v0.5.35: helm updates, copilot improvements, 404 for docs, salesforce fixes, subflow resize clamping

[waleedlatif1]

• fix(workflow-state, copilot): prevent copilot from setting undefined state, fix order of operations for copilot edit workflow, add sleep tool (fix(workflow-state, copilot): prevent copilot from setting undefined state, fix order of operations for copilot edit workflow, add sleep tool #2440)
• fix(condition): async execution isolated vm error (fix(condition): async execution isolated vm error #2446)
• fix(auth): added same-origin validation to forget password route, added confirmation for disable auth FF (fix(auth): added same-origin validation to forget password route, added confirmation for disable auth FF #2447)
• feat(compare-schema): ci check to make sure schema.ts never goes out of sync with migrations (feat(compare-schema): ci check to make sure schema.ts never goes out of sync with migrations #2449)
• fixing the useWbehookManangement call to only call the loadwebhookorgenerateurl function when the useWebhookurl flag is true
• fix(salesforce): updated to more flexible oauth that allows production, developer, and custom domain salesforce orgs (fix(oauth): updated oauth providers that had unstable reference IDs leading to duplicate oauth records #2441) (fix(salesforce): updated to more flexible oauth that allows production, developer, and custom domain salesforce orgs (#2441) #2444)
• fixing a react component:
• feat(docs): added 404 page for the docs (feat(docs): added 404 page for the docs #2450)
• fixing lint errors
• Revert "fix(salesforce): updated to more flexible oauth that allows production, developer, and custom domain salesforce orgs (fix(oauth): updated oauth providers that had unstable reference IDs leading to duplicate oauth records #2441) (fix(salesforce): updated to more flexible oauth that allows production, developer, and custom domain salesforce orgs (#2441) #2444)" (Revert "fix(salesforce): updated to more flexible oauth that allows production, developer, and custom domain salesforce orgs (#2441) (#2444)" #2453)
• fix(notifs): inactivity polling filters, consolidate trigger types, minor consistency issue with filter parsing (fix(notifs): inactivity polling filters, consolidate trigger types, minor consistency issue with filter parsing #2452)
• improvement(helm): added SSO and cloud storage variables to helm charts (improvement(helm): added SSO and cloud storage variables to helm charts #2454)
• fix(ui): fixed visibility issue on reset password page (fix(ui): fixed visibility issue on reset password page #2456)
• fix(blog): revert back to using next image tags in blog (fix(blog): revert back to using next image tags in blog #2458)
• fix(blog): add back unoptimized tag, fix styling (fix(blog): add back unoptimized tag, fix styling #2461)
• improvement(subflow): adding clamps for subflow drag and drops of blocks (improvement(sub flow): adding clamps for subflow drag and drops of blocks #2460)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Review	Updated (UTC)
docs	Skipped		Dec 18, 2025 11:58pm

[greptile-apps]

Greptile Summary

• Implements comprehensive fixes for copilot state management and adds sleep tool functionality, addressing critical issues where copilot could set undefined workflow state and order-of-operations problems in workflow editing
• Consolidates Salesforce tool type definitions into centralized types.ts file and adds comprehensive notification filtering improvements, including same-origin validation for password reset security
• Enhances Helm chart configuration with SSO and cloud storage variables for AWS S3 and Azure Blob, plus adds CI schema validation to prevent migration drift

Important Files Changed

Filename	Overview
apps/sim/lib/workflows/diff/diff-engine.ts	Added critical validation to prevent invalid block IDs from corrupting workflow state
apps/sim/lib/copilot/tools/server/workflow/edit-workflow.ts	Fixed order of operations for copilot workflow editing with two-pass processing and block ID validation
apps/sim/tools/salesforce/types.ts	Centralized Salesforce tool type definitions to reduce duplication and improve maintainability
apps/sim/executor/handlers/condition/condition-handler.ts	Replaced isolated VM execution with tool execution to fix async execution errors
apps/sim/app/api/auth/forget-password/route.ts	Added same-origin validation to prevent open redirect vulnerabilities

Confidence score: 4/5

• This PR requires careful review due to complex copilot state management changes and security fixes
• Score reflects the critical nature of workflow state corruption prevention and the extensive refactoring across multiple Salesforce tool files
• Pay close attention to the diff engine validation logic and copilot editing order of operations fixes

[greptile-apps]

Additional Comments (2)

1. apps/sim/tools/salesforce/get_accounts.ts, line 68-94 (link)

   style: complex JWT decoding logic is duplicated - consider using the imported getInstanceUrl utility

   _{Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!}

2. apps/sim/tools/salesforce/create_account.ts, line 125-157 (link)

   style: Complex inline instance URL extraction duplicates the imported getInstanceUrl utility function. Should this logic use the imported getInstanceUrl utility instead?

   _{Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!}

_{66 files reviewed, 3 comments}

_{Edit Code Review Agent Settings | Greptile}