v0.6.102: support S3-compatible in object storage, GitLab code knowledgebase connector, SSO provider ID allowlist, singleton memory leak fix

[waleedlatif1]

• fix(background): recategorize user/recovery failures as errors, not trigger faults (fix(background): recategorize user/recovery failures as errors, not trigger faults #4860)
• fix(env): schema treatment of empty string (fix(env): schema treatment of empty string for redis url #4862)
• feat(storage): support S3-compatible endpoints (R2, MinIO, B2) for file storage (feat(storage): support S3-compatible endpoints (R2, MinIO, B2) for file storage #4865)
• docs(slack): remove archival reference from Download files per Slack Marketplace guidelines (docs(slack): remove archival reference from Download files #4867)
• fix(auth): link SSO sign-in to existing same-email accounts (fix(auth): link SSO sign-in to existing same-email accounts #4866)
• feat(gitlab): sync repository files (code/docs) (feat(gitlab): sync repository files (code/docs) #4864)
• fix(mothership): run client-routed workflow tools server-side in headless execution (fix(mothership): run client-routed workflow tools server-side in headless execution #4870)
• fix(dev): use globalThis for singleton state to prevent HMR memory leaks (fix(dev): use globalThis for singleton state to prevent HMR memory leaks #4869)
• fix(storage): percent-encode object key in multipart fallback URL (fix(storage): percent-encode object key in multipart fallback URL #4872)
• fix(tables): surface real error causes on cell-execution failures (diagnostics) (fix(tables): surface real error causes on cell-execution failures (diagnostics) #4868)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview, Comment	Jun 3, 2026 10:00pm

[cursor]

PR Summary

Medium Risk
Touches auth account linking, file storage endpoints (including browser-direct uploads/CORS), and background execution classification—important for production sign-in and ops alerts, but changes are mostly additive with tests for webhooks and S3 client behavior.

Overview
This release improves self-hosted production storage and SSO, expands GitLab knowledge sync, and tightens background job alerting so user/workflow failures are not misreported as platform outages.

Object storage adds first-class S3-compatible backends via S3_ENDPOINT and S3_FORCE_PATH_STYLE (R2, MinIO, B2, RustFS), with multipart completion fallbacks that percent-encode object keys, plus a new Object Storage doc page, env/Helm examples, and a File Storage section in the env reference.

SSO links an SSO login to an existing same-email account when the IdP asserts email_verified (trustEmailVerified) or the provider is listed in SSO_TRUSTED_PROVIDER_IDS (merged into trusted providers at startup). Enterprise/self-host docs add FAQ and callouts for account not linked cases.

The GitLab connector can sync repository files (branch/ref, path prefix, extension filters) alongside wiki/issues, with keyset pagination guarded by isSameOrigin on rel="next" URLs.

Webhook and schedule background runs distinguish finalized workflow/user errors (complete the run, recordException on the span) from pipeline/infra faults (re-throw). Schedules wrap error recovery so secondary DB failures do not fault the run. Logging uses describeError (and retryable flags) in several execution paths.

Headless copilot/Mothership runs client-routed tools (e.g. run_workflow) through registered server handlers when no browser is present. Dev/HMR: Redis, pub/sub, MCP, and rate-limiter singletons move to globalThis to avoid duplicate listeners leaking memory.

Smaller changes: treat empty REDIS_URL as unset in realtime; Slack docs drop archival wording for file download; BYOK uses a dedicated Fal icon.

^{Reviewed by Cursor Bugbot for commit aed4402. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

Greptile Summary

This PR bundles several independent fixes and features: S3-compatible object-storage support, GitLab repository-file syncing, SSO account-linking improvements, and singleton memory-leak fixes across server singletons.

• GitLab code connector adds a new repo content-type that pages through the repository tree with keyset pagination, fetches file content lazily via getDocument, detects binary files, and validates the cursor-embedded rel=\"next\" URL against the configured host before following it with credentials.
• S3-compatible storage adds S3_ENDPOINT / S3_FORCE_PATH_STYLE env vars, threads them into the AWS SDK client constructor, and introduces buildObjectFallbackUrl to construct the correct multipart-completion fallback URL for virtual-hosted or path-style addressing on R2, MinIO, or B2.
• Singleton HMR leak fix moves module-level singletons (Redis client, MCP connection manager, PubSub channels, rate-limiter adapter) to globalThis-keyed properties so Next.js hot-module replacement doesn't create duplicate instances.

Confidence Score: 5/5

Safe to merge — all changes are well-scoped fixes and additive features with good test coverage and no regressions in core paths.

