feat(network): add organization outbound routing by waleedlatif1 · Pull Request #7786 · simstudioai/sim

waleedlatif1 · 2026-09-11T21:01:14Z

Summary

Add organization outbound routing to the existing validated HTTP helpers and guarded SDK transports, with isolated pools, TLS CONNECT, canonical ownership and fail-closed routing.
Migrate managed requests to explicit destination profiles and extend the existing boundary audit. Preserve supported streaming, uploads, retries, model endpoints and deployment proxies.
Combine session policies and outbound IP addresses in Security settings using shared components. Keep SSO separate and document transport coverage.
Keep credentials and organization assignments in operator configuration. Assigned routes reject unsupported remote sandbox, raw database and SDK transports; initial account OAuth and SDK-owned control traffic remain outside coverage. Activation is separate.
Depends on improvement(network): consolidate validated HTTP transports #7795. This PR contains the organization feature; the prerequisite contains reusable HTTP transport changes.

Type of Change

New feature

Testing

Full combined application regression passed 50,986 tests with 185 skipped before the staging sync. After the sync and final redirect-replay fix, 3,490 focused tests passed with 18 skipped.
All 26 workspace type checks, lint, 46 repository audits, block registry and docs manifest checks passed. Real Node and Bun socket tests cover TLS identity, destination pinning, default ports, proxies and cancellation.
Security settings were verified locally with synthetic data. CI on the new commit, deployed app/worker acceptance and connection coverage remain release gates.

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

vercel · 2026-09-11T21:01:23Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Sep 12, 2026 4:50pm UTC

waleedlatif1 · 2026-09-11T21:01:41Z

@greptile

waleedlatif1 · 2026-09-11T21:01:42Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-11T21:01:47Z

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

waleedlatif1 · 2026-09-11T21:02:34Z

@greptile-apps please review this PR.

greptile-apps · 2026-09-11T21:06:56Z

Confidence Score: 5/5

The PR appears safe to merge because no new actionable issue was introduced after the previous review and all prior findings are resolved.

Summary

Routes supported organization traffic through dedicated gateways while preserving direct routing where explicitly allowed.
Applies canonical organization scope to workflow execution, credentials, connectors, background jobs, model providers, and other managed requests.
Adds an organization network read API and shared Security settings UI.
Expands transport, routing, proxy, cancellation, authorization, and integration regression coverage.
The post-review change only corrects a gateway test title; it does not modify transport behavior.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Resource[Canonical workspace or organization resource] --> Scope[Outbound organization scope]
  Scope --> Resolver[Route resolver]
  Resolver -->|Assigned route| Gateway[Organization gateway pool]
  Resolver -->|Allowed direct route| Direct[Validated direct transport]
  Resolver -->|Missing or unsupported scope| Reject[Fail closed]
  Gateway --> TLS[TLS CONNECT and destination pinning]
  TLS --> Provider[External provider]
  Direct --> Provider
  Settings[Security settings] --> NetworkAPI[Organization network API]
  NetworkAPI --> Addresses[Configured outbound IP addresses]

_{Reviews (10) · Last reviewed commit: "chore(network): clarify Request body cov..."}

waleedlatif1 · 2026-09-11T21:23:29Z

@greptile-apps please review this PR.

waleedlatif1 · 2026-09-11T21:23:30Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-11T21:23:35Z

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

waleedlatif1 · 2026-09-11T21:37:30Z

@greptile-apps please review this PR.

waleedlatif1 · 2026-09-11T21:37:31Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-11T21:37:39Z

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

waleedlatif1 · 2026-09-11T21:46:55Z

@greptile-apps please review this PR.

waleedlatif1 · 2026-09-11T21:46:56Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-11T21:47:01Z

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

waleedlatif1 · 2026-09-11T21:59:13Z

@greptile-apps please review this PR.

waleedlatif1 · 2026-09-11T21:59:14Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-11T21:59:21Z

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

waleedlatif1 · 2026-09-11T22:24:46Z

@greptile

waleedlatif1 · 2026-09-11T22:24:52Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-11T22:24:59Z

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

waleedlatif1 · 2026-09-11T22:37:59Z

@greptile

waleedlatif1 · 2026-09-11T22:38:03Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-11T22:38:10Z

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

waleedlatif1 · 2026-09-12T00:07:31Z

@greptile

waleedlatif1 · 2026-09-12T00:07:32Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-12T00:07:40Z

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

waleedlatif1 · 2026-09-12T00:09:14Z

@greptile

waleedlatif1 · 2026-09-12T09:57:44Z

@greptile

waleedlatif1 · 2026-09-12T09:57:45Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-12T09:58:01Z

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

waleedlatif1 · 2026-09-12T10:13:34Z

@greptile

waleedlatif1 · 2026-09-12T10:13:35Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-12T10:13:42Z

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

waleedlatif1 · 2026-09-12T16:50:14Z

The current base is codex/http-transport-foundation (#7795). liftFetchArgs is identical to that base; this PR's changes in input-validation.server.ts add only the direct-transport guard for database connections.

