fix(release): host_not_allowed for refused hosts, internal-JWT-only secret release, and final release-audit cleanups (#9870)

* fix(api): tell a missing key owner from an owner whose ban state is null

user.banned is nullable, so a real owner with banned = NULL had every
personal key refused as orphaned. Select the joined user id and test that
instead; the ban and suspension checks are unchanged.

* fix(credentials): report a refused connection host as host_not_allowed

- egress validation names its refusal (dns or policy) instead of callers
  inferring it from a missing cause; an empty DNS answer is ENOTFOUND
- the token check judges every DNS record when an environment proxy will
  carry the request, so a mixed public/private host is refused up front
  rather than failing in the transport as a retryable 502; the transport's
  own refusal is a typed EgressRefusedError and maps the same way
- new host_not_allowed code (400) with its own connect-modal message
- Flow and GitLab personal-token verification classify a refused or
  missing host the same way
- the typed-URL scheme guard is shared and ignores the tabs and newlines
  the URL parser drops

* fix(credentials): report an oversized Databricks token success as a 502

An oversized 2xx token reply carried status 200 into provider_unavailable
and its logs. A refusal keeps its own status.

* docs(api): say v2 execute options need a full-access key or api:write

run.version, async and waitTimeoutSeconds refuse read-only keys; the meta
example lists search:read with the full-access scopes.

* chore(scripts): scope the payload-param allowlist to internal operations

Every listed tool is an internal operation, so the probed-request fallback
no longer builds or consults it.

* fix(redaction): keep Infisical secret names visible; redact only deployKey

* docs(networking): the SSRF guard matches NO_PROXY like curl, not like Bun

* fix(api-keys): never echo an internal key-creation failure to the caller

The unauthenticated CLI poll route and the settings routes returned the
raw error message for an internal failure. Return a fixed message and keep
the cause in the server log; a conflict still names the existing key. The
CLI's comment now says a 400 can also be a refused key creation.

* chore: log a failed route-cache clear and spell out the read-only key rollback

The route-cache clear stays non-fatal but warns when it fails for any
reason other than a missing build id or cache. The api-key-read-only flag
says to revoke or replace read-only keys before rolling back.

* fix(credentials): release saved secrets only to internal-JWT callers

The token route refused only session callers; any other auth type would
have been handed a saved secret. Allow internal JWT and refuse the rest.

Tools never execute in the browser (the registry boundary keeps the tool
registry out of every workspace client graph, and nothing else imports the
executor), so the browser-only token fetch through the route is deleted.

* fix(firecrawl): treat a blank maxDiscoveryDepth as unset

A cleared field arrived as '' and was sent as 0, a crawl of the start page
only. It now follows the blank maxDepth handling.

* chore(credentials): log a broken JWKS and keep the successor map out of credential display

The JWKS route still answers 404 when the signing key is broken, but warns
with the error. The GitLab personal-token display reads its block type
from the catalog entry instead of importing the generated successor map
into a client-imported module.

* test: drop or tighten assertions that could not fail

- delegation: the read-only replacement case decided its filter by
  scanning bound params in a fake DB; no real-boundary check exists, so
  it is dropped with the fake's filter
- Twilio: assert how many recordings requests were sent, so an empty
  loop cannot pass
- Pi: the removed-model case restated the absent-from-catalog case

* fix(security): ignore a malformed CIDR NO_PROXY entry

10.0.0.0/8/junk parsed as /8. An entry with extra segments is dropped like
any other unparseable entry, and the TSDoc says IP entries match within
their address family.

* chore(workflows): scope the paused-row read to its workflow and reuse the mutability guard

- the execution-status paused-row read filters by workflowId as well
- delete-workflow uses requireMutableWorkflow instead of an inline copy
- polling webhook logs carry the webhook id in metadata

* fix(credentials): never name a sibling credential in a trust-setup refusal

The caller may not be able to see the credential that holds or blocks the
subject, so both refusals name only the workspace or organization. The
uniqueness check documents its limits.

