Repository navigation
v0.9.44: go/ links and the Links page, extension voice input and page access, Mothership workspace file writes, trace content kept on large runs - #9700
Merged
Conversation
Co-authored-by: Sim Pi Agent <pi@sim.ai>
* docs(library): update best-ai-agent-builders-with-mcp-support * Pi Babysit: address PR #9676 feedback --------- Co-authored-by: Sim Pi Agent <pi@sim.ai>
* improvement(ci): avoid redundant browser dependency updates * fix(ci): retain historical benchmark provisioning and docs triggers
…get runs out (#9682) * fix(logs): keep checked trace content when the display projection budget runs out - Project each log display value on its own, so one oversized or ref-backed value withholds only itself instead of the error, message and every other envelope field - When the whole-trace content walk exhausts its node budget, keep the spans that already passed it and withhold only the rest; every other projection failure still withholds the whole trace - Put the bulky block dumps after the trace spans so budget pressure drops them first - Attribute projection warnings to their execution, workflow, workspace, mode, span and field * fix(logs): bound the withheld-span fallback by the trace's structure budget and make envelope span ids unguessable * fix(logs): resume the withheld-span fallback from the retained spans' structure budget * improvement(logs): name the projection warning's read/write phase explicitly
* fix(files): let Mothership tool runs write workspace files `tools execute` authorizes the chat's delegated principal for `sim:tool-execution` and hands it to the tool layer unchanged, but every workspace-file use case admits only `sim:workspace-files`. Every File tool run directly from a Mothership chat therefore failed with a 403 "Delegated workspace access is no longer valid", which the agent relayed to the user as lost workspace access. The File tool handler now rebinds a delegated caller to the workspace-files audience (keeping subject, workspace, expiry ceiling and resource scope), as function-execute and payload materialization already do; the file use cases still check the subject's current workspace role. `image_generate` outside a workflow run returned only a URL for its copilot-storage upload, so the file-output processor downloaded and re-uploaded it, storing every image twice under two keys and returning `imageUrl` and `image` that disagreed. It now returns the stored file. * improvement(files): sniff generated images once and refuse foreign delegations with 403 Generated images are now content-sniffed before they are stored, so every output field references the same verified object on both the workflow and chat paths; skipping the re-upload had otherwise skipped the sniff it did. A delegation minted for another workspace is no longer rebound (which threw and surfaced a 500); the workspace-file use cases refuse it with their ordinary 403. The regression test now uses the shared principal factory and uploads mock. * chore(files): import the principal factory directly in the delegated write test
…inks (#9686) * improvement(links): open go/ links alongside sim/ and call the page Links * improvement(links): share the go/ and sim/ host list and show link names without a prefix * improvement(links): name both prefixes in the extension description and recovery policy * improvement(links): drop extension version qualifiers from the docs
…9683) * improvement(extension): enable page access across websites * fix(extension): distinguish unreadable pages from missing access * improvement(extension): keep page-access copy concise * test(extension): wait for the page access action * fix(extension): complete access grants after dialog dismissal * test(extension): exercise voice restart and sign-in recovery * test(extension): grant microphone for the embedded app origin * fix(extension): enable voice input and resume signed-in panels safely * refactor(extension): shorten copy and verify session recovery * fix(extension): clear stale authentication when returning to Chat * fix(extension): keep recovery actions accessible and connected * test(extension): use accessible link fields and retain voice proof * test(extension): preserve link-flow failures when capturing evidence
…ace with an at-a-glance table (#9688) * improvement(comparisons): answer Copilot Studio buyer questions in place with an at-a-glance table The Copilot Studio comparison now leads with its answer under the question buyers ask, answers the tracked buyer questions in their own sections, adds a sourced six-row at-a-glance table, and links one alternatives article instead of repeating it. The page no longer appends a generated FAQ block that restated the same material; its FAQ structured data lists the page's own questions. Profile fields are optional, so every other comparison page renders as before. * improvement(comparisons): keep the hero summary, section ids, and better-than question in the page's FAQ data Restores the sr-only hero summary for pages that lead with a question, gives every new section an id, includes the 'Is Sim better than' answer in the page's question list so FAQ data matches the page, and asserts every answer and at-a-glance value in the landing SEO E2E. * improvement(comparisons): order llms-full comparison questions as the page does Opening questions lead, glance questions follow the at-a-glance table, and the switching question follows the feature table, so each answer comes after the evidence it builds on.
