v0.9.28: mship contract updates, library

Author: waleedlatif1

AGENTS.md

@@ -42,7 +42,7 @@
     "@xterm/headless": "6.0.0",
     "electron-updater": "6.8.9",
     "micromatch": "4.0.8",
-    "safe-regex2": "5.1.0",
+    "safe-regex2": "5.1.2",
     "pdf-lib": "1.17.1"
   },
   "devDependencies": {
@@ -51,19 +51,19 @@
     "@sim/emcn": "workspace:*",
     "@sim/tsconfig": "workspace:*",
     "@types/micromatch": "4.0.10",
-    "@types/node": "24.2.1",
+    "@types/node": "24.19.2",
     "@types/react": "^19",
     "@types/react-dom": "^19",
     "electron": "43.5.0",
     "electron-builder": "26.15.3",
-    "esbuild": "0.28.1",
+    "esbuild": "0.28.2",
     "jsdom": "^26.0.0",
-    "postcss": "^8",
+    "postcss": "^8.5.30",
     "postcss-load-config": "6.0.1",
     "postgres": "^3.4.5",
     "react": "19.2.4",
     "react-dom": "19.2.4",
     "typescript": "^7.0.2",
-    "vitest": "^5.0.1"
+    "vitest": "^5.0.4"
   }
 }

AGENTS.md

@@ -27,9 +27,9 @@
     "@sim/logger": "workspace:*",
     "@sim/utils": "workspace:*",
     "@sim/workflow-renderer": "workspace:*",
-    "@xyflow/react": "12.11.3",
+    "@xyflow/react": "12.12.0",
     "class-variance-authority": "^0.7.1",
-    "drizzle-orm": "^0.45.2",
+    "drizzle-orm": "^0.45.4",
     "fumadocs-core": "16.8.5",
     "fumadocs-mdx": "14.3.2",
     "fumadocs-openapi": "10.8.1",
@@ -39,21 +39,22 @@
     "react": "19.2.4",
     "react-dom": "19.2.4",
     "remark-breaks": "^4.0.0",
-    "shiki": "4.3.1",
+    "remark-gfm": "4.0.1",
+    "shiki": "4.5.0",
+    "streamdown": "2.5.0",
     "framer-motion": "^12.5.0",
     "zod": "4.3.6"
   },
   "devDependencies": {
     "@sim/tsconfig": "workspace:*",
-    "@tailwindcss/postcss": "^4.0.12",
-    "@types/node": "24.2.1",
-    "@types/react": "^19.1.2",
-    "@types/react-dom": "^19.0.4",
-    "gray-matter": "^4.0.3",
-    "jsdom": "^26.0.0",
-    "postcss": "^8.5.3",
-    "tailwindcss": "^4.0.12",
+    "@tailwindcss/postcss": "^4.3.3",
+    "@types/node": "24.19.2",
+    "@types/react": "^19",
+    "@types/react-dom": "^19",
+    "gray-matter": "4.0.3",
+    "postcss": "^8.5.30",
+    "tailwindcss": "^4.3.3",
     "typescript": "^7.0.2",
-    "vitest": "^5.0.1"
+    "vitest": "^5.0.4"
   }
 }

apps/desktop/package.json

@@ -32,21 +32,21 @@
     "@sim/workflow-persistence": "workspace:*",
     "@sim/workflow-types": "workspace:*",
     "@socket.io/redis-adapter": "8.3.0",
-    "drizzle-orm": "^0.45.2",
-    "lib0": "0.2.117",
+    "drizzle-orm": "^0.45.4",
+    "lib0": "0.2.119",
     "postgres": "^3.4.5",
     "redis": "5.10.0",
-    "socket.io": "^4.8.1",
+    "socket.io": "^4.8.4",
     "y-protocols": "1.0.7",
-    "yjs": "13.6.31",
+    "yjs": "13.6.33",
     "zod": "4.3.6"
   },
   "devDependencies": {
     "@sim/testing": "workspace:*",
     "@sim/tsconfig": "workspace:*",
-    "@types/node": "24.2.1",
-    "socket.io-client": "4.8.1",
+    "@types/node": "24.19.2",
+    "socket.io-client": "4.8.4",
     "typescript": "^7.0.2",
-    "vitest": "^5.0.1"
+    "vitest": "^5.0.4"
   }
 }

