feat(code): cli sandboxes, enterprise timeouts, secrets projections, resolver lift

[icecrasher321]

Summary

• Allow CLIs in Sandboxes (with 25 managed CLIs out of the box)
• Add Shell as supported language in function block
• Enterprise metadata can set custom timeouts now
• Resolver lifted to be central compiler adhering to secrets mgmt policies and applying across the board

Type of Change

• New feature

Testing

Tested manually

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[gitguardian]

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secret in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
35640005	Triggered	Generic Password	1a7c79b	apps/desktop/src/main/browser-import/import-service.test.ts	View secret

🛠 Guidelines to remediate hardcoded secrets

1. Understand the implications of revoking this secret by investigating where it is used in your code.
2. Replace and store your secret safely. Learn here the best practices.
3. Revoke and rotate this secret.
4. If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

• following these best practices for managing and storing secrets including API keys and other credentials
• install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

---

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Building	Preview	Aug 4, 2026 5:38pm

[cursor]

PR Summary

High Risk
Changes span remote sandbox provisioning, secret binding and model projection, workflow timeout policy, and stale-job cleanup—security-sensitive execution paths with broad operational impact.

Overview
This PR expands Function sandboxes with a curated managed-CLI catalog (pinned vendor artifacts, checksum-verified server recipes, and client-safe metadata) plus system packages, documented dedicated Function base setup for E2B/Daytona, and an add-managed-cli agent skill/command for adding tools to the registry without arbitrary install commands.

Function execution gains Shell as a remote language, Python as real modules (__sim_result__, __main__), stricter sandbox output size/path validation, and timeout/cancel handling aligned across local JS, remote runtimes, and workflow deadline headers.

Secrets move through a shared compiler: {{KEY}} and related forms bind via opaque runtime identifiers instead of pasting values into source (JS, Python, Shell, Custom Tools), with expanded provenance (__resolvedSecretNames) and docs for model-bound placeholder projection alongside log masking.

Async workflow policy adds optional X-Execution-Timeout-Seconds (async-only, capped at account policy and up to seven days for Enterprise), with matching SDK/OpenAPI/docs updates. The stale-execution cleanup cron is reworked for batched SKIP LOCKED claims, execution-deadline–aware workflow failure, separate table-job staleness windows, and higher per-run caps.

^{Reviewed by Cursor Bugbot for commit 93c6320. Configure here.}

[icecrasher321]

@greptile

[greptile-apps]

Greptile Summary

The PR centralizes workflow placeholder and secret resolution while extending remote Function sandboxes and execution-timeout policy.

• Adds curated managed CLI provisioning, content-addressed sandbox images, and Shell Function support across E2B and Daytona.
• Adds configurable enterprise async timeouts and request-level timeout caps across API and background execution paths.
• Projects resolved secrets out of log-facing and model-bound content without rewriting functional workflow data.
• Updates sandbox persistence, APIs, settings UI, SDKs, documentation, and focused tests for the new contracts.

Confidence Score: 5/5

The PR appears safe to merge based on the eligible follow-up review scope.

No blocking failure remains within the displayed prior-thread scope.

Important Files Changed

Filename	Overview
apps/sim/executor/variables/resolver.ts	Centralizes workflow value and secret resolution for executor consumers.
apps/sim/executor/utils/resolved-secret-content-projection.ts	Adds bounded, non-mutating projection of resolved secret values from model- and log-visible structures.
apps/sim/lib/execution/remote-sandbox/resolve.ts	Resolves sandbox specifications, provider strategy, managed CLI environments, and runtime dependency provisioning.
apps/sim/lib/execution/remote-sandbox/cli-tools.server.ts	Defines pinned server-side installation and verification recipes for managed CLIs.
apps/sim/lib/core/execution-limits/types.ts	Extends execution-limit resolution to support enterprise policy and request-level timeout caps.
apps/sim/lib/execution/preprocessing.ts	Applies centralized timeout and resolver behavior during workflow preprocessing.
packages/db/schema.ts	Extends persisted sandbox and enterprise metadata contracts for CLI selections and timeout configuration.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Trigger[API / Webhook / Schedule / Table] --> Policy[Resolve async timeout policy]
  Policy --> Job[Background execution job]
  Job --> Resolver[Central placeholder and secret resolver]
  Resolver --> Engine[Workflow executor]
  Engine --> Function[Function block]
  Function --> Sandbox[Remote sandbox resolver]
  Sandbox --> Spec[Content-addressed sandbox spec]
  Spec --> E2B[E2B prebuilt image]
  Spec --> Daytona[Daytona runtime provisioning]
  E2B --> Runtime[JavaScript / Python / Shell]
  Daytona --> Runtime
  CLI[Managed CLI registry] --> Spec
  Secrets[Authorized secret catalog] --> Resolver
  Resolver --> Functional[Functional runtime data]
  Resolver --> Projection[Log and model projection]
  Projection --> Logs[Protected logs]
  Projection --> Model[Protected model requests]

Loading

_{Reviews (9): Last reviewed commit: "Merge remote-tracking branch 'origin/sta..." | Re-trigger Greptile}

[icecrasher321]

@greptile

[icecrasher321]

@cursor review

[icecrasher321]

@greptile

[icecrasher321]

@cursor review

[icecrasher321]

@greptile

[icecrasher321]

@cursor review

[icecrasher321]

@greptile

[icecrasher321]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit e3f33d1. Configure here.}

[icecrasher321]

@greptile

[icecrasher321]

@cursor review

[icecrasher321]

@greptile

[icecrasher321]

@cursor review

[icecrasher321]

@cursor review

[icecrasher321]

@greptile

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 6a257db. Configure here.}

[icecrasher321]

@greptile

[icecrasher321]

@cursor review