fix(flow): validate paths and correct JSON generation

Author: waleedlatif1

apps/sim/blocks/blocks/flow.ts

@@ -638,7 +638,7 @@ export const FlowBlock: BlockConfig = {
       language: 'json',
       wandConfig: {
         enabled: true,
-        generationType: 'json-object',
+        generationType: 'json-array',
         prompt:
           'Generate valid JSON for Flow entities: Array of 1\u2013100 entities: [{entityType, name, id?}]. IDs may be omitted for server generation. Return only JSON. Use only supplied category IDs and field keys.',
         placeholder: 'Describe the entities to generate',
@@ -710,9 +710,8 @@ export const FlowBlock: BlockConfig = {
       language: 'json',
       wandConfig: {
         enabled: true,
-        generationType: 'json-object',
         prompt:
-          'Generate valid JSON for Flow value: Field value as JSON, matching the data model: string, number, boolean, array, object, or null. Return only JSON. Use only supplied category IDs and field keys.',
+          'Generate valid JSON for Flow value: Field value as JSON, matching the data model: string, number, boolean, array, object, or null. Use only supplied category IDs and field keys. Return ONLY one raw JSON value, without markdown fences or prose.',
         placeholder: 'Describe the value to generate',
       },
     },
@@ -732,7 +731,7 @@ export const FlowBlock: BlockConfig = {
       language: 'json',
       wandConfig: {
         enabled: true,
-        generationType: 'json-object',
+        generationType: 'json-array',
         prompt:
           'Generate valid JSON for Flow updates: Array of 1\u2013100 field updates: [{entityId, key, value}]. Return only JSON. Use only supplied category IDs and field keys.',
         placeholder: 'Describe the updates to generate',

apps/sim/lib/sim-search/live/flow.test.ts

@@ -15,12 +15,12 @@ const entity = {
   links: { inbound: [], outbound: [], crosslinks: [], inboundOrder: {} },
   updatedAt: '2026-10-01T12:00:00Z',
 }
-const input: NativeSearchInput = {
+const input = {
   query: 'temperature',
   limit: 10,
   scopes: [],
   native: { provider: 'flow', query: 'temperature', project: PROJECT_ID },
-}
+} satisfies NativeSearchInput
 
 function client(json: NativeClient['json']): NativeClient {
   return {
@@ -36,6 +36,38 @@ function client(json: NativeClient['json']): NativeClient {
 
 /** Failure modes: stale hits bypassing current reads, missing project scope, malformed entity states, and wrong entity identities. */
 describe('Flow live entity boundary', () => {
+  it.each([
+    { location: 'search project', id: '.' },
+    { location: 'search project', id: '..' },
+    { location: 'read project', id: '.' },
+    { location: 'read project', id: '..' },
+    { location: 'read entity', id: '.' },
+    { location: 'read entity', id: '..' },
+  ])(
+    'rejects a dot segment in $location ($id) before requesting a different endpoint',
+    async ({ location, id }) => {
+      const requests: string[] = []
+      const api = client(async (path) => {
+        requests.push(path)
+        return []
+      })
+      await expect(
+        location === 'search project'
+          ? searchFlow(
+              api,
+              { ...input, native: { ...input.native, provider: 'flow', project: id } },
+              ORIGIN
+            )
+          : readFlow(
+              api,
+              { ...reference, ...(location === 'read project' ? { container: id } : { id }) },
+              ORIGIN
+            )
+      ).rejects.toThrow('path traversal')
+      expect(requests).toEqual([])
+    }
+  )
+
   it('reads current project-bound content rather than returning stale search previews', async () => {
     const api = client(async (path) => {
       if (path === `/project/${PROJECT_ID}/entities/search`) {

apps/sim/lib/sim-search/live/flow.ts

@@ -1,7 +1,7 @@
 import { isRecordLike } from '@sim/utils/object'
 import { truncate } from '@sim/utils/string'
 import { nativeText } from '@/lib/sim-search/live/dates'
-import { array, NativeSearchError, object, segment, string } from '@/lib/sim-search/live/http'
+import { array, NativeSearchError, object, string } from '@/lib/sim-search/live/http'
 import { collectNativePages } from '@/lib/sim-search/live/pages'
 import type {
   NativeClient,
@@ -10,14 +10,15 @@ import type {
   NativeSearchInput,
 } from '@/lib/sim-search/live/types'
 import { htmlToPlainText } from '@/connectors/utils'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 const MAX_PROJECTS = 6
 const MAX_ITEM_TEXT = 120_000
 
 function itemDocument(
   row: Record<string, unknown>,
   origin: string,
-  project?: string,
+  project: string,
   humanId?: string
 ): NativeDocument | undefined {
   const id = string(row.id)
@@ -42,7 +43,10 @@ function itemDocument(
     container: project,
     kind: string(row.type) || 'item',
     title: [humanId, string(values.name) || `Item ${id}`].filter(Boolean).join(' · '),
-    url: new URL(`/project/${segment(project ?? '')}/entities/${segment(id)}`, origin).toString(),
+    url: new URL(
+      `/project/${safeUrlPathSegment(project, 'projectId')}/entities/${safeUrlPathSegment(id, 'entityId')}`,
+      origin
+    ).toString(),
     content: truncate(
       [
         ...fields,
@@ -65,7 +69,8 @@ async function searchProject(
   project: string
 ): Promise<NativePage> {
   const limit = Math.min(input.limit, 100)
-  const response = await client.json(`/project/${segment(project)}/entities/search`, {
+  const projectPath = safeUrlPathSegment(project, 'projectId')
+  const response = await client.json(`/project/${projectPath}/entities/search`, {
     query: {
       query: nativeText(input),
       branch_id: 'master',
@@ -78,7 +83,7 @@ async function searchProject(
   const ids = [...new Set(hits.map((row) => string(row.entity_id)).filter(Boolean))]
   if (!ids.length) return { documents: [], partial: response.length > 0 }
   const details = await client.json(
-    `/project/${segment(project)}/entities/${ids.map(segment).join(',')}`,
+    `/project/${projectPath}/entities/${ids.map((id) => safeUrlPathSegment(id, 'entityId')).join(',')}`,
     { query: { branch_id: 'master', include_metadata: 'true' } }
   )
   if (!Array.isArray(details))
@@ -140,7 +145,7 @@ export async function readFlow(
   if (!origin || !reference.id || reference.id.length > 256 || !reference.container)
     throw new NativeSearchError('unavailable', 'Invalid Flow item reference.')
   const response = await client.json(
-    `/project/${segment(reference.container)}/entities/${segment(reference.id)}`,
+    `/project/${safeUrlPathSegment(reference.container, 'projectId')}/entities/${safeUrlPathSegment(reference.id, 'entityId')}`,
     { query: { branch_id: 'master', include_metadata: 'true' } }
   )
   if (!Array.isArray(response))