feat(code): cli sandboxes, enterprise timeouts, secrets projections, resolver lift, workflow exec cancellations by icecrasher321 · Pull Request #6247 · simstudioai/sim

icecrasher321 · 2026-08-04T08:23:20Z

Summary

Allow CLIs in Sandboxes (with 25 managed CLIs out of the box)
Add Shell as supported language in function block
Enterprise metadata can set custom timeouts now
Resolver lifted to be central compiler adhering to secrets mgmt policies and applying across the board
Workflow execution cancellations to cancel trigger dev side too

Type of Change

New feature

Testing

Tested manually

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

…resolver lift

…lver # Conflicts: # apps/sim/components/settings/navigation.test.ts # apps/sim/components/settings/navigation.ts # apps/sim/providers/index.test.ts

gitguardian · 2026-08-04T08:23:26Z

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secret in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
35640005	Triggered	Generic Password	`1a7c79b`	apps/desktop/src/main/browser-import/import-service.test.ts	View secret

🛠 Guidelines to remediate hardcoded secrets

Understand the implications of revoking this secret by investigating where it is used in your code.
Replace and store your secret safely. Learn here the best practices.
Revoke and rotate this secret.
If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

following these best practices for managing and storing secrets including API keys and other credentials
install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}

vercel · 2026-08-04T08:23:26Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview	Aug 4, 2026 9:28pm

cursor · 2026-08-04T08:23:37Z

PR Summary

High Risk
Touches secret handling, remote sandbox supply chain, and core execution/timeout/cleanup paths across API, cron, and Function routes—high blast radius if binding, deadlines, or image recipes regress.

Overview
This PR expands remote Function sandboxes with a curated managed-CLI catalog (pinned vendor artifacts, checksums, client/server registry split, content-addressed image identity) plus agent skills/commands for adding CLIs safely. Workspace sandboxes can also declare system packages alongside pip/npm deps; docs and self-hosted guides now spell out dedicated Function base images for E2B/Daytona vs separate Mothership shell images.

Function execution gains Shell as a remote language, Python as real modules (__sim_result__ / __main__), stricter sandbox output size and file-type limits, Mothership-only trusted sandbox profiles, and clearer timeout vs cancel vs workflow-deadline handling across local VM, remote JS/Python, and shell paths.

A central code compiler/resolver now binds {{KEY}} secrets at the execution boundary (opaque bindings, regex/heredoc/shell cases) instead of pasting values into source; provenance and model-facing projection replace exact secret values before agent/tool continuations while execution logs keep masked copies. Custom Tool and credentials docs reflect this.

Async workflow policy: Enterprise can configure longer runs (up to 7 days); direct async API/SDK callers may send X-Execution-Timeout-Seconds / executionTimeoutSeconds to shorten a run within account policy, not extend it. OpenAPI and Python/TS SDK docs are updated.

Stale execution cleanup is reworked for scale: deadline-aware workflow failure, bounded batched mutations with FOR UPDATE SKIP LOCKED, separate table-job thresholds, and async job cleanup keyed off per-job maxDurationSeconds when present.

^{Reviewed by Cursor Bugbot for commit 5cbafee. Configure here.}

icecrasher321 · 2026-08-04T08:27:03Z

@greptile

greptile-apps · 2026-08-04T08:30:45Z

Greptile Summary

This PR centralizes execution-time placeholder and secret resolution while expanding sandbox capabilities and configurable enterprise execution deadlines.

Adds curated managed CLIs and Shell support to Function sandboxes across provisioning, API contracts, and workspace settings.
Applies centralized variable resolution and secret-safe projection across workflow handlers, logs, traces, and Copilot tool execution.
Adds account-policy and request-level timeout handling for asynchronous executions.
Updates SDKs, database metadata, documentation, and tests for the new execution contracts.

Confidence Score: 5/5

The PR appears safe to merge based on the review findings available in this follow-up.

No blocking failure remains.

