fix(tools): stop provider timeout params from becoming the request deadline by waleedlatif1 · Pull Request #8878 · simstudioai/sim

waleedlatif1 · 2026-10-10T02:19:10Z

Summary

Provider timeout params no longer become the request deadline. The external transport (formatToolRequest) and the internal-operation path both read params.timeout as a millisecond deadline for every tool. Eight tools declare their own timeout in seconds or as a duration — Twilio make_call, New Relic nrql_query, Apify (run_actor_sync, run_actor_async, run_task), Daytona (execute_command, run_code), Trigger.dev create_waitpoint_token — so a 60-second setting aborted the call after 60 ms. A declared timeout is now the deadline only when the tool sets timeoutParamIsDeadline: true (http_request, firecrawl_map, firecrawl_parse, whose timeout really is a ms deadline — behavior unchanged). Callers can still bound tools that declare no timeout. No param ids change, so saved workflows are unaffected. function_execute (also ms) takes its own execution branch and is untouched
Redis and Upstash coercions move out of tools.config.tool. The selector runs at serialization on the object that becomes the serialized params, so params.x = Number(params.x) turned <Block.output> references into NaN. The same coercions now run in tools.config.params (merged over the resolved inputs on both the block and Agent paths — the Agent path previously got no coercion at all)
Guardrails, no exemptions needed: check-block-registry rejects a coerced value assigned back onto params inside an inline tools.config.tool (AST); check-tool-param-reachability rejects a method param on a fixed-verb external tool, which the transport would send as the HTTP verb. The add-tools skill documents both

Type of Change

Bug fix

Testing

Both audits pass on this branch and fail when one bad site is put back (redis.ts reverted; a fixed-verb tool given a method param)
vitest on request-transport, http/request and tools/index tests: 245 passed
Full audits, type-check and suites run in CI

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

…adline The request transport and the internal-operation path read params.timeout as a millisecond deadline for every tool. Twilio make_call, New Relic NRQL, Apify (3 tools), Daytona (2 tools), and Trigger.dev waitpoint tokens declare their own timeout param in seconds or as a duration, so a 60-second setting aborted the call after 60 ms. A declared timeout param is now the deadline only when the tool sets timeoutParamIsDeadline (http_request, firecrawl_map, firecrawl_parse); callers can still bound tools that declare none. No param ids change. Redis and Upstash coerced params with Number() inside tools.config.tool, which runs at serialization on the serialized params object, turning <Block.output> references into NaN. The coercions now run in tools.config.params. Guardrails: check-block-registry rejects coerced assignments to params inside an inline tools.config.tool; check-tool-param-reachability rejects a method param on a fixed-verb external tool, which the transport would send as the HTTP verb.

vercel · 2026-10-10T02:19:13Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Oct 10, 2026 2:32am UTC

cubic-dev-ai

All reported issues were addressed across 11 files

_{Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic}

…d clarify declared timeout params

greptile-apps · 2026-10-10T02:23:07Z

Confidence Score: 5/5

[High impact] The PR appears safe to merge; no actionable issue was established.

Summary

This PR keeps provider-owned timeout values separate from Sim’s request deadline.

Provider timeout inputs no longer set Sim’s deadline by default.
Redis blocks convert numeric inputs through their parameter mappers.
Audits flag selectors that rewrite inputs and tools that override HTTP verbs.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Read params.timeout] --> B{Tool declares timeout?}
  B -->|No| D[Use as millisecond deadline]
  B -->|Yes| C{timeoutParamIsDeadline?}
  C -->|Yes| D
  C -->|No| E[Keep as tool input]

_{Reviews (4) · Last reviewed commit: "fix(audits): reject compound assignments..." · Reviewed by Greptile}

waleedlatif1 · 2026-10-10T02:23:12Z

@greptile

waleedlatif1 · 2026-10-10T02:23:13Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-10T02:23:18Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

All reported issues were addressed across 11 files

_{Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic}

…cion

waleedlatif1 · 2026-10-10T02:27:43Z

@greptile

waleedlatif1 · 2026-10-10T02:27:45Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-10T02:27:51Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

All reported issues were addressed across 11 files

_{Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic}

…selectors

waleedlatif1 · 2026-10-10T02:32:55Z

@greptile

waleedlatif1 · 2026-10-10T02:32:56Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-10T02:33:00Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 11 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

cubic-dev-ai Bot reviewed Oct 10, 2026

View reviewed changes

Comment thread .agents/skills/add-tools/SKILL.md Outdated

Comment thread apps/sim/scripts/check-block-registry.ts Outdated

fix(audits): catch coercions under fallbacks in tools.config.tool, an…

8eb088c

…d clarify declared timeout params

cubic-dev-ai Bot reviewed Oct 10, 2026

View reviewed changes

Comment thread apps/sim/scripts/check-block-registry.ts Outdated

fix(audits): treat every value-deriving expression as a selector coer…

0055386

…cion

vercel Bot temporarily deployed to Preview October 10, 2026 02:27 Inactive

cubic-dev-ai Bot reviewed Oct 10, 2026

View reviewed changes

Comment thread apps/sim/scripts/check-block-registry.ts Outdated

fix(audits): reject compound assignments and increments on params in …

719c28c

…selectors

vercel Bot temporarily deployed to Preview October 10, 2026 02:32 Inactive

cubic-dev-ai Bot reviewed Oct 10, 2026

View reviewed changes

waleedlatif1 merged commit 5ae4dcd into staging Oct 10, 2026
48 checks passed

waleedlatif1 deleted the fix/guardrails-tools branch October 10, 2026 03:45

Conversation

waleedlatif1 commented Oct 10, 2026

Summary

Type of Change

Testing

Checklist

Uh oh!

vercel Bot commented Oct 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

greptile-apps Bot commented Oct 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Summary

Diagram

Uh oh!

waleedlatif1 commented Oct 10, 2026

Uh oh!

waleedlatif1 commented Oct 10, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 10, 2026

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

waleedlatif1 commented Oct 10, 2026

Uh oh!

waleedlatif1 commented Oct 10, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 10, 2026

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

waleedlatif1 commented Oct 10, 2026

Uh oh!

waleedlatif1 commented Oct 10, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 10, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This branch was previously deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vercel Bot commented Oct 10, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

greptile-apps Bot commented Oct 10, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading