal,
     })
   }
   if (validationType === 'pii') {