Merge remote-tracking branch 'origin/staging' into feat/search-multiple-accounts-per-provider

# Conflicts:
#	apps/sim/lib/assistant-actions/tool-permissions.integration.ts

Author: waleedlatif1

README.md

@@ -7,7 +7,7 @@
 
 <p align="center">
   <a href="https://deepwiki.com/simstudioai/sim" target="_blank" rel="noopener noreferrer"><img src="https://img.shields.io/badge/Ask-DeepWiki-E6E6E6?labelColor=C3C3C3&color=E6E6E6" alt="Ask DeepWiki"></a>
-  <a href="https://cursor.com/link/prompt?text=Help%20me%20set%20up%20Sim%20locally.%20Follow%20these%20steps%3A%0A%0A1.%20First%2C%20verify%20Docker%20is%20installed%20and%20running%3A%0A%20%20%20docker%20--version%0A%20%20%20docker%20info%0A%0A2.%20Clone%20the%20repository%3A%0A%20%20%20git%20clone%20https%3A%2F%2Fgithub.com%2Fsimstudioai%2Fsim.git%0A%20%20%20cd%20sim%0A%0A3.%20Generate%20required%20secrets%20%28the%20stack%20will%20not%20start%20without%20them%29%3A%0A%20%20%20cat%20%3E%20.env%20%3C%3C%20EOF%0A%20%20%20BETTER_AUTH_SECRET%3D%24%28openssl%20rand%20-hex%2032%29%0A%20%20%20ENCRYPTION_KEY%3D%24%28openssl%20rand%20-hex%2032%29%0A%20%20%20INTERNAL_API_SECRET%3D%24%28openssl%20rand%20-hex%2032%29%0A%20%20%20CRON_SECRET%3D%24%28openssl%20rand%20-hex%2032%29%0A%20%20%20POSTGRES_PASSWORD%3D%24%28openssl%20rand%20-hex%2024%29%0A%20%20%20EOF%0A%0A4.%20Start%20the%20services%20with%20Docker%20Compose%3A%0A%20%20%20docker%20compose%20-f%20docker-compose.prod.yml%20up%20-d%0A%0A4.%20Wait%20for%20all%20containers%20to%20be%20healthy%20(this%20may%20take%201-2%20minutes)%3A%0A%20%20%20docker%20compose%20-f%20docker-compose.prod.yml%20ps%0A%0A5.%20Verify%20the%20app%20is%20accessible%20at%20http%3A%2F%2Flocalhost%3A3000%0A%0AIf%20there%20are%20any%20errors%2C%20help%20me%20troubleshoot%20them.%20Common%20issues%3A%0A-%20Port%203000%20or%203002%20already%20in%20use%0A-%20Docker%20not%20running%0A-%20Insufficient%20memory%20(needs%2012GB%2B%20RAM)%0A%0AFor%20local%20AI%20models%20with%20Ollama%2C%20use%20this%20instead%20of%20step%203%3A%0A%20%20%20docker%20compose%20-f%20docker-compose.ollama.yml%20--profile%20setup%20up%20-d"><img src="https://img.shields.io/badge/Set%20Up%20with-Cursor-E6E6E6?logo=cursor&logoColor=1A1A1A&labelColor=C3C3C3&color=E6E6E6" alt="Set Up with Cursor"></a>
+  <a href="https://cursor.com/link/prompt?text=Help%20me%20set%20up%20Sim%20locally.%20Follow%20these%20steps%3A%0A%0A1.%20First%2C%20verify%20Docker%20is%20installed%20and%20running%3A%0A%20%20%20docker%20--version%0A%20%20%20docker%20info%0A%0A2.%20Clone%20the%20repository%3A%0A%20%20%20git%20clone%20https%3A%2F%2Fgithub.com%2Fsimstudioai%2Fsim.git%0A%20%20%20cd%20sim%0A%0A3.%20Generate%20required%20secrets%20%28the%20stack%20will%20not%20start%20without%20them%29%3A%0A%20%20%20cat%20%3E%20.env%20%3C%3C%20EOF%0A%20%20%20BETTER_AUTH_SECRET%3D%24%28openssl%20rand%20-hex%2032%29%0A%20%20%20ENCRYPTION_KEY%3D%24%28openssl%20rand%20-hex%2032%29%0A%20%20%20INTERNAL_API_SECRET%3D%24%28openssl%20rand%20-hex%2032%29%0A%20%20%20CRON_SECRET%3D%24%28openssl%20rand%20-hex%2032%29%0A%20%20%20POSTGRES_PASSWORD%3D%24%28openssl%20rand%20-hex%2024%29%0A%20%20%20EOF%0A%0A4.%20Start%20the%20services%20with%20Docker%20Compose%3A%0A%20%20%20docker%20compose%20-f%20docker-compose.prod.yml%20up%20-d%0A%0A5.%20Wait%20for%20all%20containers%20to%20be%20healthy%20%28this%20may%20take%201-2%20minutes%29%3A%0A%20%20%20docker%20compose%20-f%20docker-compose.prod.yml%20ps%0A%0A6.%20Verify%20the%20app%20is%20accessible%20at%20http%3A%2F%2Flocalhost%3A3000%0A%0AIf%20there%20are%20any%20errors%2C%20help%20me%20troubleshoot%20them.%20Common%20issues%3A%0A-%20Port%203000%20or%203002%20already%20in%20use%0A-%20Docker%20not%20running%0A-%20Insufficient%20memory%20%28needs%2012GB%2B%20RAM%29%0A%0AFor%20local%20AI%20models%20with%20Ollama%2C%20use%20one%20of%20these%20instead%20of%20step%204%3A%0A%20%20%20docker%20compose%20-f%20docker-compose.ollama.yml%20--profile%20gpu%20--profile%20setup%20up%20-d%0A%20%20%20docker%20compose%20-f%20docker-compose.ollama.yml%20--profile%20cpu%20--profile%20setup%20up%20-d%0AThen%20check%20status%20in%20step%205%20with%3A%0A%20%20%20docker%20compose%20-f%20docker-compose.ollama.yml%20ps"><img src="https://img.shields.io/badge/Set%20Up%20with-Cursor-E6E6E6?logo=cursor&logoColor=1A1A1A&labelColor=C3C3C3&color=E6E6E6" alt="Set Up with Cursor"></a>
 </p>
 