apps/docs/package.json

@@ -9,6 +9,7 @@ import { LIBRARY_SECTION } from '@/lib/library/seo'
 import { COMPARISON_SECTIONS, getFactGroup } from '@/app/(landing)/comparisons/comparison-sections'
 import { BrandIconTile, SimIconTile } from '@/app/(landing)/comparisons/components/brand-icon-tile'
 import { ComparisonCards } from '@/app/(landing)/comparisons/components/comparison-cards'
+import { ComparisonLinkRow } from '@/app/(landing)/comparisons/components/comparison-link-row'
 import { ComparisonTable } from '@/app/(landing)/comparisons/components/comparison-table'
 import { ProseText } from '@/app/(landing)/comparisons/components/prose-text'
 import { getLibraryPostsForCompetitor } from '@/app/(landing)/comparisons/library-links'
@@ -91,6 +92,7 @@ export default async function ComparisonProviderPage({
   const relatedPosts = await getLibraryPostsForCompetitor(competitor)
   const verdict = buildBottomLine(competitor)
   const CompetitorIcon = competitor.brand?.icon
+  const otherCompetitors = ALL_COMPETITORS.filter((other) => other.id !== competitor.id)
 
   const breadcrumbJsonLd = {
     '@context': 'https://schema.org',
@@ -378,6 +380,22 @@ export default async function ComparisonProviderPage({
               </>
             ) : null}
 
+            <section aria-labelledby='more-comparisons-heading'>
+              <h2
+                id='more-comparisons-heading'
+                className='px-6 pt-10 pb-6 text-[var(--text-primary)] text-xl leading-[100%] tracking-[-0.02em] lg:text-2xl'
+              >
+                More comparisons
+              </h2>
+              <ul className='grid grid-cols-1 gap-px border-[var(--border)] border-y bg-[var(--border)] lg:grid-cols-2'>
+                {otherCompetitors.map((other) => (
+                  <li key={other.id} className='bg-[var(--bg)] lg:odd:last:col-span-2'>
+                    <ComparisonLinkRow competitor={other} />
+                  </li>
+                ))}
+              </ul>
+            </section>
+
             <section aria-labelledby='faq-heading' className='px-6 py-10'>
               <h2
                 id='faq-heading'

apps/realtime/package.json

@@ -95,9 +95,11 @@ export interface ComparisonVerdict {
 
 export function buildBottomLine(competitor: CompetitorProfile): ComparisonVerdict {
   const strength = competitor.standoutFeatures[0]
-  const chooseCompetitor = strength
-    ? `Choose ${competitor.name} if you specifically need ${lowercaseFirst(strength.title)}: ${strength.description}`
-    : `Choose ${competitor.name} if its specific strengths, documented above, matter more to your team than an AI-native, self-hostable workspace.`
+  const chooseCompetitor =
+    competitor.chooseCompetitorAnswer ??
+    (strength
+      ? `Choose ${competitor.name} if you specifically need ${lowercaseFirst(strength.title)}: ${strength.description}`
+      : `Choose ${competitor.name} if its specific strengths, documented above, matter more to your team than an AI-native, self-hostable workspace.`)
 
   return {
     chooseSim: `Choose Sim if you want an open-source, self-hostable AI workspace that treats AI agents as first-class citizens: native multi-LLM support, real-time multiplayer editing, human-in-the-loop approvals, and, on the Enterprise plan, environment promotion (dev/qa/prod) and governance (SSO, credential-level permissions, audit logs) built in rather than bolted on.`,

apps/sim/app/(landing)/comparisons/[provider]/page.tsx

@@ -4,7 +4,7 @@ import { useState } from 'react'
 import { usePathname } from 'next/navigation'
 import type { ThemeProviderProps } from 'next-themes'
 import { ThemeProvider as NextThemesProvider } from 'next-themes'
-import { LANDING_ROUTES } from '@/lib/landing/routes'
+import { isLandingPath } from '@/lib/landing/routes'
 
 /**
  * First path segments outside the `(landing)` group whose pages pin the light
@@ -41,6 +41,8 @@ const NON_LANDING_LIGHT_SEGMENTS = [
  */
 const LIGHT_MODE_SEGMENTS: ReadonlySet<string> = new Set(NON_LANDING_LIGHT_SEGMENTS)
 