The staging implementation at 9294beb326 already materializes inherited Request bodies with input.clone().arrayBuffer() in both guarded and pinned fetch normalization. The prerequisite narrows that existing behavior to inherited bodies in follow mode and preserves streaming for manual/error modes and explicit init bodies. It does not introduce eager Request buffering relative to staging. The memory limitation for inherited Request bodies is real, but it is pre-existing.

The newly injected OpenAI/AzureOpenAI and Anthropic SDK transports call fetch with a URL and explicit init body. The audited multipart/audio upload paths do the same, so they bypass inherited-Request materialization. I also corrected the gateway test title from "streams Request bodies" to "preserves Request bodies"; its assertions are unchanged.

@greptile please reassess this finding against the current PR base. If a newly migrated caller creates additional exposure, please identify that call path so we can address it directly.

waleedlatif1 requested a review from a team as a code owner September 11, 2026 21:01

vercel Bot deployed to Preview September 11, 2026 21:02 View deployment

greptile-apps Bot reviewed Sep 11, 2026

View reviewed changes

Comment thread apps/sim/lib/credential-groups/standard-oauth-provider.ts Outdated

Comment thread apps/sim/lib/workflows/executor/execution-core.ts

vercel Bot temporarily deployed to Preview September 11, 2026 21:22 Inactive

greptile-apps Bot reviewed Sep 11, 2026

View reviewed changes

Comment thread apps/sim/lib/core/config/appconfig.ts Outdated

vercel Bot temporarily deployed to Preview September 11, 2026 21:37 Inactive

vercel Bot deployed to Preview September 11, 2026 21:48 View deployment

vercel Bot temporarily deployed to Preview September 11, 2026 21:58 Inactive

vercel Bot temporarily deployed to Preview September 11, 2026 22:24 Inactive

vercel Bot deployed to Preview September 11, 2026 22:38 View deployment

vercel Bot deployed to Preview September 12, 2026 00:08 View deployment

waleedlatif1 force-pushed the codex/organization-egress branch from 94d423e to 3b319c5 Compare September 12, 2026 09:57

waleedlatif1 changed the base branch from staging to codex/http-transport-foundation September 12, 2026 09:57

vercel Bot deployed to Preview September 12, 2026 09:59 View deployment

feat(network): add organization outbound routing

7169f79

waleedlatif1 force-pushed the codex/organization-egress branch from 3b319c5 to 7169f79 Compare September 12, 2026 10:13

vercel Bot deployed to Preview September 12, 2026 10:15 View deployment

chore(network): clarify Request body coverage

0fb8b92

vercel Bot temporarily deployed to Preview September 12, 2026 16:50 Inactive

Uh oh!

Conversation

waleedlatif1 commented Sep 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Type of Change

Testing

Checklist

Uh oh!

vercel Bot commented Sep 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

waleedlatif1 commented Sep 11, 2026

Uh oh!

waleedlatif1 commented Sep 11, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 11, 2026

Uh oh!

waleedlatif1 commented Sep 11, 2026

Uh oh!

greptile-apps Bot commented Sep 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Summary

Diagram

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Sep 11, 2026

Uh oh!

waleedlatif1 commented Sep 11, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 11, 2026

Uh oh!

Uh oh!

waleedlatif1 commented Sep 11, 2026

Uh oh!

waleedlatif1 commented Sep 11, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 11, 2026

Uh oh!

waleedlatif1 commented Sep 11, 2026

Uh oh!

waleedlatif1 commented Sep 11, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 11, 2026

Uh oh!

waleedlatif1 commented Sep 11, 2026

Uh oh!

waleedlatif1 commented Sep 11, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 11, 2026

Uh oh!

waleedlatif1 commented Sep 11, 2026

Uh oh!

waleedlatif1 commented Sep 11, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 11, 2026

Uh oh!

waleedlatif1 commented Sep 11, 2026

Uh oh!

waleedlatif1 commented Sep 11, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 11, 2026

Uh oh!

waleedlatif1 commented Sep 12, 2026

Uh oh!

waleedlatif1 commented Sep 12, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 12, 2026

Uh oh!

waleedlatif1 commented Sep 12, 2026

Uh oh!

waleedlatif1 commented Sep 12, 2026

Uh oh!

waleedlatif1 commented Sep 12, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 12, 2026

Uh oh!

waleedlatif1 commented Sep 12, 2026

waleedlatif1 commented Sep 11, 2026 •

edited

Loading

vercel Bot commented Sep 11, 2026 •

edited

Loading

greptile-apps Bot commented Sep 11, 2026 •

edited

Loading