fix(release): keep Firecrawl news/image results, refuse unreachable crawl depth, run pinned async versions on their own variables

Author: waleedlatif1

.github/CONTRIBUTING.md

@@ -140,20 +140,15 @@ Using clear and consistent commit messages makes it easier for everyone to under
 
 To set up your local development environment:
 
-### Option 1: Using NPM Package (Simplest)
+### Option 1: Using the Setup Wizard (Simplest)
 
-The easiest way to run Sim locally is using our NPM package:
+The easiest way to run Sim locally is the `sim-setup` wizard, which creates a deployment directory, generates secrets, and starts the published images with Docker Compose:
 
 ```bash
-npx simstudio
+npx sim-setup
 ```
 
-After running this command, open [http://localhost:3000/](http://localhost:3000/) in your browser.
-
-#### Options
-
-- `-p, --port <port>`: Specify the port to run Sim on (default: 3000)
-- `--no-pull`: Skip pulling the latest Docker images
+Inside a cloned Sim repository, run `bun run sim-setup` instead to unlock the source-only local development mode.
 
 #### Requirements
 

apps/sim/app/api/cli/auth/poll/route.ts

@@ -3,6 +3,7 @@ import { type NextRequest, NextResponse } from 'next/server'
 import { pollCliAuthContract } from '@/lib/api/contracts'
 import { parseRequest } from '@/lib/api/server'
 import {
+  apiKeyCreationErrorStatus,
   performCreatePersonalApiKey,
   performCreateWorkspaceApiKey,
 } from '@/lib/api-key/orchestration'
@@ -83,7 +84,7 @@ async function mintForGrant(
   if (!result.success || !result.key) {
     return {
       ok: false,
-      status: result.errorCode === 'conflict' ? 409 : 500,
+      status: apiKeyCreationErrorStatus(result.errorCode),
       message: result.error ?? 'Failed to generate API key',
     }
   }

apps/sim/app/api/resume/[workflowId]/[executionId]/[contextId]/route.ts

@@ -160,7 +160,7 @@ export const GET = withRouteHandler(
     }
   ) => {
     const { workflowId: requestedWorkflowId } = await context.params
-    const access = await validateWorkflowAccess(request, requestedWorkflowId, false)
+    const access = await validateWorkflowAccess(request, requestedWorkflowId)
     if (access.error) {
       return NextResponse.json({ error: access.error.message }, { status: access.error.status })
     }

apps/sim/app/api/workflows/[id]/executions/[executionId]/route.ts

@@ -23,7 +23,7 @@ export const GET = withRouteHandler(
     const { id: workflowId, executionId } = parsed.data.params
     const { includeOutput, selectedOutputs } = parsed.data.query
 
-    const access = await validateWorkflowAccess(request, workflowId, false)
+    const access = await validateWorkflowAccess(request, workflowId)
     if (access.error) {
       return NextResponse.json({ error: access.error.message }, { status: access.error.status })
     }

apps/sim/app/api/workflows/[id]/paused/route.ts

@@ -14,7 +14,7 @@ export const GET = withRouteHandler(
     if (!parsed.success) return parsed.response
     const { id: workflowId } = parsed.data.params
 
-    const access = await validateWorkflowAccess(request, workflowId, false)
+    const access = await validateWorkflowAccess(request, workflowId)
     if (access.error) {
       return NextResponse.json({ error: access.error.message }, { status: access.error.status })
     }

apps/sim/app/api/workflows/middleware.test.ts

@@ -1,6 +1,6 @@
 /**
  * Tests for workflow access middleware — focused on the workspace-scoped
- * API key boundary check in the `requireDeployment=false` branch.
+ * API key boundary check.
  */
 
 import {
@@ -13,10 +13,6 @@ import { NextRequest } from 'next/server'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 vi.mock('@/lib/workflows/utils', () => workflowsUtilsMock)
-vi.mock('@/lib/api-key/service', () => ({
-  authenticateApiKeyFromHeader: vi.fn(),
-  updateApiKeyLastUsed: vi.fn(),
-}))
 
 import { WORKSPACE_KEY_SCOPE_DENIED } from '@/lib/api-key/policy-messages'
 import { validateWorkflowAccess } from '@/app/api/workflows/middleware'
@@ -25,7 +21,7 @@ function makeRequest() {
   return new NextRequest(new URL('https://example.com/api/workflows/wf-1'))
 }
 
