v0.5.27: sidebar updates, ssrf patches, gpt-5.2

apps/sim/app/api/files/parse/route.ts

@@ -5,7 +5,7 @@ import path from 'path'
 import binaryExtensionsList from 'binary-extensions'
 import { type NextRequest, NextResponse } from 'next/server'
 import { checkHybridAuth } from '@/lib/auth/hybrid'
-import { validateExternalUrl } from '@/lib/core/security/input-validation'
+import { createPinnedUrl, validateUrlWithDNS } from '@/lib/core/security/input-validation'
 import { isSupportedFileType, parseFile } from '@/lib/file-parsers'
 import { createLogger } from '@/lib/logs/console/logger'
 import { isUsingCloudStorage, type StorageContext, StorageService } from '@/lib/uploads'
@@ -270,7 +270,7 @@ async function handleExternalUrl(
     logger.info('Fetching external URL:', url)
     logger.info('WorkspaceId for URL save:', workspaceId)
 
-    const urlValidation = validateExternalUrl(url, 'fileUrl')
+    const urlValidation = await validateUrlWithDNS(url, 'fileUrl')
     if (!urlValidation.isValid) {
       logger.warn(`Blocked external URL request: ${urlValidation.error}`)
       return {
@@ -346,8 +346,12 @@ async function handleExternalUrl(
       }
     }
 
-    const response = await fetch(url, {
+    const pinnedUrl = createPinnedUrl(url, urlValidation.resolvedIP!)
+    const response = await fetch(pinnedUrl, {
       signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS),
+      headers: {
+        Host: urlValidation.originalHostname!,
+      },
     })
     if (!response.ok) {
       throw new Error(`Failed to fetch URL: ${response.status} ${response.statusText}`)

apps/sim/app/api/proxy/route.ts

@@ -4,7 +4,7 @@ import { z } from 'zod'
 import { checkHybridAuth } from '@/lib/auth/hybrid'
 import { generateInternalToken } from '@/lib/auth/internal'
 import { isDev } from '@/lib/core/config/environment'
-import { validateProxyUrl } from '@/lib/core/security/input-validation'
+import { createPinnedUrl, validateUrlWithDNS } from '@/lib/core/security/input-validation'
 import { generateRequestId } from '@/lib/core/utils/request'
 import { getBaseUrl } from '@/lib/core/utils/urls'
 import { createLogger } from '@/lib/logs/console/logger'
@@ -173,7 +173,7 @@ export async function GET(request: Request) {
     return createErrorResponse("Missing 'url' parameter", 400)
   }
 
-  const urlValidation = validateProxyUrl(targetUrl)
+  const urlValidation = await validateUrlWithDNS(targetUrl)
   if (!urlValidation.isValid) {
     logger.warn(`[${requestId}] Blocked proxy request`, {
       url: targetUrl.substring(0, 100),
@@ -211,11 +211,13 @@ export async function GET(request: Request) {
   logger.info(`[${requestId}] Proxying ${method} request to: ${targetUrl}`)
 
   try {
-    const response = await fetch(targetUrl, {
+    const pinnedUrl = createPinnedUrl(targetUrl, urlValidation.resolvedIP!)
+    const response = await fetch(pinnedUrl, {
       method: method,
       headers: {
         ...getProxyHeaders(),
         ...customHeaders,
+        Host: urlValidation.originalHostname!,
       },
       body: body || undefined,
     })

apps/sim/app/api/tools/postgresql/utils.ts

@@ -33,9 +33,10 @@ export async function executeQuery(
   params: unknown[] = []
 ): Promise<{ rows: unknown[]; rowCount: number }> {
   const result = await sql.unsafe(query, params)
+  const rowCount = result.count ?? result.length ?? 0
   return {
     rows: Array.isArray(result) ? result : [result],
-    rowCount: Array.isArray(result) ? result.length : result ? 1 : 0,
+    rowCount,
   }
 }
 
@@ -107,9 +108,10 @@ export async function executeInsert(
   const query = `INSERT INTO ${sanitizedTable} (${sanitizedColumns.join(', ')}) VALUES (${placeholders.join(', ')}) RETURNING *`
   const result = await sql.unsafe(query, values)
 
+  const rowCount = result.count ?? result.length ?? 0
   return {
     rows: Array.isArray(result) ? result : [result],
-    rowCount: Array.isArray(result) ? result.length : result ? 1 : 0,
+    rowCount,
   }
 }
 
@@ -130,9 +132,10 @@ export async function executeUpdate(
   const query = `UPDATE ${sanitizedTable} SET ${setClause} WHERE ${where} RETURNING *`
   const result = await sql.unsafe(query, values)
 
