fix(release): small release-audit cleanups (#9863)

* fix(release): small release-audit cleanups

- Read a paused run's pause points once per status read instead of
  querying paused_executions twice.
- Log a polling webhook's auto-disable only when this failure disables
  it, in the same race-free statement.
- /api/v2/meta reports the scopes a credential can actually reach,
  using the same check enforcement uses. Enforcement is unchanged.
- MACHINE_ACCESS.md names MCP TypeScript SDK 2.4.0.

* test(webhooks): overlapping poll failures count every failure and disable once

* test(mcp): expect the search:read scope a full-access key reaches in v2 meta

Author: waleedlatif1

apps/docs/MACHINE_ACCESS.md

@@ -33,7 +33,7 @@ Continue until `nextCursor` is `null`. Unknown cursors and invalid parameters re
 
 Configure a remote Streamable HTTP server at `https://docs.sim.ai/api/mcp`. This endpoint is separate from Sim's workspace MCP server and `/mcp/...` documentation pages. It requires no API key.
 
-The official stable MCP TypeScript SDK 2.3.1 serves the 2026-07-28 protocol and stateless compatibility for 2025-era clients. Tools:
+The official stable MCP TypeScript SDK 2.4.0 serves the 2026-07-28 protocol and stateless compatibility for 2025-era clients. Tools:
 
 | Tool | Input | Result |
 | --- | --- | --- |

apps/docs/openapi-v2-resources.json

@@ -18651,7 +18651,7 @@
               "type": "string",
               "enum": ["api:read", "api:write", "search:read"]
             },
-            "description": "API scopes the calling credential holds. A read-only API key holds only api:read: it is refused every operation that changes state and every operation that declares no API scope, so api:read alone does not authorize those. A full-access key holds api:read and api:write; an OAuth access token holds what it was granted."
+            "description": "API scopes the calling credential can use. api:write implies api:read, and either implies search:read. A read-only API key holds api:read and search:read: it is refused every operation that changes state and every operation that declares no API scope, so api:read alone does not authorize those. A full-access key holds all three; an OAuth access token holds what it was granted and what that implies."
           }
         },
         "required": ["v2Enabled", "keyType", "expiresAt", "scopes"],

apps/sim/lib/api-key/__integration__/read-only-access.integration.ts

@@ -275,7 +275,7 @@ describe('read-only and expiring API keys in PostgreSQL', () => {
     for (const key of [readPersonalKey, readWorkspaceKey]) {
       const meta = await call(v2Meta, '/api/v2/meta', { key })
       expect(meta.status).toBe(200)
-      expect(meta.body).toMatchObject({ data: { scopes: ['api:read'] } })
+      expect(meta.body).toMatchObject({ data: { scopes: ['api:read', 'search:read'] } })
     }
     const personalMeta = await call(v2Meta, '/api/v2/meta', { key: readPersonalKey })
     expect(personalMeta.body).toMatchObject({ data: { expiresAt } })
@@ -417,7 +417,7 @@ describe('read-only and expiring API keys in PostgreSQL', () => {
   it('treats a key created before access levels as full access', async () => {
     const meta = await call(v2Meta, '/api/v2/meta', { key: legacyKey })
     expect(meta.body).toMatchObject({
-      data: { scopes: ['api:read', 'api:write'], expiresAt: null },
+      data: { scopes: ['api:read', 'api:write', 'search:read'], expiresAt: null },
     })
 
     const tablesBefore = await tableCount()

apps/sim/lib/api/contracts/v2/meta.ts

@@ -25,7 +25,7 @@ export const v2MetaSchema = z
     scopes: z
       .array(z.enum(['api:read', 'api:write', 'search:read']))
       .describe(
-        'API scopes the calling credential holds. A read-only API key holds only api:read: it is refused every operation that changes state and every operation that declares no API scope, so api:read alone does not authorize those. A full-access key holds api:read and api:write; an OAuth access token holds what it was granted.'
+        'API scopes the calling credential can use. api:write implies api:read, and either implies search:read. A read-only API key holds api:read and search:read: it is refused every operation that changes state and every operation that declares no API scope, so api:read alone does not authorize those. A full-access key holds all three; an OAuth access token holds what it was granted and what that implies.'
       ),
   })
   .meta({

