fix(managed-agent): address MR feedback (decrypt escape, cancel, requires_action, public defaults)

Four fixes to PR #5769 review comments.

- `getDecryptedApiKey` throws when stored ciphertext cannot be decrypted
  (typically after an `ENCRYPTION_KEY` rotation). Wrapped the call in the
  tool's error-handling path so the failure returns the tool's declared
  `{success:false, output:{}, error:'...'}` shape with an actionable
  message pointing at Settings → Managed Agents → rotate, rather than an
  unhandled promise rejection.

- Added the workflow's abort signal to `_context.abortSignal` on the
  `directExecution` path in `executeTool`, so any tool that wants to
  propagate cancellation can. This is opt-in — existing tools are
  unaffected.
- Read the signal in `run_session.server.ts` and thread it into
  `createSession`, `sendUserMessage`, `openSessionStream`,
  `readSSEEvents`, and `listEventsAfter`. Every long-lived HTTP hop
  now cancels cleanly.
- Guard all loop entrances with `signal?.aborted` and translate any
  abort-caused exception into a clean `{success:false, error:'aborted'}`
  response — no scary stack traces on cancel.

- Server-side / vault-backed MCP tools legitimately hold the session in
  `requires_action` with no client-visible events until the tool
  finishes. My previous logic returned a terminal error on the first
  empty `listEventsAfter` catch-up, failing those workflows before the
  agent could complete.
- New policy: `requires_action` idle is NEVER terminal by itself. If
  the outer reconnect loop finds no new events, back off (500ms,
  doubling to 5s max) and re-poll `listEventsAfter`. Only fail after a
  hard `MAX_REQUIRES_ACTION_WAIT_MS` cap (~5 min) — with a clear error
  message — or on an explicit `session.status_terminated` /
  `session.error`.
- `EventState` gains `requiresActionEnteredAt` (first entry into the
  busy stretch) and `currentBackoffMs`; both reset when the session
  makes progress (non-empty catch-up). Reconnect ceiling raised to 60
  since the loop now sleeps between polls.

- Deleted `NEXT_PUBLIC_MANAGED_AGENT_SELF_HOSTED_DEFAULTS` — any
  deployer who accidentally seeded a token into the JSON would leak it
  to every browser via the client bundle.
- Replaced with server-only `MANAGED_AGENT_SELF_HOSTED_DEFAULTS` +
  `GET /api/managed-agent-defaults` route that returns the parsed
  rows. Values never enter the client bundle at build time.
- Extended the `Table` sub-block component with an optional
  `fetchDefaultRows` async prop (mirrors the `fetchOptions` pattern
  used by comboboxes). The block config points at
  `fetchManagedAgentSelfHostedDefaults` in `subblock-options.ts`,
  which calls the new API route via `requestJson(contract, ...)`.
- Removed the deleted function's tests; added coverage for the new
  API route (`app/api/managed-agent-defaults/route.test.ts` — 7 tests).
- Updated `.env.example` docs to make the safety property explicit.

Verified: 86 tests pass across the 6 managed-agent test files. Pre-existing
tsc errors (integration-tag enum, environments-route type mismatch, etc.)
are unchanged.

Author: Ricardo DeMatos

apps/sim/.env.example

@@ -64,7 +64,7 @@ API_ENCRYPTION_KEY=your_api_encryption_key # Use `openssl rand -hex 32` to gener
 # LITELLM_API_KEY=                       # Optional bearer token if your LiteLLM proxy requires auth
 # FIREWORKS_API_KEY=                     # Optional Fireworks AI API key for model listing
 # NEXT_PUBLIC_BEDROCK_DEFAULT_CREDENTIALS=true  # Set when using AWS default credential chain (IAM roles, ECS task roles, IRSA). Hides credential fields in Agent block UI.
-# NEXT_PUBLIC_MANAGED_AGENT_SELF_HOSTED_DEFAULTS='{"SOURCE_TYPE":"git","SOURCE_REF":"main"}'  # JSON object of default session-metadata rows seeded into fresh Claude Managed Agents (self-hosted) blocks. Deployment-specific; keys map to whatever env vars your self-hosted agent sandbox reads. Absent = empty table.
+# MANAGED_AGENT_SELF_HOSTED_DEFAULTS='{"SOURCE_TYPE":"git","SOURCE_REF":"main"}'  # Server-only JSON object of default session-metadata rows seeded into fresh Claude Managed Agents (self-hosted) blocks. Deployment-specific; keys map to whatever env vars your self-hosted agent sandbox reads. Absent = empty table. Values are served via GET /api/managed-agent-defaults and never inlined into the client bundle — safe to include values that should not leak to the browser.
 # NEXT_PUBLIC_MANAGED_AGENT_SELF_HOSTED_MEMORY_ENABLED=true  # Reveal Memory Store + Memory Access fields on the Claude Managed Agents (self-hosted) block. Off by default: Claude self-hosted environments do not currently support the memory-store resource attach on the session API. Enable only if your self-hosted agent sandbox implements memory attach on its side.
 # AZURE_OPENAI_ENDPOINT=                        # Azure OpenAI endpoint (hides field in UI when set alongside NEXT_PUBLIC_AZURE_CONFIGURED)
 # AZURE_OPENAI_API_KEY=                         # Azure OpenAI API key