The S3-compatible endpoint, GitLab file sync, SSO linking, and singleton fixes are all contained and independently testable. The GitLab cursor SSRF guard, webhook fault-vs-error reclassification, and HMR singleton migration are each backed by targeted tests. No previously-flagged issues remain unresolved in the diff.

No files require special attention beyond the previously-noted trustEmailVerified: true breadth in apps/sim/lib/auth/auth.ts, which was documented in an earlier review thread.

Important Files Changed

Filename	Overview
apps/sim/connectors/gitlab/gitlab.ts	Adds full repository-file sync (tree listing + lazy content fetch), binary detection, extension/path filters, and keyset-pagination cursor with origin-validation guard against SSRF on cursor-embedded next-page URLs.
apps/sim/lib/uploads/providers/s3/client.ts	Adds endpoint/forcePathStyle to the S3 client constructor and buildObjectFallbackUrl for correct multipart-completion location across AWS, MinIO path-style, and R2 virtual-hosted configurations. Keys are percent-encoded per segment.
apps/sim/lib/auth/auth.ts	Adds trustEmailVerified: true to the SSO plugin and builds additionalTrustedSsoProviders from SSO_PROVIDER_ID + SSO_TRUSTED_PROVIDER_IDS for IdPs that omit the email_verified claim.
apps/sim/lib/core/config/redis.ts	Moves all module-level Redis state into a globalThis._redisState object to prevent duplicate client creation on HMR; logic is otherwise unchanged.
apps/sim/background/webhook-execution.ts	Awaits waitForPostExecution before checking finalization, then returns a failure result (instead of re-throwing) when core finalized the error, preventing user/workflow errors from faulting the trigger.dev job.
apps/sim/lib/copilot/tool-executor/executor.ts	Falls back to a registered server-side handler for client-routed tools (e.g. run_workflow) when running headless in the Mothership block, fixing the Tool not found error in that execution context.
apps/sim/lib/core/utils/validation.ts	Generalises isSameOrigin to accept an explicit base argument (defaults to app base URL), enabling it to validate GitLab pagination URLs against the configured API host.
apps/sim/background/schedule-execution.ts	Wraps the error-recovery path in a nested try/catch so a secondary DB failure records the exception on the span rather than faulting the trigger.dev run.
apps/sim/lib/uploads/config.ts	Adds endpoint and forcePathStyle fields to S3_CONFIG, sourced from the new S3_ENDPOINT and S3_FORCE_PATH_STYLE env vars.
apps/realtime/src/env.ts	Preprocesses REDIS_URL to treat empty strings as undefined, preventing a Zod parse failure when the variable is set but blank.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Webhook job starts] --> B[executeWebhookJobInternal]
    B --> C[executeWorkflowCore]
    C -->|success| D[Return result]
    C -->|throws error| E[await waitForPostExecution]
    E --> F{wasExecutionFinalizedByCore?}
    F -->|YES - user/workflow error| G[recordException on span]
    G --> H[Return failure result - job completes normally]
    F -->|NO - infra/pipeline error| I[safeCompleteWithError]
    I --> J[re-throw error - trigger.dev job faults]

Loading

_{Reviews (2): Last reviewed commit: "fix(storage): percent-encode object key ..." | Re-trigger Greptile}

[waleedlatif1]

Re: the flagged trustEmailVerified scope item in the Greptile summary —

Intended. A configured SSO provider whose IdP asserts email_verified: true should link to an existing same-email account; that's the behavior this change restores. Two clarifications on the "broadens linking globally" concern:

• The existing hardcoded SSO_TRUSTED_PROVIDERS list already trusts common provider IDs (okta/oidc/saml/azure-ad…) unconditionally for linking — without requiring email_verified at all. So trustEmailVerified is the more conservative path: it only links when the IdP actually vouches for the email. SSO_TRUSTED_PROVIDER_IDS is the escape hatch for IdPs (often SAML) that omit the claim.
• The security boundary isn't the allowlist — it's domain scoping: a provider is resolved by the email's domain, and registration enforces one-org-per-domain. An IdP can only assert emails in its own registered domain.

The one genuinely valid residual — multi-tenant: an org registering SSO for a domain it doesn't actually own — is pre-existing (same surface as the common-ID trust list), gated by Enterprise + the domain-conflict check, and the principled fix is DNS-based domain verification + domainVerified (better-auth already auto-trusts a domainVerified provider scoped to its domain; Sim doesn't set that column yet). That's the right lever to harden this, tracked as a follow-up — not narrowing trustEmailVerified, which would just reintroduce the original "account not linked" bug.

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 5efb47e. Configure here.}