Merge remote-tracking branch 'origin/staging' into improvement/org-view

# Conflicts:
#	apps/sim/app/o/[organizationId]/integrations/account-actions-menu.tsx
#	apps/sim/app/o/[organizationId]/integrations/assistant-account-integrations.tsx
#	apps/sim/ee/credential-groups/components/organization-person-connections.tsx
#	apps/sim/lib/assistant-actions/application/review.ts
#	apps/sim/platform/app/(shell)/integrations/_components/connected-credential/connected-credential.tsx
#	apps/sim/scripts/test-org-redesign-e2e.ts

Author: waleedlatif1

apps/docs/content/docs/search/connect-your-account.mdx

@@ -10,19 +10,25 @@ After your admin adds a source in **Settings → Sources**, connect your own acc
 ## Connect and verify
 
 1. Join the Sim organization through its invitation or SSO. Use the verified email required by the provider connection.
-2. Open **Integrations**, select the app, and choose **Connect** in its header.
-3. Complete authorization in the new tab. If the popup is blocked, allow it and select **Connect** again.
+2. Open **Integrations**, select the app, and choose the app's button under **Connect your account**.
+3. Complete authorization in the new tab. If the popup is blocked, allow it and select the button again.
 4. Return to **Search** or **Search → Assistant** and search for content your account can open. Read a result and follow its source link.
 
 <Image
   src="/static/search/connect-account-details.png"
-  alt="Coda integration details with Connect in the resource header and no account connected"
+  alt="Coda integration details with a connect button and no account connected"
   width={1440}
   height={1000}
   variant="overview"
 />
 
-Your organization currently supports one connected account per provider. Open the app to see that account's permissions and connection actions.
+To connect another account of the same app, such as Google Drive for two different work accounts, open the app and choose **Add account**, then pick the other account when the provider asks. You can connect up to five accounts per app, and Search looks across all of them. Open an account to see its tool permissions when the app supports them; each account's menu has **Reconnect** and **Disconnect**.
+
+- Slack accounts must belong to your organization's connected workspace.
+- Zoom, Lucid, and Databricks allow one account, because Sim cannot yet tell their accounts apart.
+- If the provider signs you straight back into a connected account, sign in to the other account with the provider first, then choose **Add account** again.
+
+Reconnecting keeps the same account. To use a different one, add it as a new account or disconnect the old one first. If Sim asks you to reconnect before adding another account, it could not confirm which account an existing connection belongs to. Reconnect that one, then add the other. Your organization and the provider must allow each account to authorize Sim.
 
 The connection is usable when authorization completes; no initial indexing run is required. If a provider is missing, ask an admin to add it in **Sources**. `Not configured` means its app or deployment setup needs an admin's attention.
 
@@ -33,7 +39,7 @@ You do not choose repositories, channels, labels, or an indexing method during p
 | Source setup | Personal connection |
 | --- | --- |
 | **Member accounts** | Connect your own provider account. |
-| **GitHub App** | Connect GitHub once per Sim organization. Each selected repository must be readable by you and the installation. |
+| **GitHub App** | Connect one or more GitHub accounts. Each selected repository must be readable by you and the installation. |
 | Google service account: Gmail, Calendar, Drive | Connect each corresponding Google service. The source verifies your identity and resource access through delegation. |
 | Confluence service account | Connect Confluence. Both your account and the service connection must read the selected content. |
 | Coda | Connect personal Coda MCP. Service mode also verifies the parent document with its REST token. |
@@ -46,7 +52,7 @@ Creating Jira sprints requires the Jira sprint permission. If your account was c
 
 ## Tool permissions
 
-Open the app in **Integrations** and select your account. Tool permissions appear in its details when the app has supported Assistant tools available to you. Hover over or focus the info button beside a tool to read its description. Set a preference for each operation or use the **Read-only tools** and **Write tools** group controls:
+Open the app in **Integrations**. If you connected several accounts, select one. Tool permissions appear in its details when the app has supported Assistant tools available to you. Hover over or focus the info button beside a tool to read its description. Set a preference for each operation or use the **Read-only tools** and **Write tools** group controls:
 
 | Preference | Behavior |
 | --- | --- |

apps/sim/app/api/billing/update-cost/route.ts

@@ -196,7 +196,7 @@ async function updateCostInner(req: NextRequest, span: Span): Promise<NextRespon
   const startTime = Date.now()
 
   try {
-    logger.info(`[${requestId}] Update cost request started`)
+    logger.debug(`[${requestId}] Update cost request started`)
 