apps/sim/app/api/managed-agent-defaults/route.test.ts

@@ -0,0 +1,84 @@
+/**
+ * @vitest-environment node
+ */
+import { createMockRequest } from '@sim/testing'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { envState } = vi.hoisted(() => ({
+  envState: { MANAGED_AGENT_SELF_HOSTED_DEFAULTS: undefined as string | undefined },
+}))
+
+vi.mock('@/lib/core/config/env', () => ({
+  env: new Proxy({} as Record<string, unknown>, {
+    get: (_target, key) => (envState as Record<string, unknown>)[key as string],
+  }),
+}))
+
+import { GET } from '@/app/api/managed-agent-defaults/route'
+
+describe('GET /api/managed-agent-defaults', () => {
+  beforeEach(() => {
+    envState.MANAGED_AGENT_SELF_HOSTED_DEFAULTS = undefined
+  })
+
+  it('returns an empty list when the env var is unset', async () => {
+    const res = await GET(createMockRequest('GET'))
+    expect(res.status).toBe(200)
+    const body = await res.json()
+    expect(body.selfHosted).toEqual([])
+  })
+
+  it('returns an empty list for whitespace-only env values', async () => {
+    envState.MANAGED_AGENT_SELF_HOSTED_DEFAULTS = '   '
+    const body = await (await GET(createMockRequest('GET'))).json()
+    expect(body.selfHosted).toEqual([])
+  })
+
+  it('returns an empty list on invalid JSON', async () => {
+    envState.MANAGED_AGENT_SELF_HOSTED_DEFAULTS = '{not-json'
+    const body = await (await GET(createMockRequest('GET'))).json()
+    expect(body.selfHosted).toEqual([])
+  })
+
+  it('returns an empty list on a JSON array (must be an object)', async () => {
+    envState.MANAGED_AGENT_SELF_HOSTED_DEFAULTS = '["a","b"]'
+    const body = await (await GET(createMockRequest('GET'))).json()
+    expect(body.selfHosted).toEqual([])
+  })
+
+  it('coerces a valid JSON object into table-row shape', async () => {
+    envState.MANAGED_AGENT_SELF_HOSTED_DEFAULTS = JSON.stringify({
+      FOO: 'bar',
+      BAZ: 'qux',
+    })
+    const body = await (await GET(createMockRequest('GET'))).json()
+    expect(body.selfHosted).toEqual([
+      { cells: { Key: 'FOO', Value: 'bar' } },
+      { cells: { Key: 'BAZ', Value: 'qux' } },
+    ])
+  })
+
+  it('drops entries with a blank key', async () => {
+    envState.MANAGED_AGENT_SELF_HOSTED_DEFAULTS = JSON.stringify({
+      '': 'dropped',
+      '   ': 'also dropped',
+      keep: 'yes',
+    })
+    const body = await (await GET(createMockRequest('GET'))).json()
+    expect(body.selfHosted).toEqual([{ cells: { Key: 'keep', Value: 'yes' } }])
+  })
+
+  it('coerces non-string values to their string form', async () => {
+    envState.MANAGED_AGENT_SELF_HOSTED_DEFAULTS = JSON.stringify({
+      A: 1,
+      B: true,
+      C: null,
+    })
+    const body = await (await GET(createMockRequest('GET'))).json()
+    expect(body.selfHosted).toEqual([
+      { cells: { Key: 'A', Value: '1' } },
+      { cells: { Key: 'B', Value: 'true' } },
+      { cells: { Key: 'C', Value: '' } },
+    ])
+  })
+})

