Merge remote-tracking branch 'origin/staging' into codex/ashby-integration-expansion

# Conflicts:
#	apps/sim/tools/generated/tool-ids.ts
#	apps/sim/tools/generated/tool-metadata.ts
#	apps/sim/tools/generated/tool-outputs.ts
#	scripts/check-tool-registry-boundary.baseline.json

Author: waleedlatif1

.agents/skills/add-permission-group-item/SKILL.md

@@ -62,21 +62,25 @@ Every export of a `'use client'` module becomes a *client reference* on the serv
 Server code runs in two runtimes with **different environments**. The app container loads the
 full env from `SIM_ENV_SECRET_ID` (Secrets Manager). Trigger.dev workers — which execute
 workflows, so every block handler and every tool call — get their env from the Trigger.dev
-dashboard, and `trigger.config.ts` syncs only `DB_APP_NAME`. The repo cannot see what the
-dashboard holds.
+dashboard; `trigger.config.ts` additionally syncs `DB_APP_NAME`, `TRIGGER_DEV_ENABLED`, and the
+`FUNCTION_EXECUTION_ENV` vars. The repo cannot see what the dashboard holds.
 
 So before replacing a worker's HTTP call to our own API with an in-process call, ask what env
 that work reads *on the app side*. Anything gated by a `require*Capability` helper is the sharp
 case: those **throw** when the variable is absent (`requireOAuthClientCapability` →
 `EnvCapabilityConfigurationError`), and the throw may be caught and reported as something
-unrelated. OAuth token refresh is the known example — moving it into the worker turns every
-expired credential into `Failed to refresh access token`, while a still-valid token hides the
-bug entirely, so it surfaces hours later and only for whoever's token lapsed first.
+unrelated — an in-worker OAuth refresh missing a provider's client pair reports every expired
+credential as `Failed to refresh access token`, while a still-valid token hides the bug until it
+lapses. The required step before such a conversion is verifying the dashboard env holds every
+variable the moved code reads (for OAuth refresh: the `OAUTH_CLIENT_CAPABILITIES` key pairs in
+`packages/deployment-config/src/env-capabilities.ts`).
 
 An in-process conversion is safe when the same work already runs in that runtime (the agent
 block has always called `executeProviderRequest` in-process, so router and evaluator joining it
-is proven), or when the caller and the callee are both the app (a route calling a lib module, an
-RSC prefetch reading the data layer). It is not safe on reasoning alone.
+is proven; connector sync refreshing OAuth tokens in-worker is what proved credential-token
+resolution could move in-process), or when the caller and the callee are both the app (a route
+calling a lib module, an RSC prefetch reading the data layer). It is not safe on reasoning
+alone — verify the env, then convert.
 
 ## Feature Organization
 

.agents/skills/validate-permission-group-item/SKILL.md

@@ -0,0 +1 @@
+../../.agents/skills/add-permission-group-item

.claude/rules/sim-architecture.md

@@ -0,0 +1 @@
+../../.agents/skills/validate-permission-group-item

.claude/skills/add-permission-group-item

@@ -94,8 +94,8 @@ fi
 # Generate schema and run database migrations
 echo "🗃️ Running database schema generation and migrations..."
 echo "Generating schema..."
-cd apps/sim
-bunx drizzle-kit generate
+cd packages/db
+bun run db:generate
 cd ../..
 
 echo "Waiting for database to be ready..."
@@ -105,8 +105,8 @@ echo "Waiting for database to be ready..."
   while [ $timeout -gt 0 ]; do
     if PGPASSWORD=postgres psql -h db -U postgres -c '\q' 2>/dev/null; then
       echo "Database is ready!"
-      cd apps/sim
-      DATABASE_URL=postgresql://postgres:postgres@db:5432/simstudio bunx drizzle-kit push
+      cd packages/db
+      DATABASE_URL=postgresql://postgres:postgres@db:5432/simstudio bun run db:push
       cd ../..
       break
     fi

.claude/skills/validate-permission-group-item

@@ -7,8 +7,8 @@
 alias sim-start="cd /workspace && bun run dev:full"
 alias sim-app="cd /workspace && bun run dev"
 alias sim-sockets="cd /workspace && bun run dev:sockets"
-alias sim-migrate="cd /workspace/apps/sim && bunx drizzle-kit push"
-alias sim-generate="cd /workspace/apps/sim && bunx drizzle-kit generate"
+alias sim-migrate="cd /workspace/packages/db && bun run db:push"
+alias sim-generate="cd /workspace/packages/db && bun run db:generate"
 alias sim-rebuild="cd /workspace && bun run build && bun run start"
 alias docs-dev="cd /workspace/apps/docs && bun run dev"
 

.devcontainer/post-create.sh

@@ -1,4 +1,4 @@
 Sim Studio
 Copyright 2026 Sim Studio
 
-This product includes software developed for the Sim project. 
+This product includes software developed for the Sim project.

.devcontainer/sim-commands.sh

@@ -50,9 +50,10 @@
     "@sim/tsconfig": "workspace:*",
     "@types/micromatch": "4.0.10",
     "@types/node": "24.2.1",
-    "electron": "43.5.0",
+    "electron": "43.4.1",
     "electron-builder": "26.15.3",
     "esbuild": "0.28.1",
+    "jsdom": "^26.0.0",
     "typescript": "^7.0.2",
     "vitest": "^4.1.0"
   }

NOTICE

@@ -54,8 +54,9 @@ body {
      nominally references; loading a webfont here would make docs the odd one out, not the
      aligned one. If the app ever wires that font up for real, add the var back in both
      places at once. */
-  --font-mono: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono",
-    "Courier New", monospace;
+  --font-mono:
+    ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", "Courier New",
+    monospace;
 }
 
 /* Pure white light mode background */
@@ -243,14 +244,16 @@ body {
 
 /* Font family utilities */
 .font-sans {
-  font-family: var(--font-geist-sans), ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont,
-    "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
+  font-family:
+    var(--font-geist-sans), ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI",
+    Roboto, "Helvetica Neue", Arial, sans-serif;
 }
 
 /* Platform UI font — Season Sans, used by the chip chrome to match the main app */
 .font-season {
-  font-family: var(--font-season), system-ui, "Segoe UI", Roboto, "Helvetica Neue", Arial,
-    "Noto Sans", sans-serif;
+  font-family:
+    var(--font-season), system-ui, "Segoe UI", Roboto, "Helvetica Neue", Arial, "Noto Sans",
+    sans-serif;
 }
 
 :root {
@@ -445,8 +448,9 @@ html #nd-sidebar button:not([aria-label*="ollapse"]):not([aria-label*="xpand"])
   padding: 5px 0.5rem !important; /* 30px tall overall — the app's chip pill, at its px-2 */
   font-weight: 400 !important;
   border-radius: 0.5rem !important; /* platform rounded-lg */
-  font-family: var(--font-geist-sans), ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont,
-    "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif !important;
+  font-family:
+    var(--font-geist-sans), ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI",
+    Roboto, "Helvetica Neue", Arial, sans-serif !important;
 }
 
 /* Sidebar text — platform --text-body */
@@ -904,8 +908,9 @@ video {
 #nd-page:has(.api-page-header) div:not(.font-mono),
 #nd-page:has(.api-page-header) label:not(.font-mono),
 #nd-page:has(.api-page-header) button:not(.font-mono) {
-  font-family: var(--font-geist-sans), ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont,
-    "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
+  font-family:
+    var(--font-geist-sans), ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI",
+    Roboto, "Helvetica Neue", Arial, sans-serif;
 }
 
 /* Method badge pills — shared background colors (page + sidebar) */