* docs: correct the Helm readOnlyRootFilesystem note and the deployed-run variables TSDoc

* test(credentials): rely on the shared env reset in the proxy validator tests

* chore(helm): bump the chart version for the README correction

* fix(redaction): keep prefixed secret keys masked while leaving Infisical's bare secretKey visible

* fix(release): keep bare secretKey redacted, leave the proxy every-address rule to the transport, and report unknown GitLab hosts as input errors

Author: waleedlatif1

apps/docs/content/docs/platform/self-hosting/networking.mdx

@@ -265,7 +265,7 @@ Most `/api` requests also pass through Next.js Proxy. The current app configurat
 
 The app makes outbound calls to model providers, integration APIs, your email provider, object storage, and your telemetry backend. Whether `HTTP_PROXY` / `HTTPS_PROXY` apply depends on which of those paths a call takes — there is no single answer, and no global setting that covers all of them.
 
-The server runs on Bun, and Bun's native `fetch` honors `$HTTP_PROXY`, `$HTTPS_PROXY`, and `$NO_PROXY`. Sim installs no global dispatcher. Default `fetch` uses the configured proxy unless `NO_PROXY` excludes the destination. The SSRF guard reads the same three variables, with the same rules, for every request it sends. The rest either build their own HTTP agent or speak a non-HTTP protocol.
+The server runs on Bun, and Bun's native `fetch` honors `$HTTP_PROXY`, `$HTTPS_PROXY`, and `$NO_PROXY`. Sim installs no global dispatcher. Default `fetch` uses the configured proxy unless `NO_PROXY` excludes the destination. The SSRF guard reads the same three variables for every request it sends, matching `NO_PROXY` the way curl does (see [Internal destinations and `NO_PROXY`](#internal-destinations-and-no_proxy)). The rest either build their own HTTP agent or speak a non-HTTP protocol.
 
 This depends on the runtime. The published images run Bun. If you build the standalone output and run it under Node instead, Node ignores these variables unless started with `NODE_USE_ENV_PROXY=1` (Node 22.21+ / 24.5+), and the `fetch`-based "Yes" rows stop being proxied — model providers, Resend, Gmail sending, the desktop update feed, and the telemetry relay. The Azure Blob, GCS and Azure Communication Services rows still hold: those SDKs read the proxy variables through their own agents rather than through `fetch`. See [Bun fetch](https://bun.sh/docs/runtime/networking/fetch) and [Node proxy configuration](https://nodejs.org/learn/http/enterprise-network-configuration).
 

apps/docs/openapi-v2-resources.json

@@ -4986,7 +4986,7 @@
                         "v2Enabled": true,
                         "keyType": "personal",
                         "expiresAt": null,
-                        "scopes": ["api:read", "api:write"]
+                        "scopes": ["api:read", "api:write", "search:read"]
                       }
                     }
                   }
@@ -18677,7 +18677,7 @@
               "v2Enabled": true,
               "keyType": "personal",
               "expiresAt": null,
-              "scopes": ["api:read", "api:write"]
+              "scopes": ["api:read", "api:write", "search:read"]
             }
           }
         ]

