fix(credentials): report a refused host as the user's input, persist normalized account ids, cap Databricks reads by waleedlatif1 · Pull Request #9859 · simstudioai/sim

waleedlatif1 · 2026-11-10T23:17:29Z

Summary

Saved-credential checks on a typed host (Grafana, GitLab, Infisical, Upstash and the other configuredEndpoint/selfHostedService checks) now validate the host and fetch in two steps. A host the egress policy refuses (private address, plain http where https is required) fails as invalid_credentials 400 instead of provider_unavailable, which rendered as a retryable 503 for a refusal that never clears. Unknown hosts stay site_not_found; transport failures and transient DNS failures stay provider_unavailable
The token secret stores the validator's normalized account id, the same way it already stores the normalized domain (every normalizer only trims today, so stored values don't change)
Databricks token and SCIM Me responses are read through the capped JSON reader like the other credential checks
Comparison data says Sim's code path is the REST API and CLI, not an SDK

Type of Change

Bug fix

Testing

bunx vitest run lib/credentials/ in apps/sim: 87 files, 772 tests pass, including new cases for a refused host (invalid_credentials) and an unreachable host (provider_unavailable)
biome, check:comment-hygiene, check:utils

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing (new tests pass the test-audit authoring gate)
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

vercel · 2026-11-10T23:17:34Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Nov 11, 2026 12:21am UTC

cubic-dev-ai

All reported issues were addressed across 8 files

_{Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic}

greptile-apps · 2026-11-10T23:20:35Z

Confidence Score: 5/5

[Medium impact] This PR appears safe to merge; no new actionable issues remain.

Summary

This PR corrects saved-credential errors and bounds Databricks response reads.

Typed-host checks tell a refused address from an outage.
Saved credentials keep the account ID that validation checked.
Databricks credential checks cap token and identity replies.
Sim’s comparison profile names the REST API and CLI as code interfaces.

Both earlier, unnumbered findings are fixed: oversized identity replies stop the save, and interrupted token reads report a read failure instead of a size failure. No new actionable issues were found.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Check typed host] --> B{URL and DNS result}
  B -->|Policy refuses host| C[invalid_credentials]
  B -->|Host does not exist| D[site_not_found]
  B -->|Temporary lookup failure| E[provider_unavailable]
  B -->|Allowed| F[Fetch using checked IP]
  F -->|Connection fails| E
  F -->|Provider replies| G[Check provider response]

_{Reviews (5) · Last reviewed commit: "fix(credentials): tell an interrupted Da..." · Reviewed by Greptile}

Drops the response cap and crawl depth (landed in #9860), CONTRIBUTING (#9860), Firecrawl search sources (on hold), Databricks JSON caps (#9859), and the workflow middleware and route-policies cleanups (#9858). Drops the NO_PROXY entry-syntax docs line (owned by a separate NO_PROXY change). Generated files regenerated on current staging.

waleedlatif1 · 2026-11-11T00:03:04Z

@greptile

waleedlatif1 · 2026-11-11T00:03:05Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-11-11T00:03:11Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

All reported issues were addressed across 9 files

_{Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic}

waleedlatif1 · 2026-11-11T00:09:48Z

@greptile

waleedlatif1 · 2026-11-11T00:09:49Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-11-11T00:09:55Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

All reported issues were addressed across 9 files

_{Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic}

waleedlatif1 · 2026-11-11T00:17:56Z

@greptile

waleedlatif1 · 2026-11-11T00:17:57Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-11-11T00:18:03Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

…normalized account ids, cap Databricks reads - A saved-credential check whose typed host the egress policy refuses (private address, plain http where https is required) now fails as invalid_credentials instead of provider_unavailable, which rendered as a retryable 503 - The stored account id is the validator's normalized value, matching how the domain is stored - Databricks token and identity responses are read through the capped JSON reader - Comparison data no longer says Sim can be built in code via an SDK