+const APP_SURFACE = { defaultTheme: 'system', storageKey: 'sim-theme' } as const
+
 /**
  * The marketing surface: the root plus every `app/(landing)` segment. These
  * pages keep their own stored theme, written only by the landing footer's
@@ -50,16 +52,8 @@ const LIGHT_MODE_SEGMENTS: ReadonlySet<string> = new Set(NON_LANDING_LIGHT_SEGME
  * every signed-in user, which would render the marketing site in the OS theme
  * and overwrite any choice the footer toggle made.
  */
-const LANDING_SEGMENTS: ReadonlySet<string> = new Set(LANDING_ROUTES)
-
-const APP_SURFACE = { defaultTheme: 'system', storageKey: 'sim-theme' } as const
 const LANDING_SURFACE = { defaultTheme: 'light', storageKey: 'sim-landing-theme' } as const
 
-function isLandingPath(pathname: string): boolean {
-  const firstSegment = pathname.split('/')[1]
-  return firstSegment === '' || LANDING_SEGMENTS.has(firstSegment)
-}
-
 export function ThemeProvider({ children, ...props }: ThemeProviderProps) {
   const pathname = usePathname()
 

apps/sim/app/(landing)/comparisons/utils.ts

@@ -49,7 +49,7 @@ const DCR_UNSUPPORTED_MESSAGE =
 /**
  * The MCP SDK throws a plain `Error` (no typed class or code) when an auth server lacks a
  * `registration_endpoint`, so this string-match is the only available signal. Pinned to
- * `@modelcontextprotocol/sdk` v1.31.0 `registerClient` (client/auth.js): "Incompatible auth
+ * `@modelcontextprotocol/sdk` v1.32.1 `registerClient` (client/auth.js): "Incompatible auth
  * server: does not support dynamic client registration". If a version bump rephrases this, the
  * 422 branch silently stops firing (users get a generic 500) — update the substring here.
  */

apps/sim/app/_shell/providers/theme-provider.tsx

@@ -15,16 +15,8 @@ const { mockVerify, mockExecuteInboxTask } = vi.hoisted(() => ({
   mockExecuteInboxTask: vi.fn(),
 }))
 
-vi.mock('svix', () => ({
-  Webhook: class {
-    private readonly secret: string
-    constructor(secret: string) {
-      this.secret = secret
-    }
-    verify(payload: string, headers: Record<string, string>) {
-      return mockVerify(this.secret, payload, headers)
-    }
-  },
+vi.mock('@sim/security/standard-webhooks', () => ({
+  verifyStandardWebhook: mockVerify,
 }))
 
 vi.mock('@/lib/core/admission/gate', () => admissionGateMock)
@@ -92,9 +84,7 @@ describe('POST /api/webhooks/agentmail', () => {
 
     mockTryAdmit.mockReturnValue({ release: mockRelease })
     mockExecuteInboxTask.mockResolvedValue(undefined)
-    mockVerify.mockImplementation(() => {
-      throw new Error('signature mismatch')
-    })
+    mockVerify.mockReturnValue({ valid: false, reason: 'no_matching_signature' })
   })
 
   it('checks the signature against only the secret the payload routes to', async () => {
@@ -106,12 +96,14 @@ describe('POST /api/webhooks/agentmail', () => {
     expect(mockEq).toHaveBeenCalledWith(schemaMock.workspace.inboxProviderId, TARGET_INBOX_ID)
     expect(dbChainMockFns.limit).toHaveBeenCalledWith(1)
     expect(mockVerify).toHaveBeenCalledTimes(1)
-    expect(mockVerify).toHaveBeenCalledWith('whsec_b', expect.any(String), expect.any(Object))
+    expect(mockVerify).toHaveBeenCalledWith(
+      expect.objectContaining({ secret: 'whsec_b', headerPrefix: 'svix' })
+    )
   })
 
   it('rejects a payload naming an inbox no workspace owns, without hashing it', async () => {
     queueTableRows(schemaMock.workspace, [])
-    mockVerify.mockReturnValue(undefined)
+    mockVerify.mockReturnValue({ valid: true })
 
     const response = await POST(
       webhookRequest(envelope({ inbox_id: 'agent-unknown@agentmail.to' }))