apps/sim/app/api/managed-agent-defaults/route.ts

@@ -0,0 +1,52 @@
+import { createLogger } from '@sim/logger'
+import { type NextRequest, NextResponse } from 'next/server'
+import { env } from '@/lib/core/config/env'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+
+const logger = createLogger('ManagedAgentDefaultsAPI')
+
+interface DefaultRow {
+  cells: Record<string, string>
+}
+
+/**
+ * Read the JSON defaults for the Claude Managed Agents (self-hosted)
+ * block's Session parameters table from the SERVER-ONLY env var
+ * `MANAGED_AGENT_SELF_HOSTED_DEFAULTS`. Kept behind an API route (rather
+ * than a `NEXT_PUBLIC_*` var) so seeded values never leak into the
+ * client bundle at build time — deployers can safely put anything the
+ * self-hosted agent sandbox reads without inadvertently shipping it to
+ * the browser.
+ */
+function readSelfHostedDefaults(): DefaultRow[] {
+  const raw = env.MANAGED_AGENT_SELF_HOSTED_DEFAULTS
+  if (typeof raw !== 'string' || raw.trim().length === 0) return []
+  try {
+    const parsed = JSON.parse(raw)
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) return []
+    const rows: DefaultRow[] = []
+    for (const [key, value] of Object.entries(parsed as Record<string, unknown>)) {
+      const k = typeof key === 'string' ? key.trim() : ''
+      if (!k) continue
+      const v = value == null ? '' : typeof value === 'string' ? value : String(value)
+      rows.push({ cells: { Key: k, Value: v } })
+    }
+    return rows
+  } catch (error) {
+    logger.warn('Failed to parse MANAGED_AGENT_SELF_HOSTED_DEFAULTS', { error })
+    return []
+  }
+}
+
+/**
+ * GET /api/managed-agent-defaults
+ *
+ * Returns the deployer-configured default rows the block picker seeds
+ * into a fresh Claude Managed Agents (self-hosted) block. No auth
+ * required — the response contains only default keys the deployer
+ * chose to expose to their workflow authors; there is no per-user or
+ * per-workspace state.
+ */
+export const GET = withRouteHandler(async (_request: NextRequest) => {
+  return NextResponse.json({ selfHosted: readSelfHostedDefaults() }, { status: 200 })
+})

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/table/table.tsx

@@ -31,6 +31,15 @@ interface TableProps {
    * missing columns fall back to `""`. Existing values are never overwritten.
    */
   defaultRows?: Array<{ cells: Record<string, string> }>
+  /**
+   * Optional async fetcher for seed rows — used when the block's default
+   * rows come from a server-side source (e.g. deployer-configured env vars
+   * read via an API route). Called once on first mount when the store is
+   * empty. If the fetcher rejects or returns an empty array, falls back to
+   * `defaultRows`, then to a single empty row. Same overwrite rules as
+   * `defaultRows`: existing store values are never touched.
+   */
+  fetchDefaultRows?: () => Promise<Array<{ cells: Record<string, string> }>>
 }
 
 interface WorkflowTableRow {
@@ -221,6 +230,7 @@ export function Table({
   previewValue,
   disabled = false,
   defaultRows,
+  fetchDefaultRows,
 }: TableProps) {
   const activeSearchTarget = useActiveSearchTarget()
   const params = useParams()
@@ -256,22 +266,47 @@ export function Table({
 
   /**
    * Initialize the table when the component mounts and the store value is
-   * missing/empty. If the caller supplied `defaultRows`, seed those rows
-   * (any missing columns default to `""`); otherwise start with a single
-   * empty row.
+   * missing/empty. Precedence:
+   *   1. `fetchDefaultRows` (async) — used when defaults live server-side
+   *      (e.g. deployer env-var read via an API route).
+   *   2. `defaultRows` (sync) — static seeds declared on the block config.
+   *   3. Single empty row — the pre-existing behavior.
+   * Existing store values are never touched.
    */
   useEffect(() => {
-    if (!isPreview && !disabled && (!Array.isArray(storeValue) || storeValue.length === 0)) {
+    if (isPreview || disabled) return
+    if (Array.isArray(storeValue) && storeValue.length > 0) return
+    let cancelled = false
+    const seedWith = (rows: Array<{ cells: Record<string, string> }> | undefined) => {
+      if (cancelled) return
       const seedRows: WorkflowTableRow[] =
-        Array.isArray(defaultRows) && defaultRows.length > 0
-          ? defaultRows.map((row) => ({
+        Array.isArray(rows) && rows.length > 0
+          ? rows.map((row) => ({
               id: generateId(),
               cells: { ...emptyCellsTemplate, ...(row.cells ?? {}) },
             }))
           : [{ id: generateId(), cells: { ...emptyCellsTemplate } }]
       setStoreValue(seedRows)
     }
-  }, [isPreview, disabled, storeValue, setStoreValue, emptyCellsTemplate, defaultRows])
+    if (fetchDefaultRows) {
+      fetchDefaultRows()
+        .then((rows) => seedWith(rows.length > 0 ? rows : defaultRows))
+        .catch(() => seedWith(defaultRows))
+    } else {
+      seedWith(defaultRows)
+    }
+    return () => {
+      cancelled = true
+    }
+  }, [
+    isPreview,
+    disabled,
+    storeValue,
+    setStoreValue,
+    emptyCellsTemplate,
+    defaultRows,
+    fetchDefaultRows,
+  ])
 