apps/sim/lib/api/mcp/route-handler.test.ts

@@ -102,7 +102,7 @@ describe('Sim MCP tools', () => {
         v2Enabled: true,
         keyType: 'personal',
         expiresAt: null,
-        scopes: ['api:read', 'api:write'],
+        scopes: ['api:read', 'api:write', 'search:read'],
       },
     })
     expect(v2RouteMocks.authenticate).toHaveBeenCalledTimes(2)

apps/sim/lib/core/application/oauth-authorization.test.ts

@@ -2,6 +2,7 @@ import type { OAuthAccessTokenPrincipal, PersonalApiKeyPrincipal } from '@sim/au
 import { describe, expect, it, vi } from 'vitest'
 import { defineAuthorizedWorkspaceUseCase } from '@/lib/core/application/authorized-workspace-use-case'
 import {
+  credentialApiScopes,
   InsufficientScopeError,
   OAuthAccessTokenExpiredError,
   ReadOnlyApiKeyError,
@@ -104,6 +105,30 @@ describe('semantic OAuth policy', () => {
     ).not.toThrow()
   })
 
+  it.each([
+    { case: 'a write token', credential: { ...principal, scopes: ['api:write'] } },
+    { case: 'a read token', credential: principal },
+    { case: 'a search-only token', credential: { ...principal, scopes: ['search:read'] } },
+    {
+      case: 'a read-only key',
+      credential: { kind: 'personal_api_key', userId: 'user-1', keyId: 'k-1', access: 'read' },
+    },
+    {
+      case: 'a full-access key',
+      credential: { kind: 'personal_api_key', userId: 'user-1', keyId: 'k-1', access: 'write' },
+    },
+  ] as const)('reports exactly the scopes $case can reach', ({ credential }) => {
+    const reachable = (['api:read', 'api:write', 'search:read'] as const).filter((oauthScope) => {
+      try {
+        requireOAuthOperationScope(credential, { ...writeOperation, oauthScope })
+        return true
+      } catch {
+        return false
+      }
+    })
+    expect(credentialApiScopes(credential)).toEqual(reachable)
+  })
+
   it('rejects expiry before considering scope', () => {
     expect(() =>
       requireOAuthOperationScope({ ...principal, expiresAt: new Date(0) }, writeOperation)

apps/sim/lib/core/application/oauth-authorization.ts

@@ -87,13 +87,15 @@ const API_SCOPES: readonly OAuthApiScope[] = [
 ]
 
 /**
- * The API scopes a credential holds, as `/api/v2/meta` reports them. A credential
- * no grant bounds, such as a write key, holds both `api:read` and `api:write`.
+ * The API scopes a credential can reach, as `/api/v2/meta` reports them: each scope
+ * {@link requireOAuthOperationScope} would let it through, so `api:write` reports the
+ * `api:read` it implies and either reports `search:read`. A credential no grant bounds,
+ * such as a write key, reaches every scope.
  */
 export function credentialApiScopes(principal: Principal): OAuthApiScope[] {
   const granted = grantedApiScopes(principal)
-  if (!granted) return [OAUTH_API_READ_SCOPE, OAUTH_API_WRITE_SCOPE]
-  return API_SCOPES.filter((scope) => granted.includes(scope))
+  if (!granted) return [...API_SCOPES]
+  return API_SCOPES.filter((scope) => oauthScopeSatisfies(granted, scope))
 }
 