 <p align="center">

apps/desktop/src/main/app-routes.test.ts

@@ -0,0 +1,25 @@
+import { describe, expect, it, vi } from 'vitest'
+
+vi.mock('electron', () => import('@/test/electron-mock'))
+
+import { settingsRoute } from '@/main/app-routes'
+
+describe('settingsRoute', () => {
+  it('opens the settings of the organization the user was last in', () => {
+    expect(settingsRoute('/o/org-1/search?q=x')).toBe('/o/org-1/settings/general')
+  })
+
+  it('keeps the desktop settings of the workspace the user was last in', () => {
+    expect(settingsRoute('/workspace/ws-1/home')).toBe('/workspace/ws-1/settings/desktop')
+  })
+
+  it.each([
+    ['the workspace picker', '/workspace'],
+    ['the app entry', '/home'],
+    ['no saved route', undefined],
+    ['a route that only starts like an organization', '/oauth/o/org-1'],
+    ['an unsafe route', '//evil.example/o/org-1'],
+  ])('resolves settings through the web app from %s', (_label, lastRoute) => {
+    expect(settingsRoute(lastRoute)).toBe('/workspace?redirect=settings')
+  })
+})

apps/desktop/src/main/app-routes.ts

@@ -16,6 +16,12 @@ import { isSafeInternalPath } from '@/main/config'
  */
 export const APP_ENTRY_ROUTE = '/home'
 
+/**
+ * Settings for a viewer whose last route names no workspace or organization. The web
+ * app resolves it to their most recent workspace, or to their organization's settings.
+ */
+const SETTINGS_ENTRY_ROUTE = '/workspace?redirect=settings'
+
 /** Workspace id from the last visited route, or null when it carries none. */
 function workspaceIdFromRoute(lastRoute: string | undefined): string | null {
   if (isSafeInternalPath(lastRoute)) {
@@ -27,6 +33,16 @@ function workspaceIdFromRoute(lastRoute: string | undefined): string | null {
   return null
 }
 