Important Files Changed

Filename	Overview
apps/sim/executor/variables/resolver.ts	Centralizes execution input and secret-reference resolution for block handlers.
apps/sim/lib/execution/code-placeholders/index.ts	Exposes the shared compiler contract for language-aware code placeholders.
apps/sim/lib/execution/remote-sandbox/cli-tools.server.ts	Defines server-only, pinned installation recipes for curated sandbox CLIs.
apps/sim/lib/execution/remote-sandbox/resolve.ts	Resolves sandbox specifications, packages, managed CLIs, and provider behavior.
apps/sim/lib/billing/execution-timeout-defaults.ts	Introduces centralized defaults and policy handling for execution timeouts.
apps/sim/app/api/workflows/[id]/execute/route.ts	Propagates request-level asynchronous execution deadlines through workflow admission and dispatch.
packages/db/schema.ts	Extends persisted enterprise metadata needed by configurable execution policies.
packages/ts-sdk/src/index.ts	Adds the asynchronous server-side execution timeout option to the TypeScript SDK.
packages/python-sdk/simstudio/init.py	Adds the corresponding asynchronous execution timeout option to the Python SDK.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Trigger[Workflow trigger] --> Preprocess[Admission and timeout policy]
  Preprocess --> Resolver[Central variable and secret resolver]
  Resolver --> Executor[Workflow executor]
  Executor --> Function[Function sandbox]
  Function --> Runtime{Runtime}
  Runtime --> JavaScript[JavaScript]
  Runtime --> Python[Python]
  Runtime --> Shell[Shell]
  Function --> ManagedCLI[Managed CLI environment]
  Executor --> Projection[Secret-safe output projection]
  Projection --> Logs[Logs and traces]
  Projection --> Agent[Agent and Copilot consumers]

_{Reviews (12): Last reviewed commit: "Merge remote-tracking branch 'origin/sta..." | Re-trigger Greptile}

icecrasher321 · 2026-08-04T09:19:51Z

@greptile

icecrasher321 · 2026-08-04T09:19:58Z

@cursor review

icecrasher321 · 2026-08-04T10:13:16Z

@greptile

icecrasher321 · 2026-08-04T10:13:23Z

@cursor review

icecrasher321 · 2026-08-04T10:26:38Z

@greptile

icecrasher321 · 2026-08-04T10:26:44Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 6a257db. Configure here.}

…lver # Conflicts: # apps/sim/background/schedule-execution.test.ts # apps/sim/background/schedule-execution.ts # apps/sim/lib/copilot/chat/workspace-context.ts

icecrasher321 · 2026-08-04T17:38:11Z

@greptile

icecrasher321 · 2026-08-04T17:38:17Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 93c6320. Configure here.}

…lver

icecrasher321 · 2026-08-04T18:11:32Z

@greptile

icecrasher321 · 2026-08-04T18:11:41Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 7845110. Configure here.}

…lver

icecrasher321 · 2026-08-04T18:43:52Z

@greptile

icecrasher321 · 2026-08-04T18:44:00Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 54e828f. Configure here.}

…lver

icecrasher321 · 2026-08-04T19:14:50Z

@greptile

icecrasher321 · 2026-08-04T19:14:58Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 9f0d229. Configure here.}

…lver # Conflicts: # apps/sim/lib/copilot/vfs/workspace-vfs.ts # apps/sim/lib/core/config/env-flags.ts # apps/sim/lib/execution/remote-sandbox/pi-lifetime.test.ts # apps/sim/lib/execution/remote-sandbox/pi-lifetime.ts # apps/sim/lib/execution/remote-sandbox/provider.ts # scripts/setup/checks.ts

icecrasher321 · 2026-08-04T21:24:20Z

bugbot run

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 5cbafee. Configure here.}

icecrasher321 added 2 commits August 4, 2026 01:07

feat(code): cli sandboxes, enterprise timeouts, secrets projections, …

66b25d3

…resolver lift

Merge remote-tracking branch 'origin/staging' into feat/func-cli-reso…

1a7c79b

…lver # Conflicts: # apps/sim/components/settings/navigation.test.ts # apps/sim/components/settings/navigation.ts # apps/sim/providers/index.test.ts

icecrasher321 requested a review from a team as a code owner August 4, 2026 08:23

vercel Bot deployed to Preview August 4, 2026 08:28 View deployment

cursor Bot reviewed Aug 4, 2026

View reviewed changes

Comment thread apps/sim/app/api/cron/cleanup-stale-executions/route.ts

github-advanced-security AI found potential problems Aug 4, 2026

View reviewed changes

Comment thread apps/sim/lib/execution/code-placeholders/javascript.ts Fixed

fix(execution): harden compatibility and secret diagnostics

9661638

vercel Bot temporarily deployed to Preview August 4, 2026 09:19 Inactive

cursor Bot reviewed Aug 4, 2026

View reviewed changes

Comment thread apps/sim/app/api/cron/cleanup-stale-executions/route.ts

Comment thread apps/sim/app/api/cron/cleanup-stale-executions/route.ts Outdated

fix(execution): harden generated JavaScript literals

78c5e8b

vercel Bot temporarily deployed to Preview August 4, 2026 09:37 Inactive

fix(execution): align timeout cleanup semantics

3ff0dba

vercel Bot temporarily deployed to Preview August 4, 2026 10:11 Inactive

cursor Bot reviewed Aug 4, 2026

View reviewed changes

Comment thread apps/sim/app/api/cron/cleanup-stale-executions/route.ts Outdated

fix(tables): decouple stale job cleanup

d8f777e

vercel Bot temporarily deployed to Preview August 4, 2026 10:26 Inactive

cursor Bot reviewed Aug 4, 2026

View reviewed changes

Comment thread apps/sim/app/api/cron/cleanup-stale-executions/route.ts

fix(execution): drain stale workflow backlog

e3f33d1

vercel Bot temporarily deployed to Preview August 4, 2026 10:45 Inactive

cursor Bot reviewed Aug 4, 2026

View reviewed changes

Merge remote-tracking branch 'origin/staging' into feat/func-cli-reso…

93c6320

…lver # Conflicts: # apps/sim/background/schedule-execution.test.ts # apps/sim/background/schedule-execution.ts # apps/sim/lib/copilot/chat/workspace-context.ts

cursor Bot reviewed Aug 4, 2026

View reviewed changes

vercel Bot deployed to Preview August 4, 2026 17:42 View deployment

Merge remote-tracking branch 'origin/staging' into feat/func-cli-reso…

7845110

…lver

cursor Bot reviewed Aug 4, 2026

View reviewed changes

vercel Bot deployed to Preview August 4, 2026 18:16 View deployment

Merge remote-tracking branch 'origin/staging' into feat/func-cli-reso…

54e828f

…lver

vercel Bot deployed to Preview August 4, 2026 18:48 View deployment

cursor Bot reviewed Aug 4, 2026

View reviewed changes

Merge remote-tracking branch 'origin/staging' into feat/func-cli-reso…

9f0d229

…lver

vercel Bot temporarily deployed to Preview August 4, 2026 19:14 Inactive

cursor Bot reviewed Aug 4, 2026

View reviewed changes

icecrasher321 changed the title ~~feat(code): cli sandboxes, enterprise timeouts, secrets projections, resolver lift~~ feat(code): cli sandboxes, enterprise timeouts, secrets projections, resolver lift, workflow exec cancellations Aug 4, 2026

cancel route fixes

d192e21

vercel Bot temporarily deployed to Preview August 4, 2026 20:26 Inactive

vercel Bot deployed to Preview August 4, 2026 20:55 View deployment

separate out mship template and func template

5cbafee

vercel Bot deployed to Preview August 4, 2026 21:28 View deployment

cursor Bot reviewed Aug 4, 2026

View reviewed changes

Uh oh!

Conversation

icecrasher321 commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Type of Change

Testing

Checklist

Uh oh!

gitguardian Bot commented Aug 4, 2026

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Uh oh!

vercel Bot commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

icecrasher321 commented Aug 4, 2026

Uh oh!

Uh oh!

greptile-apps Bot commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Flowchart

Uh oh!

Uh oh!

icecrasher321 commented Aug 4, 2026

Uh oh!

icecrasher321 commented Aug 4, 2026

Uh oh!

Uh oh!

Uh oh!

icecrasher321 commented Aug 4, 2026

Uh oh!

icecrasher321 commented Aug 4, 2026

Uh oh!

Uh oh!

icecrasher321 commented Aug 4, 2026

Uh oh!

icecrasher321 commented Aug 4, 2026

Uh oh!

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

icecrasher321 commented Aug 4, 2026

Uh oh!

icecrasher321 commented Aug 4, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

icecrasher321 commented Aug 4, 2026

Uh oh!

icecrasher321 commented Aug 4, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

icecrasher321 commented Aug 4, 2026

Uh oh!

icecrasher321 commented Aug 4, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

icecrasher321 commented Aug 4, 2026

Uh oh!

icecrasher321 commented Aug 4, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

icecrasher321 commented Aug 4, 2026

Uh oh!

cursor Bot left a comment

icecrasher321 commented Aug 4, 2026 •

edited

Loading

vercel Bot commented Aug 4, 2026 •

edited

Loading

cursor Bot commented Aug 4, 2026 •

edited

Loading

greptile-apps Bot commented Aug 4, 2026 •

edited

Loading