+  const rowCount = result.count ?? result.length ?? 0
   return {
     rows: Array.isArray(result) ? result : [result],
-    rowCount: Array.isArray(result) ? result.length : result ? 1 : 0,
+    rowCount,
   }
 }
 
@@ -147,8 +150,9 @@ export async function executeDelete(
   const query = `DELETE FROM ${sanitizedTable} WHERE ${where} RETURNING *`
   const result = await sql.unsafe(query, [])
 
+  const rowCount = result.count ?? result.length ?? 0
   return {
     rows: Array.isArray(result) ? result : [result],
-    rowCount: Array.isArray(result) ? result.length : result ? 1 : 0,
+    rowCount,
   }
 }

apps/sim/app/api/tools/stagehand/agent/route.ts

@@ -496,7 +496,7 @@ export async function POST(request: NextRequest) {
         verbose: 1,
         logger: (msg) => logger.info(typeof msg === 'string' ? msg : JSON.stringify(msg)),
         model: {
-          modelName: 'claude-sonnet-4-20250514',
+          modelName: 'anthropic/claude-3-7-sonnet-latest',
           apiKey: apiKey,
         },
       })
@@ -704,7 +704,14 @@ The system will substitute actual values when these placeholders are used, keepi
         `.trim()
 
       const agent = stagehand.agent({
-        model: 'anthropic/claude-sonnet-4-20250514',
+        model: {
+          modelName: 'anthropic/claude-3-7-sonnet-latest',
+          apiKey: apiKey,
+        },
+        executionModel: {
+          modelName: 'anthropic/claude-3-7-sonnet-latest',
+          apiKey: apiKey,
+        },
         systemPrompt: `${agentInstructions}\n\n${additionalContext}`,
       })
 
@@ -795,6 +802,9 @@ The system will substitute actual values when these placeholders are used, keepi
       })
 
       let structuredOutput = null
+      const hasOutputSchema =
+        outputSchema && typeof outputSchema === 'object' && outputSchema !== null
+
       if (agentResult.message) {
         try {
           let jsonContent = agentResult.message
@@ -807,33 +817,31 @@ The system will substitute actual values when these placeholders are used, keepi
           structuredOutput = JSON.parse(jsonContent)
           logger.info('Successfully parsed structured output from agent response')
         } catch (parseError) {
-          logger.error('Failed to parse JSON from agent message', {
-            error: parseError,
-            message: agentResult.message,
-          })
-
-          if (
-            outputSchema &&
-            typeof outputSchema === 'object' &&
-            outputSchema !== null &&
-            stagehand
-          ) {
-            try {
-              logger.info('Attempting to extract structured data using Stagehand extract')
-              const schemaObj = getSchemaObject(outputSchema)
-              const zodSchema = ensureZodObject(logger, schemaObj)
-
-              structuredOutput = await stagehand.extract(
-                'Extract the requested information from this page according to the schema',
-                zodSchema
-              )
-
-              logger.info('Successfully extracted structured data as fallback', {
-                keys: structuredOutput ? Object.keys(structuredOutput) : [],
-              })
-            } catch (extractError) {
-              logger.error('Fallback extraction also failed', { error: extractError })
+          if (hasOutputSchema) {
+            logger.warn('Failed to parse JSON from agent message, attempting fallback extraction', {
+              error: parseError,
+            })
+
+            if (stagehand) {
+              try {
+                logger.info('Attempting to extract structured data using Stagehand extract')
+                const schemaObj = getSchemaObject(outputSchema)
+                const zodSchema = ensureZodObject(logger, schemaObj)
+
+                structuredOutput = await stagehand.extract(
+                  'Extract the requested information from this page according to the schema',
+                  zodSchema
+                )
+
+                logger.info('Successfully extracted structured data as fallback', {
+                  keys: structuredOutput ? Object.keys(structuredOutput) : [],
+                })
+              } catch (extractError) {
+                logger.error('Fallback extraction also failed', { error: extractError })
+              }
             }
+          } else {
+            logger.info('Agent returned plain text response (no schema provided)')
           }
         }
       }

apps/sim/app/api/tools/stagehand/extract/route.ts

@@ -86,7 +86,7 @@ export async function POST(request: NextRequest) {
         verbose: 1,
         logger: (msg) => logger.info(typeof msg === 'string' ? msg : JSON.stringify(msg)),
         model: {
-          modelName: 'gpt-4o',
+          modelName: 'openai/gpt-4o',
           apiKey: apiKey,
         },
       })

apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/search-modal/search-modal.tsx