   // Ensure value is properly typed and initialized
   const rows = useMemo(() => {

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/sub-block.tsx

@@ -754,6 +754,7 @@ function SubBlockComponent({
                 ? (config.defaultValue as Array<{ cells: Record<string, string> }>)
                 : undefined
             }
+            fetchDefaultRows={config.fetchDefaultRows}
           />
         )
 

apps/sim/blocks/blocks/managed_agent_self_hosted.test.ts

@@ -5,7 +5,6 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 const { envState } = vi.hoisted(() => ({
   envState: {
-    NEXT_PUBLIC_MANAGED_AGENT_SELF_HOSTED_DEFAULTS: undefined as string | undefined,
     NEXT_PUBLIC_MANAGED_AGENT_SELF_HOSTED_MEMORY_ENABLED: undefined as string | undefined,
   },
 }))
@@ -20,75 +19,12 @@ vi.mock('@/lib/managed-agents/subblock-options', () => ({
   fetchManagedAgentAgentOptions: vi.fn(),
   fetchManagedAgentConnectionOptions: vi.fn(),
   fetchManagedAgentMemoryStoreOptions: vi.fn(),
+  fetchManagedAgentSelfHostedDefaults: vi.fn(),
   fetchManagedAgentSelfHostedEnvironmentOptions: vi.fn(),
   fetchManagedAgentVaultOptions: vi.fn(),
 }))
 
-import {
-  isSelfHostedMemoryEnabled,
-  readSessionMetadataDefaults,
-} from '@/blocks/blocks/managed_agent_self_hosted'
-
-describe('readSessionMetadataDefaults', () => {
-  beforeEach(() => {
-    envState.NEXT_PUBLIC_MANAGED_AGENT_SELF_HOSTED_DEFAULTS = undefined
-  })
-
-  it('returns [] when the env var is unset', () => {
-    envState.NEXT_PUBLIC_MANAGED_AGENT_SELF_HOSTED_DEFAULTS = undefined
-    expect(readSessionMetadataDefaults()).toEqual([])
-  })
-
-  it('returns [] when the env var is empty / whitespace-only', () => {
-    envState.NEXT_PUBLIC_MANAGED_AGENT_SELF_HOSTED_DEFAULTS = ''
-    expect(readSessionMetadataDefaults()).toEqual([])
-    envState.NEXT_PUBLIC_MANAGED_AGENT_SELF_HOSTED_DEFAULTS = '   '
-    expect(readSessionMetadataDefaults()).toEqual([])
-  })
-
-  it('returns [] on invalid JSON', () => {
-    envState.NEXT_PUBLIC_MANAGED_AGENT_SELF_HOSTED_DEFAULTS = '{not json'
-    expect(readSessionMetadataDefaults()).toEqual([])
-  })
-
-  it('returns [] on a JSON array (must be an object of key/value pairs)', () => {
-    envState.NEXT_PUBLIC_MANAGED_AGENT_SELF_HOSTED_DEFAULTS = '["a","b"]'
-    expect(readSessionMetadataDefaults()).toEqual([])
-  })
-
-  it('coerces a valid JSON object into `{cells: {Key, Value}}` rows', () => {
-    envState.NEXT_PUBLIC_MANAGED_AGENT_SELF_HOSTED_DEFAULTS = JSON.stringify({
-      FOO: 'bar',
-      BAZ: 'qux',
-    })
-    expect(readSessionMetadataDefaults()).toEqual([
-      { cells: { Key: 'FOO', Value: 'bar' } },
-      { cells: { Key: 'BAZ', Value: 'qux' } },
-    ])
-  })
-
-  it('drops entries with a blank key', () => {
-    envState.NEXT_PUBLIC_MANAGED_AGENT_SELF_HOSTED_DEFAULTS = JSON.stringify({
-      '': 'dropped',
-      '   ': 'also dropped',
-      keep: 'yes',
-    })
-    expect(readSessionMetadataDefaults()).toEqual([{ cells: { Key: 'keep', Value: 'yes' } }])
-  })
-
-  it('coerces non-string values to their string form', () => {
-    envState.NEXT_PUBLIC_MANAGED_AGENT_SELF_HOSTED_DEFAULTS = JSON.stringify({
-      A: 1,
-      B: true,
-      C: null,
-    })
-    expect(readSessionMetadataDefaults()).toEqual([
-      { cells: { Key: 'A', Value: '1' } },
-      { cells: { Key: 'B', Value: 'true' } },
-      { cells: { Key: 'C', Value: '' } },
-    ])
-  })
-})
+import { isSelfHostedMemoryEnabled } from '@/blocks/blocks/managed_agent_self_hosted'
 