…et (#9689) * test(extension): exercise larger page batches and shared budgets * improvement(extension): share the page attachment content budget * fix(chat): validate page snapshots before measuring their budget
…h config rejections at warn (#9691)
…rough one component (#9693) The 'Is Sim better than' answer now renders through QuestionSections with the intro questions, the hero lead shares one answer paragraph and one verified line across both variants, and answersQuestionsInPlace names the rule that hides the FAQ block and sources FAQ data from the page's questions.
* test(voice): cover cancellation during startup * fix(voice): stop microphone capture during startup
…n nothing was searched (#9694) * fix(search): keep Confluence searchable for colon queries and say when nothing was searched Confluence rejects a CQL text query holding a colon or backslash with HTTP 400, even escaped, which dropped it from those searches; both now go as word breaks. A plain live search that reaches no connected account is reported as partial with guidance naming where to connect one, and the results view offers the connection instead of claiming no results. * fix(search): search nothing for a Confluence query with no words and stop the Assistant retrying unsearchable searches A query left with no words after the colon and backslash become spaces would list every Confluence page, so it now searches nothing on both the member and service-account paths. The Assistant search tool reports a search no account served as nothing searched instead of advising a narrower retry, and the organization search E2E asserts the connect prompt the unconnected member sees. * fix(search): let the guidance alone say how to recover from a search nothing served
…rojection warnings (#9692)
* improvement(links): make go/ and sim/ work on install with no setup Chrome treats go/x as a search until it has seen the host. It counts a visit to an unfamiliar single-label host as typed, so the extension now visits both hosts once on install, in background tabs that close themselves. That removes the Browser shortcuts modal and its Enable buttons, and the Links header now just links to the store. Drop the managed bookmarks export with it. The /sim-links/<org>/<name> route stays so bookmarks already distributed keep opening. * improvement(links): only teach Chrome when links are on, and open links in the organization they belong to Teaching Chrome go/ for everyone would turn a typed go/foo into a Sim page for people without links, so the visit now waits for the signed-in session to report links as enabled. History expires after 90 days, so the visit repeats weekly at browser start and retries when it did not complete. Links page Open and Copy, the shortcut chips and the org route now resolve in the organization they name rather than the session's landing organization. A link can't point back into link resolution. Suggestions match inside names, a missing link offers similar names, a typed phrase searches Links, and an organization without links gets an explanation instead of a 404. * improvement(extension): tidy page capture and session handling Use the shared UTF-8 length helper, drop redundant mounted guards, reuse ExtensionSessionExpired and the repeated capture messages, style the page-access error, and guard that the stale-transcript e2e sends before the socket closes. * fix(extension): visit short hosts when a signed-in panel is ready Installing signed out and signing in through the panel left go/ and sim/ untaught until the next browser start. Prove it end to end: nothing is visited signed out, and each host is visited once after sign-in. * improvement(links): keep sim/ URLs, tell the extension when sign-in finishes, and fix what the feature audit found A user belongs to one organization, so org-scoped link URLs fixed nothing and lost values and queries. Restore them, and drop the redirect-loop guard, which refused real aliases and broke editing them. The hosted app now posts signed-in from the extension layout, so members without chat access still get shortcuts. Typed phrases find hyphenated names, Copy link confirms, the omnibox hint matches what Enter does, and the docs match the behaviour. Share the extension dialog shell and remove an unreachable recovery branch. * improvement(extension): remove opt-in search recovery Shortcuts now work without setup, so recovery was extra config that needed search-site access and could catch real searches like go/ast. An update clears the rules and setting from earlier versions, and the recover route stays until those versions have updated. * improvement(links): remove the search recovery and organization link routes Links has few users so far, so nothing needs to keep working from earlier versions: no bookmarks export remains to serve, and no recovery rules to catch. * improvement(extension): disclose the keyboard shortcut in the privacy policy
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Contributor
 [High impact] The PR reaches browser permissions, workspace file writes, execution traces, and shared search behavior. Keep the two legacy link routes working before merging so installed shortcuts and distributed bookmarks do not break. SummaryThis release adds
|
Contributor
Comments Outside DiffThese findings could not be posted inline.
|
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
All reported issues were addressed across 117 files
Reply with feedback, questions, or to request a fix.
Turn on auto-fix | Re-trigger cubic
Restore no caches in the signed build job, and require a manual dispatch to run from the tag it builds, so it never executes another ref's code in a run that can write default-branch caches.
A Links search over 200 characters failed client validation and showed the raw error. Cap it in the input and in the URL parser, the way People does, so a deep link stays valid too.
* fix(desktop): download Bun fresh in the signed release build * fix(desktop): drop the unused setup-bun anchor
* test(extension): verify explicit sign-in recovery * fix(extension): keep sign-in recovery available
This branch was previously deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.