Merge remote-tracking branch 'origin/staging' into feat/permission-groups-coverage

Author: waleedlatif1

.devcontainer/docker-compose.yml

@@ -25,6 +25,11 @@ services:
       - OLLAMA_URL=${OLLAMA_URL:-http://localhost:11434}
       - NEXT_PUBLIC_SOCKET_URL=${NEXT_PUBLIC_SOCKET_URL:-}
       - BUN_INSTALL_CACHE_DIR=/home/bun/.bun/cache
+    # Lets a workflow reach a service on the Docker host. Reaching it also
+    # requires naming it in EGRESS_ALLOWED_HOSTS; this only makes the name
+    # resolve, which it does not on Linux by default.
+    extra_hosts:
+      - 'host.docker.internal:host-gateway'
     depends_on:
       db:
         condition: service_healthy

.gitignore

@@ -84,9 +84,6 @@ start-collector.sh
 # IntelliJ
 .idea
 
-## Helm Chart Tests
-helm/sim/test
-
 ## Claude Code
 .claude/launch.json
 .claude/worktrees/

apps/docs/content/docs/agents/mcp.mdx

@@ -85,6 +85,10 @@ Tool validation badges appear on servers with issues — for example, if a tool
 
 Self-hosted deployments can restrict which MCP server domains are allowed by setting the `ALLOWED_MCP_DOMAINS` environment variable (comma-separated list). When set, only servers on approved domains can be added. When unset, all domains are allowed.
 
+This governs which domains may be used. It is separate from where those domains are allowed to resolve: an MCP server on a private address is reached by naming it in `EGRESS_ALLOWED_HOSTS` or `EGRESS_ALLOWED_IP_RANGES`, described in [Security](/platform/self-hosting/security#the-ssrf-boundary). Both checks apply.
+
+The allowlist covers the server URL itself. If the server requires OAuth, any endpoint its metadata names on a *different* origin than the server you configured is treated as content rather than as configuration, so that one has to be publicly routable. Endpoints on the server's own origin keep the server's reachability.
+
 ## Using MCP Tools in Agents
 
 Once MCP servers are configured, their tools become available within your agent blocks:

apps/docs/content/docs/integrations/elasticsearch.mdx

@@ -306,7 +306,7 @@ Retrieve index information including settings, mappings, and aliases.
 
 | Parameter | Type | Description |
 | --------- | ---- | ----------- |
-| `index` | json | Index information including aliases, mappings, and settings |
+| `indices` | json | Matched indices keyed by index name, each with its aliases, mappings, and settings |
 
 ### Elasticsearch Cluster Health
 
@@ -324,7 +324,7 @@ Get the health status of the Elasticsearch cluster.
 | `username` | string | No | Username for basic auth |
 | `password` | string | No | Password for basic auth |
 | `waitForStatus` | string | No | Wait until cluster reaches this status: green, yellow, or red |
-| `timeout` | string | No | Timeout for the wait operation \(e.g., 30s, 1m\) |
+| `clusterTimeout` | string | No | How long Elasticsearch waits for the cluster to reach the requested status, as an Elasticsearch time value \(e.g., 30s, 1m\). Not named "timeout": that name is reserved by the tool transport as a client-side abort deadline in milliseconds. |
 
 #### Output
 
@@ -377,12 +377,13 @@ List all indices in the Elasticsearch cluster with their health, status, and sta
 | `apiKey` | string | No | Elasticsearch API key |
 | `username` | string | No | Username for basic auth |
 | `password` | string | No | Password for basic auth |
+| `includeSystemIndices` | boolean | No | Include Elasticsearch system indices \(names starting with "."\). Omitted by default. |
 
 #### Output
 
 | Parameter | Type | Description |
 | --------- | ---- | ----------- |
 | `message` | string | Summary message about the indices |
-| `indices` | json | Array of index information objects |
+| `indices` | json | Array of index information objects \(index, health, status, docsCount, storeSize, primaryShards, replicaShards\). System indices are omitted unless includeSystemIndices is set. |
 
 

apps/docs/content/docs/integrations/file.mdx

@@ -1,6 +1,6 @@
 ---
 title: File
-description: Read, get content, fetch, write, append, compress, decompress, and manage sharing for files
+description: Read, search, get content, fetch, write, append, compress, decompress, and manage sharing for files
 ---
 
 import { BlockInfoCard } from "@/components/ui/block-info-card"
@@ -11,23 +11,24 @@ import { BlockInfoCard } from "@/components/ui/block-info-card"
 />
 
 {/* MANUAL-CONTENT-START:intro */}
-The File block is a built-in Sim block for working with files stored in the workspace, or fetched from external URLs. It handles reading, writing, appending, compressing, decompressing, and sharing files as part of a workflow.
+The File block is a built-in Sim block for working with files stored in the workspace, or fetched from external URLs. It handles reading, searching, writing, appending, compressing, decompressing, and sharing files as part of a workflow.
 