 describe('isSelfHostedMemoryEnabled', () => {
   beforeEach(() => {

apps/sim/blocks/blocks/managed_agent_self_hosted.ts

@@ -4,6 +4,7 @@ import {
   fetchManagedAgentAgentOptions,
   fetchManagedAgentConnectionOptions,
   fetchManagedAgentMemoryStoreOptions,
+  fetchManagedAgentSelfHostedDefaults,
   fetchManagedAgentSelfHostedEnvironmentOptions,
   fetchManagedAgentVaultOptions,
 } from '@/lib/managed-agents/subblock-options'
@@ -57,36 +58,6 @@ const memorySubBlocks: SubBlockConfig[] = isSelfHostedMemoryEnabled()
     ]
   : []
 
-/**
- * Read the JSON defaults for the self-hosted metadata table from
- * `NEXT_PUBLIC_MANAGED_AGENT_SELF_HOSTED_DEFAULTS`. Kept out of source
- * so deployers can seed the block with the keys their self-hosted
- * agent sandbox reads, without the values living in the repo.
- *
- * Expected shape: a JSON object `{"KEY": "VALUE", ...}`. Non-string
- * values are coerced to their string form. Anything invalid (missing,
- * unparseable, non-object) falls back to an empty seed — the block
- * still renders, users see a single blank row.
- */
-export function readSessionMetadataDefaults(): Array<{ cells: Record<string, string> }> {
-  const raw = env.NEXT_PUBLIC_MANAGED_AGENT_SELF_HOSTED_DEFAULTS
-  if (typeof raw !== 'string' || raw.trim().length === 0) return []
-  try {
-    const parsed = JSON.parse(raw)
-    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) return []
-    const rows: Array<{ cells: Record<string, string> }> = []
-    for (const [key, value] of Object.entries(parsed)) {
-      const k = typeof key === 'string' ? key.trim() : ''
-      if (!k) continue
-      const v = value == null ? '' : typeof value === 'string' ? value : String(value)
-      rows.push({ cells: { Key: k, Value: v } })
-    }
-    return rows
-  } catch {
-    return []
-  }
-}
-
 /**
  * Claude Managed Agents block — self-hosted variant.
  *
@@ -181,15 +152,16 @@ export const ManagedAgentSelfHostedBlock: BlockConfig = {
       // Session metadata forwarded to the self-hosted agent sandbox as
       // env vars. The set of supported keys is deployment-specific and
       // lives with the deployer, not in this repo. Seed rows come from
-      // `NEXT_PUBLIC_MANAGED_AGENT_SELF_HOSTED_DEFAULTS` (see
-      // `readSessionMetadataDefaults` above); leave empty to start with
-      // a single blank row.
+      // the server-only `MANAGED_AGENT_SELF_HOSTED_DEFAULTS` env var,
+      // fetched via `/api/managed-agent-defaults` — the values never
+      // enter the client bundle, so deployers can safely include
+      // anything their sandbox reads.
       id: 'sessionParameters',
       title: 'Session parameters',
       type: 'table',
       required: false,
       columns: ['Key', 'Value'],
-      defaultValue: readSessionMetadataDefaults(),
+      fetchDefaultRows: fetchManagedAgentSelfHostedDefaults,
       description:
         'Key/value pairs forwarded to the self-hosted agent sandbox as environment variables. Supported keys depend on your deployment — consult your deployment docs. Value cells support <block.output> / <var.name> references.',
     },

apps/sim/blocks/types.ts

@@ -285,6 +285,13 @@ export interface SubBlockConfig {
         }
       })
   defaultValue?: string | number | boolean | Record<string, unknown> | Array<unknown>
+  /**
+   * Optional async fetcher for a `table` subblock's initial rows — used
+   * when defaults come from a server-side source (e.g. deployer-configured
+   * env vars) and must not be inlined into the client bundle. Called once
+   * on first mount when the store is empty. See `Table.fetchDefaultRows`.
+   */
+  fetchDefaultRows?: () => Promise<Array<{ cells: Record<string, string> }>>
   options?:
     | {
         label: string