 function grantedApiScopes(principal: Principal): readonly string[] | undefined {

apps/sim/lib/webhooks/polling/utils.ts

@@ -149,11 +149,19 @@ export async function recordPollSourceFailure(
  * Increment the webhook's failure count, auto-disabling it once the count
  * reaches MAX_CONSECUTIVE_FAILURES. One statement, so an enable that resets the
  * count concurrently is never followed by a disable decided on the old count.
+ * The locked `prior` read reports whether this update is the one that disabled
+ * the webhook, so a failure on an already-disabled webhook logs nothing.
  */
 export async function markWebhookFailed(webhookId: string, logger: Logger): Promise<void> {
   try {
     const now = new Date()
     const reachesLimit = sql`COALESCE(${webhook.failedCount}, 0) + 1 >= ${MAX_CONSECUTIVE_FAILURES}`
+    const prior = db
+      .select({ wasActive: webhook.isActive })
+      .from(webhook)
+      .where(eq(webhook.id, webhookId))
+      .for('update')
+      .as('prior')
     const [result] = await db
       .update(webhook)
       .set({
@@ -162,10 +170,11 @@ export async function markWebhookFailed(webhookId: string, logger: Logger): Prom
         isActive: sql`CASE WHEN ${reachesLimit} THEN false ELSE ${webhook.isActive} END`,
         updatedAt: now,
       })
+      .from(prior)
       .where(eq(webhook.id, webhookId))
-      .returning({ failedCount: webhook.failedCount })
+      .returning({ isActive: webhook.isActive, wasActive: prior.wasActive })
 
-    if ((result?.failedCount ?? 0) >= MAX_CONSECUTIVE_FAILURES) {
+    if (result?.wasActive && !result.isActive) {
       logger.warn(
         `Webhook ${webhookId} auto-disabled after ${MAX_CONSECUTIVE_FAILURES} consecutive failures`
       )

apps/sim/lib/workflows/application/read-workflow-run.ts

@@ -85,7 +85,7 @@ export const readWorkflowRun = defineAuthorizedWorkflowUseCase({
         viewerUserId: logProjectionSubjectUserId(principal),
       })
       if (!projected) throw new OrchestrationError('not_found', 'Run not found')
-      const { status, projection, stateExecutionId } = projected
+      const { status, projection, stateExecutionId, pausePoints: loadedPausePoints } = projected
 
       /**
        * A run whose `blockOutputs` the viewer's group withholds joins the same
@@ -171,6 +171,7 @@ export const readWorkflowRun = defineAuthorizedWorkflowUseCase({
             (await readPausedRunPoints({
               workflowId: context.workflowId,
               executionId: stateExecutionId,
+              pausePoints: loadedPausePoints ?? undefined,
             })) ?? []
           ).map((point) => ({
             ...point,

apps/sim/lib/workflows/application/triggers.integration.ts

@@ -742,16 +742,36 @@ check('enabling a poller clears its failures and backoff but keeps its config',
 
 check('a poll failure auto-disables at the threshold in the same write', async () => {
   const logger = createLogger('TriggerHealthIntegration')
+  const warn = vi.spyOn(logger, 'warn')
   await markWebhookFailed(flakyWebhookId, logger)
   expect(await webhookRow(flakyWebhookId)).toMatchObject({ isActive: true, failedCount: 99 })
   await markWebhookFailed(flakyWebhookId, logger)
   expect(await webhookRow(flakyWebhookId)).toMatchObject({ isActive: false, failedCount: 100 })
+  expect(warn).toHaveBeenCalledTimes(1)
+
+  await markWebhookFailed(flakyWebhookId, logger)
+  expect(await webhookRow(flakyWebhookId)).toMatchObject({ isActive: false, failedCount: 101 })
+  expect(warn).toHaveBeenCalledTimes(1)
 
   await setBlock('flaky', true)
   await markWebhookFailed(flakyWebhookId, logger)
   expect(await webhookRow(flakyWebhookId)).toMatchObject({ isActive: true, failedCount: 1 })
 })
 
+check('overlapping failures at the threshold count every failure and disable once', async () => {
+  const logger = createLogger('TriggerHealthConcurrency')
+  const warn = vi.spyOn(logger, 'warn')
+  await db
+    .update(webhook)
+    .set({ isActive: true, failedCount: 97 })
+    .where(eq(webhook.id, flakyWebhookId))
+
+  await Promise.all(Array.from({ length: 6 }, () => markWebhookFailed(flakyWebhookId, logger)))
+
+  expect(await webhookRow(flakyWebhookId)).toMatchObject({ isActive: false, failedCount: 103 })
+  expect(warn).toHaveBeenCalledTimes(1)
+})
+
 check('an unknown block is not found', async () => {
   await expect(setBlock('missing', true)).rejects.toMatchObject({
     code: 'not_found',