-describe('validateWorkflowAccess (requireDeployment=false)', () => {
+describe('validateWorkflowAccess', () => {
   beforeEach(() => {
     workflowsUtilsMockFns.mockGetWorkflowById.mockResolvedValue({
       id: 'wf-1',
@@ -48,7 +44,7 @@ describe('validateWorkflowAccess (requireDeployment=false)', () => {
       workspaceId: 'ws-B',
     })
 
-    const result = await validateWorkflowAccess(makeRequest(), 'wf-1', false)
+    const result = await validateWorkflowAccess(makeRequest(), 'wf-1')
 
     expect(result.error).toEqual({
       message: WORKSPACE_KEY_SCOPE_DENIED,
@@ -70,7 +66,7 @@ describe('validateWorkflowAccess (requireDeployment=false)', () => {
       message: 'Access denied',
     })
 
-    const result = await validateWorkflowAccess(makeRequest(), 'wf-1', false)
+    const result = await validateWorkflowAccess(makeRequest(), 'wf-1')
 
     expect(result.error).toEqual({ message: 'Access denied', status: 403 })
   })

apps/sim/app/api/workflows/middleware.ts

@@ -2,11 +2,6 @@ import { createLogger } from '@sim/logger'
 import { authorizeWorkflowByWorkspacePermission } from '@sim/platform-authz/workflow'
 import type { NextRequest } from 'next/server'
 import { WORKSPACE_KEY_SCOPE_DENIED } from '@/lib/api-key/policy-messages'
-import {
-  type ApiKeyAuthResult,
-  authenticateApiKeyFromHeader,
-  updateApiKeyLastUsed,
-} from '@/lib/api-key/service'
 import { type AuthResult, checkHybridAuth } from '@/lib/auth/hybrid'
 import { getWorkflowById } from '@/lib/workflows/utils'
 
@@ -20,8 +15,7 @@ export interface ValidationResult {
 
 export async function validateWorkflowAccess(
   request: NextRequest,
-  workflowId: string,
-  requireDeployment = true
+  workflowId: string
 ): Promise<ValidationResult> {
   try {
     const workflow = await getWorkflowById(workflowId)
@@ -44,95 +38,40 @@ export async function validateWorkflowAccess(
       }
     }
 
-    if (!requireDeployment) {
-      const auth = await checkHybridAuth(request, { requireWorkflowId: false })
-      if (!auth.success || !auth.userId) {
-        return {
-          error: {
-            message: auth.error || 'Unauthorized',
-            status: 401,
-          },
-        }
-      }
-
-      if (auth.apiKeyType === 'workspace' && auth.workspaceId !== workflow.workspaceId) {
-        return {
-          error: {
-            message: WORKSPACE_KEY_SCOPE_DENIED,
-            status: 403,
-          },
-        }
-      }
-
-      const authorization = await authorizeWorkflowByWorkspacePermission({
-        workflowId,
-        userId: auth.userId,
-        action: 'read',
-      })
-      if (!authorization.allowed) {
-        return {
-          error: {
-            message: authorization.message || 'Access denied',
-            status: authorization.status,
-          },
-        }
+    const auth = await checkHybridAuth(request, { requireWorkflowId: false })
+    if (!auth.success || !auth.userId) {
+      return {
+        error: {
+          message: auth.error || 'Unauthorized',
+          status: 401,
+        },
       }
-
-      return { workflow, auth }
     }
 
-    if (requireDeployment) {
-      if (!workflow.isDeployed) {
-        return {
-          error: {
-            message: 'Workflow is not deployed',
-            status: 403,
-          },
-        }
-      }
-
-      let apiKeyHeader = null
-      for (const [key, value] of request.headers.entries()) {
-        if (key.toLowerCase() === 'x-api-key' && value) {
-          apiKeyHeader = value
-          break
-        }
-      }
-
-      if (!apiKeyHeader) {
-        return {
-          error: {
-            message: 'Unauthorized: API key required',
-            status: 401,
-          },
-        }
-      }
-
-      let validResult: ApiKeyAuthResult | null = null
-
-      const workspaceResult = await authenticateApiKeyFromHeader(apiKeyHeader, {
-        workspaceId: workflow.workspaceId as string,
-        keyTypes: ['workspace', 'personal'],
-      })
-
-      if (workspaceResult.success) {
-        validResult = workspaceResult
-      }
-
-      if (!validResult) {
-        return {
-          error: {
-            message: 'Unauthorized: Invalid API key',
-            status: 401,
-          },
-        }
+    if (auth.apiKeyType === 'workspace' && auth.workspaceId !== workflow.workspaceId) {
+      return {
+        error: {
+          message: WORKSPACE_KEY_SCOPE_DENIED,
+          status: 403,
+        },
       }
+    }
 
