fix(release): small release-audit cleanups

- docs: MACHINE_ACCESS names MCP TypeScript SDK 2.4.0 (taken in #9846)
- run status: readPausedRunPoints reuses the pause_points the status read already
  loaded instead of re-querying paused_executions on every paused run read
- polling: markWebhookFailed logs "auto-disabled" only when this update turned the
  webhook off, read from a locked prior row in the same single statement
- mistral: an explicit image limit of 0 asks Mistral for no images instead of
  falling back to 100; block placeholder and tool description say so
- v2 meta: scopes reports every scope the credential reaches through
  oauthScopeSatisfies (api:write implies api:read, either implies search:read);
  enforcement unchanged, OpenAPI and CLI artifacts regenerated

Author: waleedlatif1

apps/docs/MACHINE_ACCESS.md

@@ -33,7 +33,7 @@ Continue until `nextCursor` is `null`. Unknown cursors and invalid parameters re
 
 Configure a remote Streamable HTTP server at `https://docs.sim.ai/api/mcp`. This endpoint is separate from Sim's workspace MCP server and `/mcp/...` documentation pages. It requires no API key.
 
-The official stable MCP TypeScript SDK 2.3.1 serves the 2026-07-28 protocol and stateless compatibility for 2025-era clients. Tools:
+The official stable MCP TypeScript SDK 2.4.0 serves the 2026-07-28 protocol and stateless compatibility for 2025-era clients. Tools:
 
 | Tool | Input | Result |
 | --- | --- | --- |

apps/docs/content/docs/integrations/mistral_parse.mdx

@@ -33,7 +33,7 @@ Parse PDF documents using Mistral OCR API
 | `resultType` | string | No | Legacy parser output format \(markdown, text, or json; default markdown\). Versions 2 and 3 return structured OCR pages regardless of this value. |
 | `includeImageBase64` | boolean | No | Extract the images in the document \(figures, logos, photos\) as files on the images output |
 | `pages` | array | No | Specific pages to process \(array of page numbers, starting from 0\) |
-| `imageLimit` | number | No | Maximum number of images to extract \(at most 100\) |
+| `imageLimit` | number | No | Maximum number of images to extract \(at most 100; 0 extracts none\) |
 | `imageMinSize` | number | No | Minimum height and width of images to extract from the PDF |
 | `tableFormat` | string | No | Return tables separately on each page as markdown or html instead of inline in the page markdown |
 | `apiKey` | string | Yes | Mistral API key \(MISTRAL_API_KEY\) |

apps/docs/openapi-v2-resources.json

@@ -18651,7 +18651,7 @@
               "type": "string",
               "enum": ["api:read", "api:write", "search:read"]
             },
-            "description": "API scopes the calling credential holds. A read-only API key holds only api:read: it is refused every operation that changes state and every operation that declares no API scope, so api:read alone does not authorize those. A full-access key holds api:read and api:write; an OAuth access token holds what it was granted."
+            "description": "API scopes the calling credential can use. api:write implies api:read, and either implies search:read. A read-only API key holds api:read and search:read: it is refused every operation that changes state and every operation that declares no API scope, so api:read alone does not authorize those. A full-access key holds all three; an OAuth access token holds what it was granted and what that implies."
           }
         },
         "required": ["v2Enabled", "keyType", "expiresAt", "scopes"],

apps/sim/blocks/blocks/mistral_parse.ts

@@ -384,7 +384,7 @@ export const MistralParseV3Block: BlockConfig = {
       id: 'imageLimit',
       title: 'Max Images',
       type: 'short-input',
-      placeholder: 'Up to 100 (default 100)',
+      placeholder: 'Up to 100 (default 100, 0 for none)',
       condition: { field: 'includeImageBase64', value: true },
       mode: 'advanced',
     },

apps/sim/lib/api-key/__integration__/read-only-access.integration.ts

@@ -275,7 +275,7 @@ describe('read-only and expiring API keys in PostgreSQL', () => {
     for (const key of [readPersonalKey, readWorkspaceKey]) {
       const meta = await call(v2Meta, '/api/v2/meta', { key })
       expect(meta.status).toBe(200)
-      expect(meta.body).toMatchObject({ data: { scopes: ['api:read'] } })
+      expect(meta.body).toMatchObject({ data: { scopes: ['api:read', 'search:read'] } })
     }
     const personalMeta = await call(v2Meta, '/api/v2/meta', { key: readPersonalKey })
     expect(personalMeta.body).toMatchObject({ data: { expiresAt } })
@@ -417,7 +417,7 @@ describe('read-only and expiring API keys in PostgreSQL', () => {
   it('treats a key created before access levels as full access', async () => {
     const meta = await call(v2Meta, '/api/v2/meta', { key: legacyKey })
     expect(meta.body).toMatchObject({
-      data: { scopes: ['api:read', 'api:write'], expiresAt: null },
+      data: { scopes: ['api:read', 'api:write', 'search:read'], expiresAt: null },
     })
 
     const tablesBefore = await tableCount()

apps/sim/lib/api/contracts/v2/meta.ts

@@ -25,7 +25,7 @@ export const v2MetaSchema = z
     scopes: z
       .array(z.enum(['api:read', 'api:write', 'search:read']))
       .describe(
-        'API scopes the calling credential holds. A read-only API key holds only api:read: it is refused every operation that changes state and every operation that declares no API scope, so api:read alone does not authorize those. A full-access key holds api:read and api:write; an OAuth access token holds what it was granted.'
+        'API scopes the calling credential can use. api:write implies api:read, and either implies search:read. A read-only API key holds api:read and search:read: it is refused every operation that changes state and every operation that declares no API scope, so api:read alone does not authorize those. A full-access key holds all three; an OAuth access token holds what it was granted and what that implies.'
       ),
   })
   .meta({

apps/sim/lib/core/application/oauth-authorization.test.ts

@@ -2,6 +2,7 @@ import type { OAuthAccessTokenPrincipal, PersonalApiKeyPrincipal } from '@sim/au
 import { describe, expect, it, vi } from 'vitest'
 import { defineAuthorizedWorkspaceUseCase } from '@/lib/core/application/authorized-workspace-use-case'
 import {
+  credentialApiScopes,
   InsufficientScopeError,
   OAuthAccessTokenExpiredError,
   ReadOnlyApiKeyError,
@@ -104,6 +105,30 @@ describe('semantic OAuth policy', () => {
     ).not.toThrow()
   })
 