 With the File block, you can:
 
 - **Read and extract content**: Load workspace file objects and extract their text content
+- **Search workspace content**: Find literal text across indexed active workspace files with bounded line-level results
 - **Fetch from URLs**: Retrieve and parse files from external URLs with custom headers
 - **Write and append**: Create new workspace files or append content to existing ones
 - **Compress and decompress**: Bundle files into a .zip archive or extract an archive into the workspace
 - **Manage sharing**: Enable or disable a public share link for a file, with public, password, email, or SSO access modes
 
-In Sim, the File block allows your agents to read and extract text from workspace files, fetch and parse files from URLs, write or append content to files, bundle files into or out of .zip archives, and control public sharing access for a file—all programmatically as steps in a workflow. This makes it possible to move file content into and out of a workflow, package outputs for download or transfer, and expose files to external users through a managed share link.
+In Sim, the File block allows your agents to search, read, and extract text from workspace files, fetch and parse files from URLs, write or append content to files, bundle files into or out of .zip archives, and control public sharing access for a file—all programmatically as steps in a workflow. This makes it possible to explore workspace content, move file content into and out of a workflow, package outputs for download or transfer, and expose files to external users through a managed share link.
 {/* MANUAL-CONTENT-END */}
 
 
 ## Usage Instructions
 
-Read workspace file objects, extract the text content of files, fetch and parse files from URLs with optional headers, write new workspace files, append content to existing files, compress files into a .zip archive, extract a .zip archive into the workspace, or manage the public share link for a file.
+Read workspace file objects, search indexed text across all active workspace files, extract the text content of files, fetch and parse files from URLs with optional headers, write new workspace files, append content to existing files, compress files into a .zip archive, extract a .zip archive into the workspace, or manage the public share link for a file.
 
 
 
@@ -67,6 +68,35 @@ Extract the text content of one or more workspace files from selected file objec
 | --------- | ---- | ----------- |
 | `contents` | array | Array of file text contents, one entry per file in input order |
 
+### File Search
+
+Search indexed text across active workspace files using literal smart-case substring matching.
+
+#### Input
+
+| Parameter | Type | Required | Description |
+| --------- | ---- | -------- | ----------- |
+| `query` | string | Yes | Literal text to find \(3-512 characters\). Uppercase Unicode letters make matching case-sensitive. |
+| `maxResults` | number | No | Hard result cap configured by the workflow builder \(1-200, default 50\). |
+
+#### Output
+
+| Parameter | Type | Description |
+| --------- | ---- | ----------- |
+| `results` | array | Matching logical lines with their workspace file ID and 1-based line number. |
+|   ↳ `fileId` | string | Canonical workspace file ID. |
+|   ↳ `lineNumber` | number | 1-based logical line number. |
+|   ↳ `text` | string | Matching line or bounded match-centered preview. |
+| `count` | number | Number of returned matching lines. |
+| `truncated` | boolean | Whether more matching lines exist beyond the configured hard cap. |
+| `complete` | boolean | Whether indexing has no pending or failed current revisions; skipped and partial coverage is reported separately. |
+| `indexStatus` | object | Current workspace search-index coverage by file status. |
+|   ↳ `readyFiles` | number | Files whose current revision is searchable. |
+|   ↳ `pendingFiles` | number | Files still waiting to be indexed. |
+|   ↳ `failedFiles` | number | Files whose current indexing attempt failed. |
+|   ↳ `skippedFiles` | number | Files intentionally excluded because they are unsupported or oversized. |
+|   ↳ `partialFiles` | number | Searchable files whose extracted text was truncated by the parser or cap. |
+
 ### File Fetch
 
 Fetch and parse a file from a URL with optional custom headers.
@@ -87,16 +117,17 @@ Fetch and parse a file from a URL with optional custom headers.
 