-      if (validResult.keyId) {
-        updateApiKeyLastUsed(validResult.keyId)
+    const authorization = await authorizeWorkflowByWorkspacePermission({
+      workflowId,
+      userId: auth.userId,
+      action: 'read',
+    })
+    if (!authorization.allowed) {
+      return {
+        error: {
+          message: authorization.message || 'Access denied',
+          status: authorization.status,
+        },
       }
     }
-    return { workflow }
+
+    return { workflow, auth }
   } catch (error) {
     logger.error('Validation error:', { error })
     return {

apps/sim/background/workflow-execution.ts

@@ -286,7 +286,8 @@ export async function executeWorkflowJob(
         /**
          * The version this run executes, loaded once: the core runs this same version's
          * blocks, so a deploy landing mid-setup cannot pair one version's variables with
-         * another's graph.
+         * another's graph. A pinned version runs with only its own snapshot, as a sync run
+         * of it does, never the editor's current variables.
          */
         const pinnedDeploymentVersionId = payload.pinnedDeploymentVersionId
         const deployedState = await withDatabaseReadRetry(
@@ -328,7 +329,9 @@ export async function executeWorkflowJob(
           metadata,
           workflow,
           payload.input,
-          resolveDeployedRunVariables(deployedState, workflow.variables),
+          pinnedDeploymentVersionId
+            ? (deployedState.variables ?? {})
+            : resolveDeployedRunVariables(deployedState, workflow.variables),
           []
         )
 

apps/sim/lib/integrations/credential-display.ts

@@ -22,6 +22,7 @@ import { CANONICAL_SERVICE_ACCOUNT_SLUGS } from '@/lib/integrations/oauth-servic
 import { OAUTH_PROVIDERS } from '@/lib/oauth/oauth'
 import type { OAuthProvider, OAuthServiceConfig } from '@/lib/oauth/types'
 import { getServiceConfigByProviderId, parseProvider } from '@/lib/oauth/utils'
+import { resolveAccessControlBlockType } from '@/lib/permission-groups/integration-allowlist'
 
 /**
  * Above this many covered integrations the subtitle states a count instead of
@@ -226,7 +227,7 @@ export function resolveCredentialDisplay(credential: DisplayableCredential): Cre
     return {
       service: null,
       integration,
-      blockType: 'gitlab',
+      blockType: resolveAccessControlBlockType('gitlab'),
       icon: GitlabIcon,
       familyName: null,
       coveredIntegrations: integration ? [integration] : [],

apps/sim/lib/workspaces/api/route-policies.ts

@@ -9,17 +9,17 @@ import { WorkspaceBusyError } from '@/lib/workspaces/permissions/management-stor
 import { WorkspaceBillingAccountRemovalError } from '@/lib/workspaces/utils'
 import { v2CaughtOrchestrationError, v2Error } from '@/app/api/v2/lib/response'
 
+function isWorkspaceBusyError(error: unknown): error is WorkspaceBusyError {
+  return error instanceof WorkspaceBusyError
+}
+
 /**
  * A caller naming a workspace it cannot reach must not be able to tell that
  * refusal apart from a workspace that does not exist. Both answer
  * `404 "Workspace not found"` — the message the unknown-workspace path in
  * `get-public-workspace` and `list-public-workspace-members` already uses, so
  * the two responses are byte-identical.
  */
-function isWorkspaceBusyError(error: unknown): error is WorkspaceBusyError {
-  return error instanceof WorkspaceBusyError
-}
-
 export const v2WorkspaceErrorPolicies = {
   concealWorkspaceAuthorization: createV2ResourceConcealmentPolicy({
     notFoundMessage: 'Workspace not found',