     // Check authentication (internal API key)
     const authResult = checkInternalApiKey(req)
@@ -324,7 +324,7 @@ async function updateCostInner(req: NextRequest, span: Span): Promise<NextRespon
       ...(idempotencyKey ? { [TraceAttr.BillingIdempotencyKey]: idempotencyKey } : {}),
     })
 
-    logger.info(`[${requestId}] Processing cost update`, {
+    logger.debug(`[${requestId}] Processing cost update`, {
       userId,
       cost,
       model,
@@ -408,7 +408,7 @@ async function updateCostInner(req: NextRequest, span: Span): Promise<NextRespon
           }
         : undefined
 
-    logger.info(`[${requestId}] Billing payer resolved`, {
+    logger.debug(`[${requestId}] Billing payer resolved`, {
       userId,
       billingProtocol: protocol,
       billingResolution: getBillingResolution(isMarkerlessLegacy, billingAttribution),
@@ -443,7 +443,10 @@ async function updateCostInner(req: NextRequest, span: Span): Promise<NextRespon
     const billed = result.billed
     logger.info(`[${requestId}] Cumulative cost top-up`, {
       userId,
+      billingPayer: billingContext?.billingEntity ?? { type: 'user', id: userId },
+      workspaceId: resolvedWorkspaceId,
       source,
+      model,
       cumulativeCost: cost,
       billedDelta: result.delta,
       newTotal: result.total,

apps/sim/app/api/credential-groups/oauth-callback.ts

@@ -139,6 +139,7 @@ export async function handleCredentialGroupOAuthCallback({
           : error instanceof CredentialGroupOAuthError && error.statusCode === 409
             ? 'configuration_changed'
             : 'failed'
+    if (error instanceof CredentialGroupOAuthError && error.failure) status = error.failure
     if (identityFailure) {
       switch (identityFailure.reason) {
         case 'email_unverified':

apps/sim/app/api/mcp/oauth/callback/route.ts

@@ -18,6 +18,7 @@ import {
 } from '@/lib/credential-groups/mcp-oauth-state'
 import { CredentialGroupOAuthStateVersionError } from '@/lib/credential-groups/oauth-attempt-version'
 import type { CredentialGroupOAuthFailure } from '@/lib/credential-groups/oauth-completion'
+import { CredentialGroupOAuthError } from '@/lib/credential-groups/provider-adapter'
 import { enforcePublicCredentialGroupIpRateLimit } from '@/lib/credential-groups/rate-limit'
 import {
   assertSafeOauthServerUrl,
@@ -162,7 +163,9 @@ async function completeManagedMcpCallback(params: {
     })
   } catch (error) {
     logger.error('Managed MCP OAuth callback failed', error)
-    return failureRedirect('failed')
+    return failureRedirect(
+      error instanceof CredentialGroupOAuthError && error.failure ? error.failure : 'failed'
+    )
   }
 }
 