 ### File Write
 
-Create a new workspace file, either from text content or from an existing file. If a file with the same name already exists, a numeric suffix is added (e.g., "data (1).csv").
+Create a new workspace file, either from text content or from an existing file. If a file with the same name already exists, a numeric suffix is added (e.g., "data (1).csv") unless overwrite is enabled.
 
 #### Input
 
 | Parameter | Type | Required | Description |
 | --------- | ---- | -------- | ----------- |
-| `fileName` | string | No | File name \(e.g., "data.csv"\). Required when writing text; optional when storing a file, which keeps its own name unless this overrides it. If the name already exists, a numeric suffix is added automatically. |
+| `fileName` | string | No | File name \(e.g., "data.csv"\). Required when writing text; optional when storing a file, which keeps its own name unless this overrides it. If the name already exists, a numeric suffix is added automatically unless overwrite is enabled. |
 | `content` | string | No | The text content to write to the file. Provide exactly one of content or fileInput. |
 | `fileInput` | file | No | An existing file to store in the workspace, such as one produced by an earlier tool. Use this for anything that is not text — PDFs, images, audio, archives. Provide exactly one of content or fileInput. |
 | `contentType` | string | No | MIME type for new files \(e.g., "text/plain"\). Auto-detected from the file extension, or taken from the stored file, if omitted. |
+| `overwrite` | boolean | No | Replace the contents of an existing file at the exact target path \(folder and name\) instead of creating a suffixed copy. Creates the file when that path does not exist yet. |
 
 #### Output
 

apps/docs/content/docs/integrations/github.mdx

@@ -1019,10 +1019,10 @@ Update branch protection rules for a specific branch, including status checks, r
 | `owner` | string | Yes | Repository owner \(user or organization\) |
 | `repo` | string | Yes | Repository name |
 | `branch` | string | Yes | Branch name |
-| `required_status_checks` | object | Yes | Required status check configuration \(null to disable\). Object with strict \(boolean\) and contexts \(string array\) |
-| `enforce_admins` | boolean | Yes | Whether to enforce restrictions for administrators |
-| `required_pull_request_reviews` | object | Yes | PR review requirements \(null to disable\). Object with optional required_approving_review_count, dismiss_stale_reviews, require_code_owner_reviews |
-| `restrictions` | object | Yes | Push restrictions \(null to disable\). Object with users \(string array\) and teams \(string array\) |
+| `required_status_checks` | object | No | Required status check configuration. Object with strict \(boolean\) and contexts \(string array\). Omit to disable status checks — GitHub receives an explicit null. |
+| `enforce_admins` | boolean | No | Whether to enforce restrictions for administrators. Omit to disable admin enforcement — GitHub receives an explicit null. |
+| `required_pull_request_reviews` | object | No | PR review requirements. Object with optional required_approving_review_count, dismiss_stale_reviews, require_code_owner_reviews. Omit to disable review requirements — GitHub receives an explicit null. |
+| `restrictions` | object | No | Push restrictions, available only for organization-owned repositories. Object with users \(string array\), teams \(string array\) and optional apps \(string array\). Omit to disable push restrictions — GitHub receives an explicit null. |
 | `apiKey` | string | Yes | GitHub Personal Access Token |
 
 #### Output
@@ -1805,14 +1805,15 @@ Trigger a workflow dispatch event for a GitHub Actions workflow. The workflow mu
 
 ### GitHub List Workflow Runs
 
-List workflow runs for a repository. Supports filtering by actor, branch, event, and status. Returns run details including status, conclusion, and links.
+List workflow runs for a repository, or for a single workflow when a workflow ID or filename is given. Supports filtering by actor, branch, event, and status. Returns run details including status, conclusion, and links.
 
 #### Input
 
 | Parameter | Type | Required | Description |
 | --------- | ---- | -------- | ----------- |
 | `owner` | string | Yes | Repository owner \(user or organization\) |
 | `repo` | string | Yes | Repository name |
+| `workflow_id` | string | No | The ID of the workflow. You can also pass the workflow file name as a string \(e.g., ci.yml\). Omit to list runs across the whole repository. |
 | `actor` | string | No | Filter by user who triggered the workflow |
 | `branch` | string | No | Filter by branch name |
 | `event` | string | No | Filter by event type \(e.g., push, pull_request, workflow_dispatch\) |