Merge remote-tracking branch 'origin/staging' into improvement/fork-workspace

# Conflicts:
#	apps/sim/app/workspace/[workspaceId]/settings/[section]/settings.tsx
#	apps/sim/lib/workspaces/fork/remap/remap-references.ts
#	scripts/check-api-validation-contracts.ts

Author: icecrasher321

.claude/commands/add-trigger.md

@@ -374,7 +374,7 @@ export const {service}PollingHandler: PollingProviderHandler = {
 
     try {
       // For OAuth services:
-      const accessToken = await resolveOAuthCredential(webhookData, '{service}', requestId, logger)
+      const accessToken = await resolveOAuthCredential(webhookData, '{service}', requestId)
       const config = webhookData.providerConfig as unknown as {Service}WebhookConfig
 
       // First poll: seed state, emit nothing
@@ -421,7 +421,7 @@ export const {service}PollingTrigger: TriggerConfig = {
   polling: true,               // REQUIRED — routes to polling infrastructure
 
   subBlocks: [
-    { id: 'triggerCredentials', type: 'oauth-input', title: 'Credentials', serviceId: '{service}', requiredScopes: [], required: true, mode: 'trigger', supportsCredentialSets: true },
+    { id: 'triggerCredentials', type: 'oauth-input', title: 'Credentials', serviceId: '{service}', requiredScopes: [], required: true, mode: 'trigger' },
     // ... service-specific config fields (dropdowns, inputs, switches) ...
     { id: 'triggerInstructions', type: 'text', title: 'Setup Instructions', hideFromPreview: true, mode: 'trigger', defaultValue: '...' },
   ],

.claude/rules/sim-queries.md

@@ -34,7 +34,7 @@ Next.js rewrites **every** export of a `'use client'` module into a *client refe
 So any **query-key factory, standalone `requestJson` fetcher, mapper, or constant** that a server module imports must live in a **non-`'use client'`** module:
 
 - key factories → `hooks/queries/utils/<entity>-keys.ts` (see `folder-keys.ts`, `table-keys.ts`, `credential-keys.ts`)
-- standalone fetchers/mappers → `hooks/queries/utils/fetch-*.ts` / `*-list-query.ts` (see `fetch-workflow-envelope.ts`, `fetch-credential-set.ts`)
+- standalone fetchers/mappers → `hooks/queries/utils/fetch-*.ts` / `*-list-query.ts` (see `fetch-workflow-envelope.ts`, `fetch-workspace-credentials.ts`)
 
 The `'use client'` hook module then imports these back for its hooks. **Never** define a server-imported factory/fetcher directly in a `'use client'` hooks file — it crashes SSR (this caused the tables-page crash). Enforced for prefetch/route/trigger/block files by `scripts/check-client-boundary-imports.ts` (`bun run check:client-boundary`, run in CI). Escape hatch for a genuinely browser-only path: `// client-boundary-allow: <reason>` on the line above the import.
 

.claude/rules/sim-settings-pages.md

@@ -117,7 +117,7 @@ pairing is:
 This is not a stylistic guess — it is the tokenized form of the literal-pixel
 pairing (`text-[14px] text-[var(--text-body)]` / `text-[12px]
 text-[var(--text-muted)]`) already used for this exact row shape across
-`member-list.tsx`, `api-keys.tsx`, `mcp.tsx`, `billing.tsx`, `credential-sets.tsx`,
+`member-list.tsx`, `api-keys.tsx`, `mcp.tsx`, `billing.tsx`,
 `workflow-mcp-servers.tsx`, and others — keep new rows consistent with it rather
 than inventing a new size pairing.
 
@@ -203,7 +203,7 @@ changes" modal:
 ## Detail sub-views
 
 A drill-down view reached from a list row (selected MCP server, workflow MCP
-server, credential set, permission group, retention policy) renders through
+server, permission group, retention policy) renders through
 `SettingsPanel` like a list page: pass `back={{ text, icon: ArrowLeft, onSelect }}`
 for the left back chip, `title` (the entity name), and the header `actions`, then
 render the body. Do NOT hand-roll a shell or header bar; a tab bar renders as the

.cursor/commands/add-trigger.md

@@ -369,7 +369,7 @@ export const {service}PollingHandler: PollingProviderHandler = {
 
     try {
       // For OAuth services:
-      const accessToken = await resolveOAuthCredential(webhookData, '{service}', requestId, logger)
+      const accessToken = await resolveOAuthCredential(webhookData, '{service}', requestId)
       const config = webhookData.providerConfig as unknown as {Service}WebhookConfig
 
       // First poll: seed state, emit nothing
@@ -416,7 +416,7 @@ export const {service}PollingTrigger: TriggerConfig = {
   polling: true,               // REQUIRED — routes to polling infrastructure
 
   subBlocks: [
-    { id: 'triggerCredentials', type: 'oauth-input', title: 'Credentials', serviceId: '{service}', requiredScopes: [], required: true, mode: 'trigger', supportsCredentialSets: true },
+    { id: 'triggerCredentials', type: 'oauth-input', title: 'Credentials', serviceId: '{service}', requiredScopes: [], required: true, mode: 'trigger' },
     // ... service-specific config fields (dropdowns, inputs, switches) ...
     { id: 'triggerInstructions', type: 'text', title: 'Setup Instructions', hideFromPreview: true, mode: 'trigger', defaultValue: '...' },
   ],

.gitignore

@@ -96,3 +96,7 @@ i18n.cache
 
 # Personal Cursor Skills
 .cursor/skills/ask-sim/
+
+# Python (apps/pii tests/tooling)
+__pycache__/
+.pytest_cache/