+function organizationIdFromRoute(lastRoute: string | undefined): string | null {
+  if (isSafeInternalPath(lastRoute)) {
+    const match = /^\/o\/([^/?#]+)/.exec(lastRoute)
+    if (match) {
+      return match[1]
+    }
+  }
+  return null
+}
+
 /**
  * Route for "New Chat": the home (chat) surface of the workspace the user was
  * last in, falling back to the app entry when the last route carries no
@@ -38,10 +54,14 @@ export function newChatRoute(lastRoute: string | undefined): string {
 }
 
 /**
- * Route for "Settings…": the Sim app's settings surface for the workspace the
- * user was last in, falling back to the app entry.
+ * Route for "Settings…": the settings of the workspace or organization the user
+ * was last in. Never the app entry, which lands on a page without settings.
  */
 export function settingsRoute(lastRoute: string | undefined): string {
   const workspaceId = workspaceIdFromRoute(lastRoute)
-  return workspaceId ? `/workspace/${workspaceId}/settings/desktop` : APP_ENTRY_ROUTE
+  if (workspaceId) {
+    return `/workspace/${workspaceId}/settings/desktop`
+  }
+  const organizationId = organizationIdFromRoute(lastRoute)
+  return organizationId ? `/o/${organizationId}/settings/general` : SETTINGS_ENTRY_ROUTE
 }

apps/desktop/src/main/handoff.test.ts

@@ -1,9 +1,11 @@
 import { get as httpGet } from 'node:http'
+import type { BrowserWindow } from 'electron'
 import { describe, expect, it, vi } from 'vitest'
 
 vi.mock('electron', () => import('@/test/electron-mock'))
 
 import {
+  createAuthFlow,
   createHandoffManager,
   type HandoffCallback,
   type HandoffCallbacks,
@@ -161,6 +163,31 @@ describe('createHandoffManager', () => {
   })
 })
 
+describe('login handoff landing', () => {
+  it('lands on the app entry after redeeming the login token', async () => {
+    const win = {
+      isDestroyed: () => false,
+      loadURL: vi.fn(async () => {}),
+      show: vi.fn(),
+      focus: vi.fn(),
+      webContents: {
+        getURL: () => 'https://sim.ai/login',
+        executeJavaScript: vi.fn(async () => 200),
+      },
+    }
+    const flow = createAuthFlow({
+      handoff: { consume: () => true } as unknown as ReturnType<typeof createHandoffManager>,
+      origin: () => 'https://sim.ai',
+      events: makeEvents(),
+      ensureMainWindow: async () => win as unknown as BrowserWindow,
+    })
+
+    await flow.handleCallback({ token: VALID_TOKEN, state: _VALID_STATE })
+
+    expect(win.loadURL).toHaveBeenCalledExactlyOnceWith('https://sim.ai/home')
+  })
+})
+
 describe('connect handoff account pinning', () => {
   it('keeps a source request correlated across the browser and native completion', async () => {
     const deps = makeDeps()

apps/desktop/src/main/handoff.ts

@@ -6,6 +6,7 @@ import { getErrorMessage } from '@sim/utils/errors'
 import { generateShortId } from '@sim/utils/id'
 import type { BrowserWindow } from 'electron'
 import { app } from 'electron'
+import { APP_ENTRY_ROUTE } from '@/main/app-routes'
 import { showShellDialog } from '@/main/dialogs'
 import type { EventRecorder } from '@/main/observability'
 
@@ -451,7 +452,7 @@ export interface AuthFlow {
 
 /**
  * Orchestrates the login handoff: opening the system browser, consuming the
- * loopback callback, redeeming the token, and navigating to the workspace. A
+ * loopback callback, redeeming the token, and navigating to the app entry. A
  * failed or expired callback never leaves a partial session — the window lands
  * back on /login.
  */
@@ -521,7 +522,7 @@ export function createAuthFlow(deps: AuthFlowDeps): AuthFlow {
       }
       deps.events.record('handoff_redeem_ok')
       try {
-        await win.loadURL(`${origin}/workspace`)
+        await win.loadURL(`${origin}${APP_ENTRY_ROUTE}`)
       } catch {}
       win.show()
       win.focus()

apps/docs/content/docs/introduction/index.mdx

@@ -55,9 +55,15 @@ For tools outside the catalog, connect an [external MCP server](/agents/mcp) or
 
 The core source is available on [GitHub](https://github.com/simstudioai/sim) under the Apache 2.0 license. Enterprise features use a separate license that requires an active Enterprise subscription for production use. See [self-hosting](/platform/self-hosting) for installation requirements and configuration.
 