…ty reply, cite the CLI docs

…ized

…om an oversized one

waleedlatif1 · 2026-11-11T00:21:14Z

@greptile

waleedlatif1 · 2026-11-11T00:21:15Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-11-11T00:21:22Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 9 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

cubic-dev-ai Bot reviewed Nov 10, 2026

View reviewed changes

Comment thread apps/sim/lib/compare/data/sim.ts Resolved

greptile-apps Bot reviewed Nov 10, 2026

View reviewed changes

Comment thread apps/sim/lib/credentials/databricks-service-account.server.ts Resolved

vercel Bot temporarily deployed to Preview November 10, 2026 23:25 Inactive

waleedlatif1 mentioned this pull request Nov 10, 2026

fix(release): redact deploy keys, check operation-backed tools in the saved-credential contract, and drop SDK copy #9864

Merged

6 tasks done

waleedlatif1 mentioned this pull request Nov 10, 2026

fix(security): harden saved-credential, proxy egress, and keyless-mint paths from the release audit #9865

Merged

8 tasks done

cubic-dev-ai Bot reviewed Nov 11, 2026

View reviewed changes

Comment thread apps/sim/lib/credentials/databricks-service-account.server.ts Resolved

waleedlatif1 force-pushed the fix/release-audit-1110-cleanups branch from 82cb3b7 to e7bfe31 Compare November 11, 2026 00:09

vercel Bot temporarily deployed to Preview November 11, 2026 00:09 Inactive

greptile-apps Bot reviewed Nov 11, 2026

View reviewed changes

Comment thread apps/sim/lib/credentials/databricks-service-account.server.ts Resolved

cubic-dev-ai Bot reviewed Nov 11, 2026

View reviewed changes

Comment thread apps/sim/lib/credentials/databricks-service-account.server.ts Resolved

vercel Bot temporarily deployed to Preview November 11, 2026 00:17 Inactive

waleedlatif1 added 4 commits November 10, 2026 16:20

fix(credentials): fail Databricks verification on an oversized identi…

e74437c

…ty reply, cite the CLI docs

fix(credentials): report an oversized Databricks token reply as overs…

3437a05

…ized

fix(credentials): tell an interrupted Databricks token reply apart fr…

cfdf4b7

…om an oversized one

waleedlatif1 force-pushed the fix/release-audit-1110-cleanups branch from dac87b7 to cfdf4b7 Compare November 11, 2026 00:21

vercel Bot temporarily deployed to Preview November 11, 2026 00:21 Inactive

cubic-dev-ai Bot reviewed Nov 11, 2026

View reviewed changes

waleedlatif1 merged commit 1a605bc into staging Nov 11, 2026
62 checks passed

waleedlatif1 deleted the fix/release-audit-1110-cleanups branch November 11, 2026 00:28

waleedlatif1 mentioned this pull request Nov 11, 2026

v0.9.53: saved credentials with keyless AWS and Databricks OIDC, read-only API keys, workspace members endpoint, trigger health and pinned versions, proxy support, search source permissions #9871

Merged

Conversation

waleedlatif1 commented Nov 10, 2026

Summary

Type of Change

Testing

Checklist

Uh oh!

vercel Bot commented Nov 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

greptile-apps Bot commented Nov 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Summary

Diagram

Uh oh!

Uh oh!

waleedlatif1 commented Nov 11, 2026

Uh oh!

waleedlatif1 commented Nov 11, 2026

Uh oh!

cubic-dev-ai Bot commented Nov 11, 2026

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

waleedlatif1 commented Nov 11, 2026

Uh oh!

waleedlatif1 commented Nov 11, 2026

Uh oh!

cubic-dev-ai Bot commented Nov 11, 2026

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

waleedlatif1 commented Nov 11, 2026

Uh oh!

waleedlatif1 commented Nov 11, 2026

Uh oh!

cubic-dev-ai Bot commented Nov 11, 2026

Uh oh!

waleedlatif1 commented Nov 11, 2026

Uh oh!

waleedlatif1 commented Nov 11, 2026

Uh oh!

cubic-dev-ai Bot commented Nov 11, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This branch was previously deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vercel Bot commented Nov 10, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

greptile-apps Bot commented Nov 10, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading