fix(selectors): address Cubic rerun findings

Author: Bill Leoutsakos

.agents/skills/add-block/SKILL.md

@@ -1080,8 +1080,10 @@ execute through `selectors.execute`; never add a client provider module or selec
 `canonicalParamId: 'oauthCredential'` on the credential sub-block is the line people forget. The
 shared context builder projects only active `dependsOn` values and keys canonical pairs by their
 canonical id. Exact environment references such as `{{GMAIL_CREDENTIAL_ID}}` stay unresolved in the
-browser and are resolved only by the authorized server executor. A credential field is also
-recognized by its `oauth-input` type as a compatibility fallback.
+browser and are resolved only by the authorized server executor. The builder does not infer a
+nonstandard credential id from `type: 'oauth-input'`; give it
+`canonicalParamId: 'oauthCredential'`, or declare an explicit manifest `sourceFields` alias when a
+legacy source id must be retained.
 
 **`options` — everything else.** A static array, or a pure function of the block's own values for a list that narrows to a sibling's selection. No I/O.
 

apps/sim/app/api/webhooks/route.test.ts

@@ -81,6 +81,7 @@ describe('POST /api/webhooks polling configuration', () => {
       blockId: 'block-1',
       path: 'imap-hook',
       provider: 'imap',
+      deploymentVersionId: 'deployment-1',
       providerConfig: {
         host: '{{IMAP_HOST}}',
         username: '{{IMAP_USERNAME}}',
@@ -115,6 +116,7 @@ describe('POST /api/webhooks polling configuration', () => {
       requestId: 'mock-request-id',
       userId: 'actor-1',
       workspaceId: 'canonical-workspace',
+      deploymentVersionId: 'deployment-1',
     })
   })
 })

apps/sim/app/api/webhooks/route.ts

@@ -509,6 +509,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
             userId,
             workspaceId:
               typeof workflowRecord.workspaceId === 'string' ? workflowRecord.workspaceId : null,
+            deploymentVersionId: savedWebhook.deploymentVersionId ?? null,
           })
 
           if (!success) {

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/dropdown/dropdown.test.tsx

@@ -14,6 +14,7 @@ const { fetched } = vi.hoisted(() => ({
     hasLoadedOptions: true,
     fetchError: null as string | null,
     hydratedOptions: [] as { id: string; label: string }[],
+    selectedValues: ['col_a', 'col_gone'] as string[],
   },
 }))
 
@@ -61,7 +62,7 @@ vi.mock(
 )
 vi.mock(
   '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/hooks/use-sub-block-value',
-  () => ({ useSubBlockValue: () => [['col_a', 'col_gone'], () => {}] })
+  () => ({ useSubBlockValue: () => [fetched.selectedValues, () => {}] })
 )
 vi.mock(
   '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/providers/active-search-target-provider',
@@ -154,4 +155,25 @@ describe('Dropdown multi-select stale selections', () => {
       fetched.hydratedOptions = []
     }
   })
+
+  it('preserves selected value order when hydrating multiple missing options', () => {
+    const previousOptions = fetched.options
+    const previousSelectedValues = fetched.selectedValues
+    fetched.options = []
+    fetched.selectedValues = ['col_first', 'col_second']
+    fetched.hydratedOptions = [
+      { id: 'col_first', label: 'First column' },
+      { id: 'col_second', label: 'Second column' },
+    ]
+    try {
+      const html = render()
+      expect(html.indexOf('data-value="col_first"')).toBeLessThan(
+        html.indexOf('data-value="col_second"')
+      )
+    } finally {
+      fetched.options = previousOptions
+      fetched.selectedValues = previousSelectedValues
+      fetched.hydratedOptions = []
+    }
+  })
 })

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/dropdown/dropdown.tsx

@@ -207,7 +207,7 @@ export const Dropdown = memo(function Dropdown({
       }
     }
 
-    for (const option of hydratedOptions) {
+    for (const option of [...hydratedOptions].reverse()) {
       const alreadyPresent = opts.some((existing) =>
         typeof existing === 'string' ? existing === option.id : existing.id === option.id
       )

apps/sim/lib/imap/connection.server.test.ts

@@ -90,6 +90,24 @@ describe('IMAP connection policy', () => {
     )
   })
 
+  it('preserves the legacy TLS defaults for nullable connection values', () => {
+    expect(
+      normalizeLiteralImapConnection({
+        host: 'imap.example.com',
+        port: null,
+        secure: null,
+        username: 'mailbox-user',
+        password: 'literal-password',
+      })
+    ).toEqual({
+      host: 'imap.example.com',
+      port: 993,
+      secure: true,
+      username: 'mailbox-user',
+      password: 'literal-password',
+    })
+  })
+
   it('resolves exact personal and visible shared references for the deployment actor', async () => {
     environmentUtilsMockFns.mockResolveEffectiveEnvironmentVariables.mockResolvedValue({
       PERSONAL_PASSWORD: {
@@ -182,6 +200,21 @@ describe('IMAP connection policy', () => {
     )
   })
 
+  it('rejects unresolved workflow references in literal IMAP connection fields', () => {
+    expect(() =>
+      normalizeLiteralImapConnection({
+        host: 'imap.example.com',
+        username: '<previous.output>',
+        password: 'literal-password',
+      })
+    ).toThrowError(
+      expect.objectContaining<Partial<ImapConnectionPolicyError>>({
+        name: 'ImapConnectionPolicyError',
+        code: 'context',
+      })
+    )
+  })
+
   it('reauthorizes requested references on every resolution and fails closed after revocation', async () => {
     environmentUtilsMockFns.mockResolveEffectiveEnvironmentVariables
       .mockResolvedValueOnce({

apps/sim/lib/imap/connection.server.ts

@@ -1,6 +1,7 @@
 import { ImapFlow } from 'imapflow'
 import { validateDatabaseHost } from '@/lib/core/security/input-validation.server'
 import { resolveEffectiveEnvironmentVariables } from '@/lib/environment/utils'
+import { containsReference } from '@/lib/workflows/sanitization/references'
 
 const EXACT_ENVIRONMENT_REFERENCE = /^\{\{\s*([A-Za-z_][A-Za-z0-9_]*)\s*\}\}$/
 
@@ -27,8 +28,8 @@ export interface ResolvedImapConnection {
   password: string
 }
 
-function containsTemplateDelimiter(value: string): boolean {
-  return value.includes('{{') || value.includes('}}')
+function containsUnresolvedReference(value: string): boolean {
+  return value.includes('{{') || value.includes('}}') || containsReference(value)
 }
 
 export function hasImapEnvironmentReferences(input: ImapConnectionInput): boolean {
@@ -41,9 +42,10 @@ function normalizeConnection(input: ImapConnectionInput): ResolvedImapConnection
   const host = typeof input.host === 'string' ? input.host.trim() : ''
   const username = typeof input.username === 'string' ? input.username : ''
   const password = typeof input.password === 'string' ? input.password : ''
-  const port = input.port === undefined || input.port === '' ? 993 : Number(input.port)
+  const port =
+    input.port === null || input.port === undefined || input.port === '' ? 993 : Number(input.port)
   const secure =
-    input.secure === undefined || input.secure === ''
+    input.secure === null || input.secure === undefined || input.secure === ''
       ? true
       : typeof input.secure === 'string'
         ? input.secure.toLowerCase() === 'true'
@@ -77,7 +79,7 @@ export async function resolveImapConnectionForActor(input: {
         if (typeof value !== 'string') return []
         const match = EXACT_ENVIRONMENT_REFERENCE.exec(value)
         if (match) return [match[1]]
-        if (containsTemplateDelimiter(value)) throw new ImapConnectionPolicyError('context')
+        if (containsUnresolvedReference(value)) throw new ImapConnectionPolicyError('context')
         return []
       })
     ),
@@ -119,7 +121,7 @@ export function normalizeResolvedImapConnection(
 
 export function normalizeLiteralImapConnection(input: ImapConnectionInput): ResolvedImapConnection {
   for (const value of [input.host, input.port, input.secure, input.username, input.password]) {
-    if (typeof value === 'string' && containsTemplateDelimiter(value)) {
+    if (typeof value === 'string' && containsUnresolvedReference(value)) {
       throw new ImapConnectionPolicyError('context')
     }
   }

apps/sim/lib/selectors/server/providers/confluence.test.ts

@@ -0,0 +1,81 @@
+/**
+ * @vitest-environment node
+ */
+import { afterAll, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { mockFetch, mockResolveCredentialBundle, mockResolveCloudId } = vi.hoisted(() => ({
+  mockFetch: vi.fn(),
+  mockResolveCredentialBundle: vi.fn(),
+  mockResolveCloudId: vi.fn(),
+}))
+
+vi.mock('@/lib/selectors/server/providers/credential-bundle', () => ({
+  resolveSelectorCredentialBundle: mockResolveCredentialBundle,
+}))
+
+vi.mock('@/lib/selectors/server/providers/atlassian', () => ({
+  resolveSelectorAtlassianCloudId: mockResolveCloudId,
+}))
+
+import { SelectorOptionsUnavailableError } from '@/lib/selectors/server/errors'
+import { createSelectorProtectedValues } from '@/lib/selectors/server/protected-values'
+import { confluenceSelectorAttachments } from '@/lib/selectors/server/providers/confluence'
+import type { ExecuteServerSelectorArgs } from '@/lib/selectors/server/types'
+
+function pageDetailArgs(): ExecuteServerSelectorArgs {
+  return {
+    selectorKey: 'confluence.pages',
+    context: { oauthCredential: 'credential-1', domain: 'acme.atlassian.net' },
+    request: { kind: 'detail', id: 'page-1' },
+    scope: { kind: 'workspace', workspaceId: 'workspace-1' },
+    workspaceId: 'workspace-1',
+    principal: { kind: 'session', userId: 'user-1', sessionId: 'session-1' },
+    requesterUserId: 'user-1',
+    credential: { suppliedId: 'credential-1' },
+    references: new Map(),
+    protectedValues: createSelectorProtectedValues(),
+  }
+}
+
+describe('Confluence server selector adapters', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    vi.stubGlobal('fetch', mockFetch)
+    mockResolveCredentialBundle.mockResolvedValue({ accessToken: 'server-only-token' })
+    mockResolveCloudId.mockResolvedValue('cloud-1')
+  })
+
+  afterAll(() => vi.unstubAllGlobals())
+
+  it('hydrates page details through the bounded provider reader without requesting page bodies', async () => {
+    mockFetch.mockResolvedValueOnce(
+      new Response(JSON.stringify({ id: 'page-1', title: 'Architecture' }), { status: 200 })
+    )
+
+    await expect(
+      confluenceSelectorAttachments['confluence.pages'].execute(pageDetailArgs())
+    ).resolves.toEqual({
+      kind: 'detail',
+      item: { id: 'page-1', label: 'Architecture' },
+    })
+
+    const requestedUrl = String(mockFetch.mock.calls[0]?.[0])
+    expect(requestedUrl).toBe(
+      'https://api.atlassian.com/ex/confluence/cloud-1/wiki/api/v2/pages/page-1'
+    )
+    expect(requestedUrl).not.toContain('body-format')
+  })
+
+  it('rejects an oversized page detail response before parsing it', async () => {
+    mockFetch.mockResolvedValueOnce(
+      new Response('{}', {
+        status: 200,
+        headers: { 'content-length': String(16 * 1024 * 1024 + 1) },
+      })
+    )
+
+    await expect(
+      confluenceSelectorAttachments['confluence.pages'].execute(pageDetailArgs())
+    ).rejects.toBeInstanceOf(SelectorOptionsUnavailableError)
+  })
+})

apps/sim/lib/selectors/server/providers/confluence.ts

@@ -13,7 +13,6 @@ import {
   listSelectorResult,
   type ServerSelectorAttachmentMap,
 } from '@/lib/selectors/server/types'
-import { fetchConfluencePage } from '@/tools/confluence/client'
 
 type ConfluenceSelectorKey = Extract<ServerSelectorKey, 'confluence.spaces' | 'confluence.pages'>
 
@@ -160,23 +159,16 @@ async function executePages(args: ExecuteServerSelectorArgs) {
     if (!/^[A-Za-z0-9_-]{1,255}$/.test(pageId)) {
       throw new SelectorContextUnavailableError()
     }
-    let response: Response
-    try {
-      response = await fetchConfluencePage({
-        ...auth,
-        pageId,
+    const page = await fetchProviderJson<ConfluencePage>(
+      `https://api.atlassian.com/ex/confluence/${auth.cloudId}/wiki/api/v2/pages/${pageId}`,
+      {
+        headers: {
+          Accept: 'application/json',
+          Authorization: `Bearer ${auth.accessToken}`,
+        },
         signal: args.signal,
-      })
-    } catch {
-      throw new SelectorOptionsUnavailableError()
-    }
-    if (!response.ok) throw new SelectorOptionsUnavailableError()
-    let page: ConfluencePage
-    try {
-      page = (await response.json()) as ConfluencePage
-    } catch {
-      throw new SelectorOptionsUnavailableError()
-    }
+      }
+    )
     if (!page.id || !page.title) throw new SelectorOptionsUnavailableError()
     return detailSelectorResult({ id: page.id, label: page.title })
   }

apps/sim/lib/selectors/server/sanitize.test.ts

@@ -141,6 +141,45 @@ describe('sanitizeSelectorResult', () => {
     ).toThrow(SelectorOptionsUnavailableError)
   })
 
+  it('rejects protected plaintext in metadata keys without applying the detail exemption', () => {
+    const protectedValues = createSelectorProtectedValues()
+    protectedValues.add('resolved-id')
+
+    expect(() =>
+      sanitizeSelectorResult(
+        {
+          kind: 'detail',
+          item: {
+            id: 'resolved-id',
+            label: 'resolved-id',
+            meta: { 'prefix-resolved-id-suffix': null },
+          },
+        },
+        protectedValues,
+        { allowedDetailExactProtectedValue: 'resolved-id' }
+      )
+    ).toThrow(SelectorOptionsUnavailableError)
+  })
+
+  it('preserves allowed metadata keys that shadow object prototype properties', () => {
+    const meta = Object.create(null) as Record<string, null>
+    meta.__proto__ = null
+
+    const result = sanitizeSelectorResult(
+      {
+        kind: 'list',
+        items: [{ id: 'resource-1', label: 'Resource one', meta }],
+      },
+      createSelectorProtectedValues()
+    )
+
+    expect(result.kind).toBe('list')
+    if (result.kind !== 'list') throw new Error('Expected list selector result')
+    expect(Object.hasOwn(result.items[0].meta ?? {}, '__proto__')).toBe(true)
+    expect(result.items[0].meta?.__proto__).toBeNull()
+    expect(JSON.stringify(result.items[0].meta)).toBe('{"__proto__":null}')
+  })
+
   it('rejects metadata strings larger than the response contract permits', () => {
     expect(() =>
       sanitizeSelectorResult(