+## Security and compliance
+
+Sim is SOC 2 Type II compliant. Find reports and security details in the [trust center](https://trust.sim.ai/).
+
 ## Related docs
 
 - [Getting started](/getting-started): Build and run a simple summarizer.
 - [Chat](/chat): Build and manage workspace resources conversationally.
 - [Workflows](/workflows): Blocks, connections, triggers, and execution.
 - [Quick reference](/quick-reference): Look up builder actions.
+- [Pricing](https://www.sim.ai/pricing): Compare Sim Cloud plans.
+- [Comparisons](https://www.sim.ai/comparisons): Sim vs Microsoft Copilot Studio, n8n, Zapier, Make, Dust, and other AI agent platforms.

apps/sim/app/(landing)/pricing/pricing.tsx

@@ -1,4 +1,5 @@
 import { INTEGRATION_COUNT_LABEL } from '@sim/deployment-config/integration-claims'
+import { CREDITS_PER_DOLLAR } from '@/lib/billing/constants'
 import { PricingPlans } from '@/app/(landing)/pricing/components/pricing-plans'
 import { PricingStructuredData } from '@/app/(landing)/pricing/components/pricing-structured-data'
 
@@ -54,6 +55,19 @@ export default function Pricing() {
         className='mx-auto flex w-full max-w-[1728px] flex-col gap-7 px-10 pt-8 max-md:px-7 max-lg:px-8 max-xl:px-9'
       >
         <PricingPlans heading={PRICING_HEADING} />
+        <p className='mx-auto max-w-[720px] text-balance text-center text-[var(--text-body)] text-small'>
+          Sim is open source under the Apache 2.0 license, so you can self-host it for free with
+          Docker Compose or Kubernetes. Enterprise features need a license.{' '}
+          <a
+            href='https://docs.sim.ai/platform/self-hosting'
+            target='_blank'
+            rel='noopener noreferrer'
+            className='underline underline-offset-2'
+          >
+            Read the self-hosting guide
+          </a>
+          . On Sim Cloud, one credit is worth ${1 / CREDITS_PER_DOLLAR}.
+        </p>
       </section>
     </main>
   )

apps/sim/app/api/workspaces/route.test.ts

@@ -16,8 +16,9 @@ import {
 } from '@sim/testing/mocks/workspaces-policy.mock'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
-const { mockCreateWorkspace } = vi.hoisted(() => ({
+const { mockCreateWorkspace, mockResolveRolledOutOrganizationId } = vi.hoisted(() => ({
   mockCreateWorkspace: vi.fn(),
+  mockResolveRolledOutOrganizationId: vi.fn(),
 }))
 
 vi.mock('@/lib/auth/session-response', () => ({
@@ -32,6 +33,10 @@ vi.mock('@/lib/workspaces/list', () => ({
   listWorkspacesForViewer: vi.fn(),
 }))
 
+vi.mock('@/lib/navigation/resolve-app-entry', () => ({
+  resolveRolledOutOrganizationId: mockResolveRolledOutOrganizationId,
+}))
+
 vi.mock('@/lib/posthog/server', () => posthogServerMock)
 