@@ -10,6 +10,7 @@ import { useBrandConfig } from '@/lib/branding/branding'
 import { cn } from '@/lib/core/utils/cn'
 import { getTriggersForSidebar, hasTriggerCapability } from '@/lib/workflows/triggers/trigger-utils'
 import { searchItems } from '@/app/workspace/[workspaceId]/w/components/sidebar/components/search-modal/search-utils'
+import { SIDEBAR_SCROLL_EVENT } from '@/app/workspace/[workspaceId]/w/components/sidebar/sidebar'
 import { getAllBlocks } from '@/blocks'
 
 interface SearchModalProps {
@@ -430,6 +431,12 @@ export function SearchModal({
               window.open(item.href, '_blank', 'noopener,noreferrer')
             } else {
               router.push(item.href)
+              // Scroll to the workflow in the sidebar after navigation
+              if (item.type === 'workflow') {
+                window.dispatchEvent(
+                  new CustomEvent(SIDEBAR_SCROLL_EVENT, { detail: { itemId: item.id } })
+                )
+              }
             }
           }
           break

apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/workflow-list/components/folder-item/folder-item.tsx

@@ -14,6 +14,7 @@ import {
   useItemDrag,
   useItemRename,
 } from '@/app/workspace/[workspaceId]/w/components/sidebar/hooks'
+import { SIDEBAR_SCROLL_EVENT } from '@/app/workspace/[workspaceId]/w/components/sidebar/sidebar'
 import { useDeleteFolder, useDuplicateFolder } from '@/app/workspace/[workspaceId]/w/hooks'
 import { useCreateFolder, useUpdateFolder } from '@/hooks/queries/folders'
 import { useCreateWorkflow } from '@/hooks/queries/workflows'
@@ -87,6 +88,10 @@ export function FolderItem({ folder, level, hoverHandlers }: FolderItemProps) {
 
       if (result.id) {
         router.push(`/workspace/${workspaceId}/w/${result.id}`)
+        // Scroll to the newly created workflow
+        window.dispatchEvent(
+          new CustomEvent(SIDEBAR_SCROLL_EVENT, { detail: { itemId: result.id } })
+        )
       }
     } catch (error) {
       // Error already handled by mutation's onError callback
@@ -100,11 +105,17 @@ export function FolderItem({ folder, level, hoverHandlers }: FolderItemProps) {
    */
   const handleCreateFolderInFolder = useCallback(async () => {
     try {
-      await createFolderMutation.mutateAsync({
+      const result = await createFolderMutation.mutateAsync({
         workspaceId,
         name: 'New Folder',
         parentId: folder.id,
       })
+      if (result.id) {
+        // Scroll to the newly created folder
+        window.dispatchEvent(
+          new CustomEvent(SIDEBAR_SCROLL_EVENT, { detail: { itemId: result.id } })
+        )
+      }
     } catch (error) {
       logger.error('Failed to create folder:', error)
     }

apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/workflow-list/workflow-list.tsx

@@ -1,6 +1,6 @@
 'use client'
 
-import { useCallback, useEffect, useMemo, useRef } from 'react'
+import { useCallback, useEffect, useMemo } from 'react'
 import clsx from 'clsx'
 import { useParams, usePathname } from 'next/navigation'
 import { FolderItem } from '@/app/workspace/[workspaceId]/w/components/sidebar/components/workflow-list/components/folder-item/folder-item'
@@ -144,11 +144,8 @@ export function WorkflowList({
     [pathname, workspaceId]
   )
 
-  // Track last scrolled workflow to avoid redundant scroll checks
-  const lastScrolledWorkflowRef = useRef<string | null>(null)
-
   /**
-   * Auto-expand folders, select active workflow, and scroll into view if needed.
+   * Auto-expand folders and select active workflow.
    */
   useEffect(() => {
     if (!workflowId || isLoading || foldersLoading) return
@@ -164,25 +161,6 @@ export function WorkflowList({
     if (!selectedWorkflows.has(workflowId)) {
       selectOnly(workflowId)
     }
-
-    // Skip scroll check if already handled for this workflow
-    if (lastScrolledWorkflowRef.current === workflowId) return
-    lastScrolledWorkflowRef.current = workflowId
-
-    // Scroll after render only if element is completely off-screen
-    requestAnimationFrame(() => {
-      const element = document.querySelector(`[data-item-id="${workflowId}"]`)
-      const container = scrollContainerRef.current
-      if (!element || !container) return
-
-      const { top: elTop, bottom: elBottom } = element.getBoundingClientRect()
-      const { top: ctTop, bottom: ctBottom } = container.getBoundingClientRect()
-
-      // Only scroll if completely above or below the visible area
-      if (elBottom <= ctTop || elTop >= ctBottom) {
-        element.scrollIntoView({ behavior: 'smooth', block: 'center' })
-      }
-    })
   }, [workflowId, activeWorkflowFolderId, isLoading, foldersLoading, getFolderPath, setExpanded])
 
   const renderWorkflowItem = useCallback(