fix(release): redact deploy keys, check operation-backed tools in the saved-credential contract, and drop SDK copy by waleedlatif1 · Pull Request #9864 · simstudioai/sim

waleedlatif1 · 2026-11-10T23:33:38Z

Summary

Release-audit cleanups that no other follow-up PR covers. Trimmed to avoid overlap: Firecrawl depth and CONTRIBUTING landed in #9860; normalized account ids and compare-data wording are in #9859; Mistral Max Images is in #9863; proxy/NO_PROXY docs are in #9865.

Redaction: deployKey (Convex) is now a sensitive key, so its value is redacted in persisted logs and console output. A bare secretKey stays unredacted on purpose: Infisical returns each secret's name in that field
Saved-credential contract: operation-backed tools were exempt from the host-steering check, so a future tool adding an unmapped host param would pass CI. Destination-named params on operation-backed tools now count as steering (AWS families are still skipped by the caller); the four current tools whose matching params are request data (startUrl, serverId, audioUrl, customDomain) are listed with the reason — each was checked to send its token only to the vendor's fixed API host
Logfire: documented why region is mapped alongside host on the saved credential
SDK leftovers: landing nav no longer advertises SDKs; CI.md planner wording says "Standalone package"

Type of Change

Bug fix

Testing

New cases in lib/core/security/redaction.test.ts and scripts/saved-credential-contract.test.ts; each guard was reverted and its test went red
bunx vitest run lib/core/security/redaction.test.ts scripts/saved-credential-contract.test.ts plus every test touching secretKey/deployKey (1,020 tests) — all pass
check-block-registry.ts origin/staging (saved-credential contract passes), check:comment-hygiene
lint:check + type-check via the pre-push hook; full check:audits and bun run test left to CI

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing (new tests pass the test-audit authoring gate)
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

vercel · 2026-11-10T23:33:42Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Nov 10, 2026 11:51pm UTC

greptile-apps · 2026-11-10T23:37:12Z

Confidence Score: 5/5

[Medium impact] No new blocking issue was established, and no numbered previous finding was supplied for scoring.

Summary

The PR expands credential redaction and adds destination checks for operation-backed tools.

Secret-key fields now get redacted from shared output.
The saved-credential check now checks destination-like inputs on operation-backed tools.
Docs now name the CLI and clarify package and Logfire wording.

Previous-thread context: waleedlatif1 acknowledged the Infisical naming issue and rejected renaming secretKey because saved workflows reference it. They reported removing the pattern, but the reviewed head still contains it. The supplied thread is unnumbered, so it receives no previousFindings entry and is not reposted.

Review checks used source inspection; no tests or browser checks were run.

_{Reviews (4) · Last reviewed commit: "fix(release): redact secret-key fields, ..." · Reviewed by Greptile}

cubic-dev-ai

All reported issues were addressed across 16 files

_{Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic}

waleedlatif1 · 2026-11-10T23:42:30Z

@greptile

waleedlatif1 · 2026-11-10T23:42:31Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-11-10T23:42:35Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 16 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

…in the saved-credential contract, and drop SDK copy

waleedlatif1 · 2026-11-10T23:48:32Z

@greptile

waleedlatif1 · 2026-11-10T23:48:34Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-11-10T23:48:38Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 7 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

waleedlatif1 · 2026-11-10T23:58:44Z

@greptile

waleedlatif1 · 2026-11-10T23:58:46Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-11-10T23:58:52Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 7 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

…k crawl depth as unset (#9857) * fix(release): measure Firecrawl crawl depth from the start URL and reuse only full-access delegation keys * fix(release): leave Firecrawl crawl depth to #9864 * fix(firecrawl): treat a blank crawl maxDepth as unset * test(release): prove delegation refuses read-only keys and type a blank crawl depth

waleedlatif1 · 2026-11-11T00:37:34Z

Correction: the follow-up commit that dropped the bare secretKey pattern (the Infisical thread above) failed to push and was not in this squash-merge, so staging still redacts secretKey. The fix is restored in a new PR against staging.