apps/docs/openapi-v2-workflows.json

@@ -14928,7 +14928,7 @@
                     "description": "Execute a deployed workflow version."
                   },
                   "version": {
-                    "description": "Deployment version to execute instead of the active one. Requires an API key or OAuth access token with workspace write access, and the workflow must be deployed. An unknown version returns `404`.",
+                    "description": "Deployment version to execute instead of the active one. Requires a full-access API key or an OAuth access token with `api:write`, plus workspace write access, and the workflow must be deployed. An unknown version returns `404`.",
                     "type": "integer",
                     "minimum": 1,
                     "maximum": 2147483647
@@ -15006,7 +15006,7 @@
           },
           "async": {
             "default": false,
-            "description": "Queue the run and return a 202 receipt. Requires an API key or OAuth access token and a deployed run source. Cannot stream, select outputs, enable thinking/tool events, or include file-inlining options (`includeFileBase64` or `base64MaxBytes`).",
+            "description": "Queue the run and return a 202 receipt. Requires a full-access API key or an OAuth access token with `api:write`, and a deployed run source. Cannot stream, select outputs, enable thinking/tool events, or include file-inlining options (`includeFileBase64` or `base64MaxBytes`).",
             "type": "boolean"
           },
           "executionTimeoutSeconds": {
@@ -15016,7 +15016,7 @@
             "maximum": 604800
           },
           "waitTimeoutSeconds": {
-            "description": "Wait at most this many seconds for a synchronous run; `0` waits until it settles. A run still going then continues in the background and the response carries its run receipt instead of its result: `202` on a JSON response, or a closing `detached` frame on an `application/x-ndjson` result stream, which keeps its `200`. The receipt is sent only once the run can be read on the runs resource, where it can also be cancelled. The run is admitted under asynchronous limits, and a dropped connection no longer cancels it. Requires an API key or OAuth access token. Cannot be combined with `async` or `stream`.",
+            "description": "Wait at most this many seconds for a synchronous run; `0` waits until it settles. A run still going then continues in the background and the response carries its run receipt instead of its result: `202` on a JSON response, or a closing `detached` frame on an `application/x-ndjson` result stream, which keeps its `200`. The receipt is sent only once the run can be read on the runs resource, where it can also be cancelled. The run is admitted under asynchronous limits, and a dropped connection no longer cancels it. Requires a full-access API key or an OAuth access token with `api:write`. Cannot be combined with `async` or `stream`.",
             "type": "integer",
             "minimum": 0,
             "maximum": 604800

apps/sim/lib/api-key/orchestration/index.test.ts

@@ -0,0 +1,54 @@
+import { dbChainMockFns, resetDbChainMock } from '@sim/testing'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { createWorkspaceKey } = vi.hoisted(() => ({ createWorkspaceKey: vi.fn() }))
+vi.mock('@/lib/api-key/auth', () => ({
+  createApiKey: vi.fn(),
+  createWorkspaceApiKey: createWorkspaceKey,
+}))
+
+import {
+  performCreatePersonalApiKey,
+  performCreateWorkspaceApiKey,
+} from '@/lib/api-key/orchestration'
+
+const INTERNAL_DETAIL = 'connect ECONNREFUSED 10.0.0.5:5432 for role april'
+
+describe('API key creation failures', () => {
+  beforeEach(() => {
+    resetDbChainMock()
+    createWorkspaceKey.mockReset()
+  })
+
+  it('never echoes an internal personal-key failure to the caller', async () => {
+    dbChainMockFns.limit.mockRejectedValueOnce(new Error(INTERNAL_DETAIL))
+
+    const result = await performCreatePersonalApiKey({ userId: 'user-1', name: 'CLI' })
+
+    expect(result).toMatchObject({ success: false, errorCode: 'internal' })
+    expect(result.error).not.toContain('ECONNREFUSED')
+  })
+
+  it('never echoes an internal workspace-key failure, but still names a conflict', async () => {
+    createWorkspaceKey.mockRejectedValueOnce(new Error(INTERNAL_DETAIL))
+    const internal = await performCreateWorkspaceApiKey({
+      workspaceId: 'ws-1',
+      userId: 'user-1',
+      name: 'CLI',
+    })
+    expect(internal).toMatchObject({ success: false, errorCode: 'internal' })
+    expect(internal.error).not.toContain('ECONNREFUSED')
+
+    createWorkspaceKey.mockRejectedValueOnce(new Error('A key named "CLI" already exists'))
+    const conflict = await performCreateWorkspaceApiKey({
+      workspaceId: 'ws-1',
+      userId: 'user-1',
+      name: 'CLI',
+    })
+    expect(conflict).toEqual({
+      success: false,
+      errorCode: 'conflict',
+      error: 'A key named "CLI" already exists',
+    })
+  })
+})

apps/sim/lib/api-key/orchestration/index.ts

@@ -208,7 +208,8 @@ export async function performCreatePersonalApiKey(
     return { success: true, key: { ...created, key: plainKey } }
   } catch (error) {
     logger.error('Failed to create personal API key', { error })
-    return { success: false, errorCode: 'internal', error: toError(error).message }
+    // The CLI poll route is unauthenticated, so an internal failure never echoes its cause.
+    return { success: false, errorCode: 'internal', error: 'Failed to create API key' }
   }
 }
 
@@ -266,10 +267,10 @@ export async function performCreateWorkspaceApiKey(
   } catch (error) {
     const message = toError(error).message
     logger.error('Failed to create workspace API key', { error })
-    return {
-      success: false,
-      error: message,
-      errorCode: message.includes('already exists') ? 'conflict' : 'internal',
+    if (message.includes('already exists')) {
+      return { success: false, error: message, errorCode: 'conflict' }
     }
+    // The CLI poll route is unauthenticated, so an internal failure never echoes its cause.
+    return { success: false, error: 'Failed to create API key', errorCode: 'internal' }
   }
 }

apps/sim/lib/api/contracts/v2/openapi/resources.ts

@@ -1939,7 +1939,7 @@ const declaredRoutes = [
               v2Enabled: true,
               keyType: 'personal',
               expiresAt: null,
-              scopes: ['api:read', 'api:write'],
+              scopes: ['api:read', 'api:write', 'search:read'],
             },
           },
         ]

apps/sim/lib/api/contracts/v2/workflows.ts

@@ -1508,7 +1508,7 @@ export const v2WorkflowRunSelectionSchema = z.discriminatedUnion('source', [
       version: versionNumberSchema
         .optional()
         .describe(
-          'Deployment version to execute instead of the active one. Requires an API key or OAuth access token with workspace write access, and the workflow must be deployed. An unknown version returns `404`.'
+          'Deployment version to execute instead of the active one. Requires a full-access API key or an OAuth access token with `api:write`, plus workspace write access, and the workflow must be deployed. An unknown version returns `404`.'
         ),
     })
     .strict(),
@@ -1599,7 +1599,7 @@ export const v2ExecuteWorkflowBodySchema = z
       .optional()
       .default(false)
       .describe(
-        'Queue the run and return a 202 receipt. Requires an API key or OAuth access token and a deployed run source. Cannot stream, select outputs, enable thinking/tool events, or include file-inlining options (`includeFileBase64` or `base64MaxBytes`).'
+        'Queue the run and return a 202 receipt. Requires a full-access API key or an OAuth access token with `api:write`, and a deployed run source. Cannot stream, select outputs, enable thinking/tool events, or include file-inlining options (`includeFileBase64` or `base64MaxBytes`).'
       ),
     /**
      * An upper bound on the request, not the effective timeout: the server
@@ -1628,7 +1628,7 @@ export const v2ExecuteWorkflowBodySchema = z
       .max(MAX_WORKFLOW_EXECUTION_TIMEOUT_SECONDS)
       .optional()
       .describe(
-        'Wait at most this many seconds for a synchronous run; `0` waits until it settles. A run still going then continues in the background and the response carries its run receipt instead of its result: `202` on a JSON response, or a closing `detached` frame on an `application/x-ndjson` result stream, which keeps its `200`. The receipt is sent only once the run can be read on the runs resource, where it can also be cancelled. The run is admitted under asynchronous limits, and a dropped connection no longer cancels it. Requires an API key or OAuth access token. Cannot be combined with `async` or `stream`.'
+        'Wait at most this many seconds for a synchronous run; `0` waits until it settles. A run still going then continues in the background and the response carries its run receipt instead of its result: `202` on a JSON response, or a closing `detached` frame on an `application/x-ndjson` result stream, which keeps its `200`. The receipt is sent only once the run can be read on the runs resource, where it can also be cancelled. The run is admitted under asynchronous limits, and a dropped connection no longer cancels it. Requires a full-access API key or an OAuth access token with `api:write`. Cannot be combined with `async` or `stream`.'
       ),
     stream: z
       .boolean()

