v0.6.81: files in agent block, file block update, mermaid version update

[Sg312]

• chore(deps): bump mermaid to 11.15.0 for GHSA-ghcm-xqfw-q4vr (chore(deps): bump mermaid to 11.15.0 for GHSA-ghcm-xqfw-q4vr #4615)
• improvement(agent, file-block): files in agent block, file block v4 (improvement(agent, file-block): files in agent block, file block v4 #4610)
• fix(logs,workspace): prevent cancelled status overwrite on race and move impersonation banner (fix(logs,workspace): prevent cancelled status overwrite on race and move impersonation banner #4617)
• fix(files): fixed resource spacing on files directories pages (fix(files): fixed resource spacing on files directories pages #4618)
• improvement(providers): align attachment dispatch to vendor SDK types (improvement(providers): align attachment dispatch to vendor SDK types #4619)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		May 15, 2026 11:39pm

[greptile-apps]

Greptile Summary

This PR adds file attachment support to the agent block (upload or reference files that are attached to the last user message and hydrated with base64 for each provider), introduces a new FileV4Block with read/fetch/write/append operations, and bumps mermaid to 11.15.0. A new attachments.ts module centralises provider-specific message formatting for 13 providers.

• Agent file attachments: files are normalised, hydrated with base64 via hydrateUserFilesWithBase64, and injected into the last user message before the provider call; memory persistence sanitises messages to strip file data before writing to DB.
• FileV4Block: supersedes FileV3Block (hidden from toolbar) with a unified read/fetch/write/append operation picker; file_read and file_fetch tools back the new block.
• Provider attachment layer (attachments.ts): builds provider-specific content parts (OpenAI Responses, Anthropic, Gemini, Bedrock, OpenRouter, and image-only providers) with MIME sniffing, format validation, and unsupported-provider guards.

Confidence Score: 4/5

The core attachment pipeline is well-structured and the provider-specific formatting is comprehensive; the main rough edges are in size validation and error messaging rather than broken data paths.

The size check in prepareProviderAttachments compares raw file size against a 10 MB threshold, but base64 encoding inflates the actual payload by ~33%, so files between ~7.5 MB and 10 MB pass the guard and then silently fail during hydration with a generic error. The memory sanitizer also strips function_call and tool_calls as a side effect of only whitelisting three fields.

apps/sim/providers/attachments.ts (size validation logic) and apps/sim/executor/handlers/agent/memory.ts (sanitizeMessageForStorage field preservation)

Important Files Changed

Filename	Overview
apps/sim/providers/attachments.ts	New 571-line module centralizing provider-specific attachment formatting for 13 providers. Size validation uses raw file size instead of base64-inflated size, meaning files between ~7.5 MB and 10 MB pass the guard but fail during hydration with a generic error.
apps/sim/executor/handlers/agent/agent-handler.ts	Adds file attachment support to the agent block: attachFilesToLastUserMessage and hydrateMessageFilesForProvider methods introduced. Files are processed redundantly in hydrateMessageFilesForProvider, and the missingFile error message is misleading about the likely cause.
apps/sim/executor/handlers/agent/memory.ts	Adds sanitizeMessageForStorage to strip files (large base64) before persisting to DB. Implementation preserves only role/content/executionId, which silently drops function_call and tool_calls as a side effect.
apps/sim/blocks/blocks/file.ts	Adds FileV4Block with read/fetch/write/append operations. FileV3Block is hidden from toolbar. Logic is clear and consistent with the existing pattern.
apps/sim/app/api/tools/file/manage/route.ts	Adds a read operation for multi-file retrieval by canonical ID or picker input. The fileInputToUserFile guard prevents double-resolution correctly.
apps/sim/lib/uploads/utils/user-file-base64.server.ts	Removes the Math.min cap on maxBytes so providers can specify limits above DEFAULT_MAX_BASE64_BYTES (~5.6 MB). Intentional to support the 10 MB attachment ceiling.
apps/sim/providers/openai/utils.ts	buildResponsesInputFromMessages updated to inject file attachments for user messages via buildOpenAIMessageContent. Empty-content guard logic preserved for system/assistant roles.
apps/sim/executor/utils/start-block.ts	normalizeStartFile replaces isUserFileWithMetadata check; files missing key, finite size, or other required fields are now rejected. Explicit output.files = undefined when files key is present but validation fails.