+  it.each([
+    { case: 'a write token', credential: { ...principal, scopes: ['api:write'] } },
+    { case: 'a read token', credential: principal },
+    { case: 'a search-only token', credential: { ...principal, scopes: ['search:read'] } },
+    {
+      case: 'a read-only key',
+      credential: { kind: 'personal_api_key', userId: 'user-1', keyId: 'k-1', access: 'read' },
+    },
+    {
+      case: 'a full-access key',
+      credential: { kind: 'personal_api_key', userId: 'user-1', keyId: 'k-1', access: 'write' },
+    },
+  ] as const)('reports exactly the scopes $case can reach', ({ credential }) => {
+    const reachable = (['api:read', 'api:write', 'search:read'] as const).filter((oauthScope) => {
+      try {
+        requireOAuthOperationScope(credential, { ...writeOperation, oauthScope })
+        return true
+      } catch {
+        return false
+      }
+    })
+    expect(credentialApiScopes(credential)).toEqual(reachable)
+  })
+
   it('rejects expiry before considering scope', () => {
     expect(() =>
       requireOAuthOperationScope({ ...principal, expiresAt: new Date(0) }, writeOperation)

apps/sim/lib/core/application/oauth-authorization.ts

@@ -87,13 +87,15 @@ const API_SCOPES: readonly OAuthApiScope[] = [
 ]
 
 /**
- * The API scopes a credential holds, as `/api/v2/meta` reports them. A credential
- * no grant bounds, such as a write key, holds both `api:read` and `api:write`.
+ * The API scopes a credential can reach, as `/api/v2/meta` reports them: each scope
+ * {@link requireOAuthOperationScope} would let it through, so `api:write` reports the
+ * `api:read` it implies and either reports `search:read`. A credential no grant bounds,
+ * such as a write key, reaches every scope.
  */
 export function credentialApiScopes(principal: Principal): OAuthApiScope[] {
   const granted = grantedApiScopes(principal)
-  if (!granted) return [OAUTH_API_READ_SCOPE, OAUTH_API_WRITE_SCOPE]
-  return API_SCOPES.filter((scope) => granted.includes(scope))
+  if (!granted) return [...API_SCOPES]
+  return API_SCOPES.filter((scope) => oauthScopeSatisfies(granted, scope))
 }
 
 function grantedApiScopes(principal: Principal): readonly string[] | undefined {

apps/sim/lib/internal/mistral/operations.test.ts

@@ -239,7 +239,6 @@ describe('Mistral ingestion authorization', () => {
   it.each([
     { case: 'a limit above the cap', imageLimit: 5000 },
     { case: 'no limit', imageLimit: undefined },
-    { case: 'a zero limit', imageLimit: 0 },
   ])(
     'never asks Mistral for more images than one parse may store, given $case',
     async ({ imageLimit }) => {
@@ -255,6 +254,15 @@ describe('Mistral ingestion authorization', () => {
     }
   )
 
+  it('asks Mistral for no images when the image limit is zero', async () => {
+    await executeMistralToolParse(
+      'mistral_parser_v3',
+      { ...input, includeImageBase64: true, imageLimit: 0 },
+      context
+    )
+    expect(submit.mock.calls[0][1]).not.toHaveProperty('include_image_base64')
+  })
+
   it('returns extracted images as files, never as base64 in the output', async () => {
     const png = Buffer.concat([Buffer.from([0xff, 0xd8, 0xff]), Buffer.from('synthetic jpeg body')])
     submit.mockResolvedValue({

apps/sim/lib/internal/mistral/operations.ts

@@ -266,20 +266,21 @@ export async function executeMistralParse(
 /**
  * The workflow tool's parse. Only `mistral_parser_v3` extracts images, and it
  * returns them as stored files rather than base64 in the output; older tool
- * versions declare no image output, so they never ask Mistral for images.
+ * versions declare no image output, so they never ask Mistral for images. An
+ * image limit of 0 asks for no images, the same as leaving extraction off.
  */
 export async function executeMistralToolParse(
   toolId: string,
   input: MistralParseInput,
   context: MistralOperationContext
 ): Promise<{ success: true; output: unknown } | InternalToolFileResult> {
-  if (toolId !== 'mistral_parser_v3' || !input.includeImageBase64) {
+  if (toolId !== 'mistral_parser_v3' || !input.includeImageBase64 || input.imageLimit === 0) {
     return executeMistralParse({ ...input, includeImageBase64: undefined }, context)
   }
   const result = await executeMistralParse(
     {
       ...input,
-      imageLimit: Math.min(input.imageLimit || MAX_OCR_EXTRACTED_IMAGES, MAX_OCR_EXTRACTED_IMAGES),
+      imageLimit: Math.min(input.imageLimit ?? MAX_OCR_EXTRACTED_IMAGES, MAX_OCR_EXTRACTED_IMAGES),
     },
     context
   )