apps/sim/lib/api/server/routes/v2-api-key-auth.test.ts

@@ -199,6 +199,26 @@ describe('v2 API key authentication', () => {
     )
   })
 
+  it('accepts a personal key whose owner has never had a ban state recorded', async () => {
+    queueTableRows(schemaMock.apiKey, [
+      {
+        id: 'key-1',
+        userId: 'user-1',
+        workspaceId: null,
+        type: 'personal',
+        access: 'write',
+        expiresAt: null,
+        ownerUserId: 'user-1',
+        userBanned: null,
+        userSuspendedAt: null,
+      },
+    ])
+
+    const result = await authenticateV2ApiKey({ apiKey: 'secret', bearer: null })
+
+    expect(result.principal).toEqual(createPersonalApiKeyPrincipal())
+  })
+
   it('refuses a personal key whose owner row is gone as invalid, expired or not', async () => {
     for (const expiresAt of [null, new Date(Date.now() - 1)]) {
       queueTableRows(schemaMock.apiKey, [
@@ -209,6 +229,7 @@ describe('v2 API key authentication', () => {
           type: 'personal',
           access: 'write',
           expiresAt,
+          ownerUserId: null,
           userBanned: null,
           userSuspendedAt: null,
         },

apps/sim/lib/api/server/routes/v2-api-key-auth.ts

@@ -77,14 +77,16 @@ interface ApiKeyRow {
   type: string
   access: ApiKeyAccess
   expiresAt: Date | null
+  /** The joined owner's id: `null` only when the owner row is gone (`user.banned` is itself nullable). */
+  ownerUserId: string | null
   userBanned: boolean | null
   userSuspendedAt: Date | null
 }
 
 function requireValidRow(row: ApiKeyRow | undefined): ApiKeyRow {
   if (!row) throw new V2ApiKeyUnauthenticatedError()
   if (row.type === 'personal' && row.workspaceId === null) {
-    if (row.userBanned === null) {
+    if (row.ownerUserId === null) {
       logger.error('Personal API key is missing its credential owner', { keyId: row.id })
       throw new V2ApiKeyUnauthenticatedError()
     }
@@ -118,6 +120,7 @@ async function authenticateApiKey(apiKeyHeader: string): Promise<V2ApiKeyAuthCon
       type: apiKey.type,
       access: apiKey.access,
       expiresAt: apiKey.expiresAt,
+      ownerUserId: user.id,
       userBanned: user.banned,
       userSuspendedAt: user.suspendedAt,
     })

apps/sim/lib/core/config/feature-flags.ts

@@ -79,7 +79,7 @@ const FEATURE_FLAGS = {
   },
   'api-key-read-only': {
     description:
-      'Allow creating read-only API keys. Turn on only after every pod runs a release that enforces key access, since older pods treat a read-only key as full access. Before rolling back below the release that added read-only keys, turn this off first: that older code also serves every existing read-only key as full access. Enforcement of existing read-only keys never depends on this flag. Global; disabled by default.',
+      'Allow creating read-only API keys. Turn on only after every pod runs a release that enforces key access, since older pods treat a read-only key as full access. Before rolling back below the release that added read-only keys, turn this off and revoke or replace every existing read-only key: turning the flag off only stops new ones, and that older code serves existing read-only keys as full access. Enforcement of existing read-only keys never depends on this flag. Global; disabled by default.',
     fallback: 'API_KEY_READ_ONLY',
   },
   'mothership-model-selector': {