Sequence Diagram

sequenceDiagram
    participant UI as Agent Block UI
    participant AH as AgentBlockHandler
    participant MEM as Memory
    participant HYDRATE as user-file-base64.server
    participant PROV as LLM Provider

    UI->>AH: execute(inputs, files)
    AH->>AH: buildMessages()
    AH->>AH: attachFilesToLastUserMessage(messages, files)
    note over AH: normalizeFileInput to processFilesToUserFiles sets message.files = UserFile[]
    AH->>AH: hydrateMessageFilesForProvider(messages, providerId)
    AH->>HYDRATE: hydrateUserFilesWithBase64(userFiles, maxBytes 10MB)
    HYDRATE-->>AH: UserFile[] with base64
    AH->>AH: missingFile check throws if base64 absent
    AH->>PROV: providerRequest with hydrated messages
    note over PROV: buildOpenAIMessageContent or buildAnthropicMessageContent or buildGeminiMessageParts
    PROV-->>AH: response
    AH->>MEM: appendMessage sanitized files stripped
    note over MEM: sanitizeMessageForStorage keeps role content executionId only

Loading

_{Reviews (1): Last reviewed commit: "improvement(agent, file-block): files in..." | Re-trigger Greptile}

[cursor]

PR Summary

Medium Risk
Moderate risk: multiple API routes now delegate core mutations to new orchestration helpers (credentials, workflows, folders, schedules, MCP) and the file system gains new folder/move/download semantics, which could affect permissions, error mapping, and data integrity. CloudWatch alarm muting switches to mute-rule APIs and file parsing now forwards custom HTTP headers, so runtime behavior changes are non-trivial.

Overview
Expands workspace file capabilities and updates the File tool to v4. Adds new workspace file-folder APIs (create/list/update/delete/restore), bulk archive, move, and a ZIP download endpoint with file-count/size limits and path sanitization; uploads/presigned/register routes now accept folderId, and the internal file/manage tool adds read (multi-file + canonical ID support) and move plus improved path handling.

Refactors several mutation routes to orchestration-layer helpers with consistent error handling. Credentials update/delete, folder create/update, workflow create/update/restore, schedule job create/update/delete, MCP server/workflow-server/tool CRUD, and table/knowledge restore now call perform* orchestration functions and map validation/not_found/conflict/forbidden to HTTP statuses; MCP DELETE gains focused tests.

Behavioral tweaks and small UX/data updates. File parse endpoint can pass custom headers when fetching external URLs (with test coverage); CloudWatch mute/unmute switches from enabling/disabling alarm actions to creating/deleting mute rules with scheduled duration; landing/workspace modals add ModalDescription for accessibility; integrations metadata updates file_v3 → file_v4 (adds Fetch op) and icon mapping; workflow execution allows client sessions to supply an executionId; .deepsec/ is added to .gitignore.

^{Reviewed by Cursor Bugbot for commit c403faf. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit c403faf. Configure here.}

[cursor]

Folder POST tests missing performCreateFolder mock setup

Medium Severity

The folder route POST handler now delegates to performCreateFolder, but the test never configures mockPerformCreateFolder (it's a bare vi.fn() returning undefined). The mockInsert throw on line 494 won't fire since the route no longer calls db.insert directly. Instead, performCreateFolder returns undefined, causing a TypeError on result.success. The caught error then logs 'Error creating folder:', not the expected 'Failed to create workflow folder' on line 509, making this assertion always fail. The same missing mock affects all other POST tests in this file (trim, default color, sort order).

 

^{Reviewed by Cursor Bugbot for commit c403faf. Configure here.}

[cursor]

mcpOrchestrationStatus missing validation and conflict error codes

Low Severity

mcpOrchestrationStatus only maps 'forbidden', 'bad_gateway', and 'not_found' error codes to HTTP statuses, defaulting everything else to 500. The standard OrchestrationErrorCode type includes 'validation' and 'conflict', which would both incorrectly return HTTP 500 instead of 400 or 409. The workflow MCP server routes handle these codes correctly inline, but the regular MCP server routes rely on this shared helper, creating an inconsistency.

Additional Locations (1)

• apps/sim/app/api/mcp/servers/route.ts#L100-L106

 

^{Reviewed by Cursor Bugbot for commit c403faf. Configure here.}