 vi.mock('@sim/audit', () => auditMock)
@@ -99,3 +104,43 @@ describe('POST /api/workspaces capability refusal', () => {
     await expect(response.json()).resolves.toEqual({ error: 'Unauthorized' })
   })
 })
+
+describe('GET /api/workspaces blocked viewer forwarding', () => {
+  const blockedList = {
+    workspaces: [],
+    lastActiveWorkspaceId: null,
+    pinnedWorkspaceIds: [],
+    creationPolicy: { canCreate: false },
+  }
+  const routeContext = { params: Promise.resolve({}) }
+  const listRequest = () =>
+    createMockRequest('GET', undefined, {}, 'http://localhost/api/workspaces')
+
+  beforeEach(() => {
+    mockGetSession.mockResolvedValue({
+      user: { id: 'user-1', name: 'A', email: 'a@example.com' },
+    })
+    vi.mocked(listWorkspacesForViewer).mockResolvedValue(
+      blockedList as unknown as Awaited<ReturnType<typeof listWorkspacesForViewer>>
+    )
+  })
+
+  it('names the organization that can serve a viewer with nothing to pick', async () => {
+    mockResolveRolledOutOrganizationId.mockResolvedValue('org-1')
+    const response = await GET(listRequest(), routeContext)
+    expect((await response.json()).forwardOrganizationId).toBe('org-1')
+  })
+
+  it('leaves the blocked picker in place when no organization can serve them', async () => {
+    mockResolveRolledOutOrganizationId.mockResolvedValue(null)
+    const response = await GET(listRequest(), routeContext)
+    expect(await response.json()).not.toHaveProperty('forwardOrganizationId')
+  })
+
+  it('still returns the list when the organization lookup fails', async () => {
+    mockResolveRolledOutOrganizationId.mockRejectedValue(new Error('down'))
+    const response = await GET(listRequest(), routeContext)
+    expect(response.status).toBe(200)
+    expect(await response.json()).not.toHaveProperty('forwardOrganizationId')
+  })
+})

apps/sim/app/api/workspaces/route.ts

@@ -2,7 +2,7 @@ import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
 import { db } from '@sim/db'
 import { type WorkspaceMode, workflow } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
-import { getPostgresErrorCode } from '@sim/utils/errors'
+import { getErrorMessage, getPostgresErrorCode } from '@sim/utils/errors'
 import { and, eq, isNull } from 'drizzle-orm'
 import { type NextRequest, NextResponse } from 'next/server'
 import { listWorkspacesQuerySchema } from '@/lib/api/contracts'
@@ -11,6 +11,7 @@ import { parseRequest } from '@/lib/api/server'
 import { getSession } from '@/lib/auth'
 import { getActiveOrganizationId } from '@/lib/auth/session-response'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { resolveRolledOutOrganizationId } from '@/lib/navigation/resolve-app-entry'
 import { capabilityRefusalResponse } from '@/lib/permission-groups/capability-response'
 import { captureServerEvent } from '@/lib/posthog/server'
 import { createWorkspace } from '@/lib/workspaces/create'
@@ -24,6 +25,20 @@ import {
 
 const logger = createLogger('Workspaces')
 
+/** A failed lookup leaves the viewer on the blocked picker rather than failing the list. */
+async function resolveForwardOrganizationId(session: {
+  user: { id: string }
+}): Promise<string | undefined> {
+  try {
+    return (await resolveRolledOutOrganizationId(session)) ?? undefined
+  } catch (error) {
+    logger.warn('Could not resolve an organization to forward a blocked viewer to', {
+      error: getErrorMessage(error),
+    })
+    return undefined
+  }
+}
+
 // Get all workspaces for the current user
 export const GET = withRouteHandler(async (request: Request) => {
   const session = await getSession()
@@ -58,6 +73,7 @@ export const GET = withRouteHandler(async (request: Request) => {
         lastActiveWorkspaceId,
         pinnedWorkspaceIds,
         creationPolicy,
+        forwardOrganizationId: await resolveForwardOrganizationId(session),
       })
     }
 

apps/sim/app/o/[organizationId]/_redesign/redesign-host.tsx

@@ -18,3 +18,12 @@ interface RedesignSurfaceProps {
 export function RedesignSurface({ children }: RedesignSurfaceProps) {
   return <PlatformSurface theme='system'>{children}</PlatformSurface>
 }
+
+/** Fills the app's content slot, and the grid stretches the surface so its canvas reaches the end. */
+export function RedesignPageSurface({ children }: RedesignSurfaceProps) {
+  return (
+    <div className='grid h-full min-h-0 min-w-0 flex-1 grid-cols-[minmax(0,1fr)] overflow-y-auto'>
+      <RedesignSurface>{children}</RedesignSurface>
+    </div>
+  )
+}