apps/sim/app/credential-groups/enroll/[token]/page.tsx

@@ -227,7 +227,7 @@ export default async function CredentialGroupEnrollmentPage({
     )
   const visibleOptions = focusedOption ? [focusedOption] : activeOptions
   const focusedConnected =
-    focusedOption?.connections[0]?.status === 'connected' &&
+    focusedOption?.connections.some((connection) => connection.status === 'connected') &&
     (returnToSearch || connectedOptionId === focusedOption.id)
   const connectedOption = connectedOptionId
     ? activeOptions.find((option) => option.id === connectedOptionId)
@@ -286,29 +286,34 @@ export default async function CredentialGroupEnrollmentPage({
           <div className='au:space-y-2'>
             {visibleOptions.map((option) => {
               const ProviderIcon = getCredentialGroupProviderService(option.provider).icon
-              const connection = option.connections[0]
+              const visibleConnections = option.connections.filter(
+                (connection) => connection.status !== 'revoked'
+              )
               return (
                 <SettingsResourceRow
                   key={option.id}
                   icon={<ProviderIcon />}
                   title={option.label}
                   description={
-                    option.connections.length > 0
-                      ? option.connections.map((account) => (
-                          <span key={account.email} className='au:block'>
+                    visibleConnections.length > 0
+                      ? visibleConnections.map((account) => (
+                          <span key={`${account.email}-${account.grantedAt}`} className='au:block'>
                             {account.email}
                             {account.status === 'connected'
                               ? ' — Connected'
-                              : ' — Reconnect required'}
+                              : ' — Reconnect needed'}
                           </span>
                         ))
                       : 'Not connected'
                   }
                   actions={
-                    focusedConnected ? undefined : (
+                    focusedConnected &&
+                    visibleConnections.every(
+                      (account) => account.status === 'connected'
+                    ) ? undefined : (
                       <OAuthConnectLink
                         href={`/api/credential-groups/enroll/${encodeURIComponent(token)}/oauth/${encodeURIComponent(option.id)}${focused ? `?returnTo=${returnToSearch ? 'search' : 'accounts'}` : ''}`}
-                        reconnect={Boolean(connection)}
+                        reconnect={visibleConnections.length > 0}
                         variant={focused ? 'primary' : undefined}
                       />
                     )
@@ -328,7 +333,7 @@ export default async function CredentialGroupEnrollmentPage({
                       server.connection?.status === 'connected'
                         ? 'Connected'
                         : server.connection
-                          ? 'Reconnect required'
+                          ? 'Reconnect needed'
                           : server.description || 'Not connected'
                     }
                     actions={

apps/sim/app/ingest/[[...path]]/route.test.ts

@@ -31,7 +31,7 @@ describe('PostHog ingest proxy', () => {
     const response = await POST(createIngestRequest(controller.signal))
 
     expect(response.status).toBe(499)
-    expect(logger.error).not.toHaveBeenCalled()
+    expect(logger.warn).not.toHaveBeenCalled()
   })
 
   it('reports an upstream failure while the client is still connected', async () => {
@@ -40,7 +40,7 @@ describe('PostHog ingest proxy', () => {
     const response = await POST(createIngestRequest())
 
     expect(response.status).toBe(502)
-    expect(logger.error).toHaveBeenCalledWith(
+    expect(logger.warn).toHaveBeenCalledWith(
       'PostHog proxy error',
       expect.objectContaining({ error: 'The operation timed out.' })
     )

apps/sim/app/ingest/[[...path]]/route.ts

@@ -61,7 +61,7 @@ async function handler(request: NextRequest) {
       logger.info('Client closed PostHog proxy request', { method: request.method })
       return new NextResponse(null, { status: 499 })
     }
-    logger.error('PostHog proxy error', {
+    logger.warn('PostHog proxy error', {
       url,
       method: request.method,
       error: toError(error).message,

apps/sim/background/webhook-execution.ts

@@ -1100,7 +1100,7 @@ async function executeWebhookJobInternal(
         }
       }
 
-      logger.info(`[${requestId}] Executing workflow for ${payload.provider} webhook`)
+      logger.debug(`[${requestId}] Executing workflow for ${payload.provider} webhook`)
 
       const metadata: ExecutionMetadata = {
         requestId,

apps/sim/blocks/blocks/credential.ts

@@ -28,7 +28,7 @@ export const CredentialBlock: BlockConfig = {
   - Use the Provider filter to narrow results to specific services (e.g. Gmail, Slack).
   - Use "List Organization Accounts" with Providers selected and Email blank to discover all accessible accounts for those integrations.
   - Organization lists return one page at a time. While hasMore is true, pass nextCursor as Cursor with the same filters to get every matching account.
-  - "Find Organization Account" requires an exact enrollment email and provider, and fails unless exactly one active account matches.
+  - "Find Organization Account" requires an exact enrollment email and provider, and returns that person's first connected account for the provider, or fails if there is none. Use "List Organization Accounts" to reach their other accounts.
   - Outputs contain account identities and credential references, never secret values.
   - To switch credentials across environments, replace the single Credential block rather than updating every downstream block.
   `,

apps/sim/ee/credential-groups/person-connections.ts

@@ -35,7 +35,7 @@ export function personConnectionSummaries(person: CredentialGroupEnrollmentDetai
         key: `mcp:${connection.mcpServerId}`,
         providerId: undefined,
         name: connection.name,
-        count: 1,
+        count: connection.count,
         icon: undefined,
       })),
   ]