v0.7.40: library, mcp hardening, pi code reviewer, gmail fix

Author: waleedlatif1

apps/docs/content/docs/en/workflows/blocks/pi.mdx

@@ -73,6 +73,7 @@ export function ContentAuthorPage({
                       month: 'short',
                       day: 'numeric',
                       year: 'numeric',
+                      timeZone: 'UTC',
                     })}
                   </span>
 
@@ -82,6 +83,7 @@ export function ContentAuthorPage({
                         month: 'short',
                         day: 'numeric',
                         year: 'numeric',
+                        timeZone: 'UTC',
                       })}
                     </span>
                     <h3 className='text-[var(--text-primary)] text-base leading-tight tracking-[-0.01em] lg:text-lg'>

apps/sim/app/(landing)/components/content-author-page/content-author-page.tsx

@@ -84,7 +84,9 @@ export function ContentIndexPage({
                         <span className='text-[var(--text-muted)] text-xs uppercase tracking-[0.1em]'>
                           {new Date(p.date).toLocaleDateString('en-US', {
                             month: 'short',
-                            year: '2-digit',
+                            day: 'numeric',
+                            year: 'numeric',
+                            timeZone: 'UTC',
                           })}
                         </span>
                         <h3 className='text-[var(--text-primary)] text-lg leading-tight tracking-[-0.01em]'>
@@ -113,6 +115,7 @@ export function ContentIndexPage({
                       month: 'short',
                       day: 'numeric',
                       year: 'numeric',
+                      timeZone: 'UTC',
                     })}
                   </span>
 
@@ -122,6 +125,7 @@ export function ContentIndexPage({
                         month: 'short',
                         day: 'numeric',
                         year: 'numeric',
+                        timeZone: 'UTC',
                       })}
                     </span>
                     <h3 className='text-[var(--text-primary)] text-base leading-tight tracking-[-0.01em] lg:text-lg'>

apps/sim/app/(landing)/components/content-index-page/content-index-page.tsx

@@ -83,6 +83,7 @@ export function ContentPostPage({
                   month: 'short',
                   day: 'numeric',
                   year: 'numeric',
+                  timeZone: 'UTC',
                 })}
               </time>
               <meta itemProp='dateModified' content={post.updated ?? post.date} />
@@ -152,7 +153,9 @@ export function ContentPostPage({
                       <span className='text-[var(--text-muted)] text-xs uppercase tracking-[0.1em]'>
                         {new Date(p.date).toLocaleDateString('en-US', {
                           month: 'short',
-                          year: '2-digit',
+                          day: 'numeric',
+                          year: 'numeric',
+                          timeZone: 'UTC',
                         })}
                       </span>
                       <h3 className='text-[var(--text-primary)] text-lg leading-tight tracking-[-0.01em]'>

apps/sim/app/(landing)/components/content-post-page/content-post-page.tsx

@@ -22,13 +22,16 @@
   --auth-primary-btn-hover-border: #e0e0e0;
   --auth-primary-btn-hover-text: #000000;
 
-  /* z-index scale. Transient poppers (menus, selects, popovers, tooltips, toasts)
-     sit above --z-modal so they stay clickable over the semi-transparent overlay. */
+  /* z-index scale. The toast/notification stack is ambient: it sits above page
+     content but BELOW the modal and the transient poppers (menus, selects,
+     popovers, tooltips), so an open modal or dropdown menu is never occluded by
+     a background notification. Poppers sit above --z-modal so they stay
+     clickable over the modal's semi-transparent overlay. */
   --z-dropdown: 100;
+  --z-toast: 150;
   --z-modal: 200;
   --z-popover: 300;
   --z-tooltip: 400;
-  --z-toast: 500;
 
   /* Shadow scale */
   --shadow-subtle: 0 2px 4px 0 rgba(0, 0, 0, 0.08);

apps/sim/app/_styles/globals.css

@@ -13,6 +13,7 @@ import { checkInternalAuth } from '@/lib/auth/hybrid'
 import { sanitizeUrlForLog } from '@/lib/core/utils/logging'
 import { assertKnownSizeWithinLimit, isPayloadSizeLimitError } from '@/lib/core/utils/stream-limits'
 import { isSupportedFileType, parseFile } from '@/lib/file-parsers'
+import { isYamlComplexityError } from '@/lib/file-parsers/yaml-parser'
 import { isUsingCloudStorage, StorageService } from '@/lib/uploads'
 import { uploadExecutionFile } from '@/lib/uploads/contexts/execution'
 import {
@@ -1043,6 +1044,9 @@ async function handleGenericTextBuffer(
       }
     } catch (parserError) {
       if (isPayloadSizeLimitError(parserError)) throw parserError
+      // Fail closed on a resource-exhaustion rejection instead of silently
+      // storing the crafted document as raw text.
+      if (isYamlComplexityError(parserError)) throw parserError
 
       logger.warn('Specialized parser failed, falling back to generic parsing:', parserError)
     }

apps/sim/app/api/files/parse/route.ts

@@ -588,7 +588,9 @@ describe('/api/files/presigned', () => {
 
       const response = await POST(request)
       expect(response.status).toBe(200)
-      expect(mockValidateAttachmentFileType).toHaveBeenCalledWith('screenshot.png')
+      expect(mockValidateAttachmentFileType).toHaveBeenCalledWith('screenshot.png', {
+        allowArchives: true,
+      })
       expect(mockValidateFileType).not.toHaveBeenCalled()
     })
 

apps/sim/app/api/files/presigned/route.test.ts

@@ -142,7 +142,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
         )
       }
 
-      const fileValidationError = validateAttachmentFileType(fileName)
+      const fileValidationError = validateAttachmentFileType(fileName, { allowArchives: true })
       if (fileValidationError) {
         throw new ValidationError(fileValidationError.message)
       }

apps/sim/app/api/files/presigned/route.ts

@@ -23,7 +23,7 @@ import type { StorageContext } from '@/lib/uploads/config'
 import { generateKnowledgeBaseFileKey } from '@/lib/uploads/contexts/knowledge-base/knowledge-base-file-manager'
 import { generateWorkspaceFileKey } from '@/lib/uploads/contexts/workspace/workspace-file-manager'
 import { MAX_WORKSPACE_FORMDATA_FILE_SIZE } from '@/lib/uploads/shared/types'
-import { isImageFileType, resolveFileType } from '@/lib/uploads/utils/file-utils'
+import { isArchiveFileName, isImageFileType, resolveFileType } from '@/lib/uploads/utils/file-utils'
 import {
   SUPPORTED_ATTACHMENT_EXTENSIONS,
   SUPPORTED_IMAGE_EXTENSIONS,
@@ -34,9 +34,12 @@ import { createErrorResponse, InvalidRequestError } from '@/app/api/files/utils'
 
 const ALLOWED_EXTENSIONS = new Set<string>(SUPPORTED_ATTACHMENT_EXTENSIONS)
 
-function validateFileExtension(filename: string): boolean {
+function validateFileExtension(filename: string, context: StorageContext): boolean {
   const extension = filename.split('.').pop()?.toLowerCase()
   if (!extension) return false
+  // Archives are only extractable in the mothership copilot flow; every other
+  // context keeps rejecting them up front instead of failing downstream.
+  if (context === 'mothership' && isArchiveFileName(filename)) return true
   return ALLOWED_EXTENSIONS.has(extension)
 }
 
@@ -150,7 +153,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
     for (const file of files) {
       const originalName = file.name || 'untitled.md'
 
-      if (!validateFileExtension(originalName)) {
+      if (!validateFileExtension(originalName, context)) {
         const extension = originalName.split('.').pop()?.toLowerCase() || 'unknown'
         throw new InvalidRequestError(
           `File type '${extension}' is not allowed. Allowed types: ${Array.from(ALLOWED_EXTENSIONS).join(', ')}`

apps/sim/app/api/files/upload/route.ts

@@ -72,4 +72,45 @@ describe('MCP OAuth callback route', () => {
       })
     )
   })
+
+  it('signals success over a same-origin BroadcastChannel carrying the state nonce', async () => {
+    const request = new NextRequest(
+      'http://localhost:3000/api/mcp/oauth/callback?state=state-1&code=auth-code-1'
+    )
+
+    const body = await (await GET(request)).text()
+
+    // The completion is delivered over a BroadcastChannel (not window.opener.postMessage)
+    // so a COOP `same-origin` provider that severs the opener can't strand the parent. The
+    // `state` nonce lets the hook react only in the tab that started this exact flow.
+    expect(body).toContain("new BroadcastChannel('mcp-oauth')")
+    expect(body).toContain('ok: true')
+    expect(body).toContain('"server-1"')
+    expect(body).toContain('"state-1"')
+  })
+
+  it('reports an early failure over the channel without attempting token exchange', async () => {
+    // Missing `code` fails at the param gate, before any network work.
+    const request = new NextRequest('http://localhost:3000/api/mcp/oauth/callback?state=state-1')
+
+    const body = await (await GET(request)).text()
+
+    expect(body).toContain('ok: false')
+    expect(mcpOauthMockFns.mockMcpAuthGuarded).not.toHaveBeenCalled()
+  })
+
+  it('echoes the state on a serverless invalid_state failure so the initiating tab can react', async () => {
+    // No row loads for the state -> failure with no serverId. The state must still be echoed,
+    // or the initiating tab would sit on "Connecting…" until its safety timeout.
+    mcpOauthMockFns.mockLoadOauthRowByState.mockResolvedValueOnce(null)
+    const request = new NextRequest(
+      'http://localhost:3000/api/mcp/oauth/callback?state=state-1&code=auth-code-1'
+    )
+
+    const body = await (await GET(request)).text()
+
+    expect(body).toContain('ok: false')
+    expect(body).toContain('"state-1"')
+    expect(body).toContain('serverId: undefined')
+  })
 })