cubic-dev-ai Bot reviewed Nov 10, 2026

View reviewed changes

Comment thread apps/sim/tools/firecrawl/crawl.ts Resolved

Comment thread .github/CONTRIBUTING.md Resolved

Comment thread .github/CI.md Resolved

vercel Bot deployed to Preview November 10, 2026 23:38

View deployment

waleedlatif1 added a commit that referenced this pull request Nov 10, 2026

fix(release): leave Firecrawl crawl depth to #9864

f5b5d0a

cubic-dev-ai Bot reviewed Nov 10, 2026

View reviewed changes

fix(release): redact secret-key fields, check operation-backed tools …

104face

…in the saved-credential contract, and drop SDK copy

waleedlatif1 force-pushed the fix/release-audit-cleanups branch from 729b37f to 104face Compare November 10, 2026 23:47

waleedlatif1 changed the title ~~fix(release): Firecrawl start-relative depth, secret-key redaction, operation-backed credential contract, and audit cleanups~~ fix(release): redact secret-key fields, check operation-backed tools in the saved-credential contract, and drop SDK copy Nov 10, 2026

cubic-dev-ai Bot reviewed Nov 10, 2026

View reviewed changes

waleedlatif1 mentioned this pull request Nov 10, 2026

fix(security): harden saved-credential, proxy egress, and keyless-mint paths from the release audit #9865

Merged

8 tasks done

greptile-apps Bot reviewed Nov 10, 2026

View reviewed changes

Comment thread apps/sim/lib/core/security/redaction.ts Resolved

vercel Bot deployed to Preview November 10, 2026 23:51

View deployment

cubic-dev-ai Bot reviewed Nov 10, 2026

View reviewed changes

waleedlatif1 changed the title ~~fix(release): redact secret-key fields, check operation-backed tools in the saved-credential contract, and drop SDK copy~~ fix(release): redact deploy keys, check operation-backed tools in the saved-credential contract, and drop SDK copy Nov 10, 2026

waleedlatif1 merged commit 15cf51d into staging Nov 11, 2026
86 checks passed

waleedlatif1 deleted the fix/release-audit-cleanups branch November 11, 2026 00:28

waleedlatif1 mentioned this pull request Nov 11, 2026

fix(redaction): keep Infisical secret names visible, and correct the NO_PROXY docs #9867

Closed

6 tasks done

waleedlatif1 mentioned this pull request Nov 11, 2026

fix(release): host_not_allowed for refused hosts, internal-JWT-only secret release, and final release-audit cleanups #9870

Merged

8 tasks done

waleedlatif1 mentioned this pull request Nov 11, 2026

v0.9.53: saved credentials with keyless AWS and Databricks OIDC, read-only API keys, workspace members endpoint, trigger health and pinned versions, proxy support, search source permissions #9871

Merged

Conversation

waleedlatif1 commented Nov 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Type of Change

Testing

Checklist

Uh oh!

vercel Bot commented Nov 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

greptile-apps Bot commented Nov 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Summary

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Nov 10, 2026

Uh oh!

waleedlatif1 commented Nov 10, 2026

Uh oh!

cubic-dev-ai Bot commented Nov 10, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

waleedlatif1 commented Nov 10, 2026

Uh oh!

waleedlatif1 commented Nov 10, 2026

Uh oh!

cubic-dev-ai Bot commented Nov 10, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

waleedlatif1 commented Nov 10, 2026

Uh oh!

waleedlatif1 commented Nov 10, 2026

Uh oh!

cubic-dev-ai Bot commented Nov 10, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

waleedlatif1 commented Nov 11, 2026

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

waleedlatif1 commented Nov 10, 2026 •

edited

Loading

vercel Bot commented Nov 10, 2026 •

edited

Loading

greptile-apps Bot commented Nov 10, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading