v0.6.33: polling improvements, jsm forms tools, credentials reactquery invalidation, HITL docs

[waleedlatif1]

• improvement(release): address comments (improvement(release): code cleanup #4069)
• fix(trigger): add @react-email/components to additionalPackages (fix(trigger): add @react-email/components to additionalPackages #4068)
• improvement(deploy): improve auto-generated version descriptions (improvement(deploy): improve auto-generated version descriptions #4075)
• improvement(polling): fix correctness and efficiency across all polling handlers (improvement(polling): fix correctness and efficiency across all polling handlers #4067)
• fix(credentials): add cross-cache invalidation for oauth credential queries (fix(credentials): add cross-cache invalidation for oauth credential queries #4076)
• feat(jsm): add ProForma/JSM Forms discovery tools (feat(jsm): add ProForma/JSM Forms discovery tools #4078)
• feat(trigger): add ServiceNow webhook triggers (feat(trigger): add ServiceNow webhook triggers #4077)
• docs(openapi): add Human in the Loop API endpoints (docs(openapi): add Human in the Loop API endpoints #4079)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview, Comment	Apr 9, 2026 9:01pm

[cursor]

PR Summary

Medium Risk
Changes touch webhook polling (Gmail/IMAP/Outlook/RSS) and add new ServiceNow/JSM endpoints, which can affect event ingestion correctness and external API behavior; however changes are scoped and largely additive with validation and tests added for workflow diff formatting.

Overview
Human-in-the-Loop API documentation expanded: OpenAPI now includes a new Human in the Loop tag and endpoints to list/get paused executions (/api/workflows/{id}/paused...) and fetch/resume pause contexts via /api/resume/..., plus docs updates describing async resume responses with jobId/statusUrl polling.

Jira Service Management Forms support added: Introduces three new JSM tools/endpoints (jsm_get_form_templates, jsm_get_form_structure, jsm_get_issue_forms) with corresponding Next.js API routes, tool configs, block UI params, and integration metadata updates.

Webhook/polling reliability improvements: Refines Gmail history polling (pagination, error handling, refresh historyId), overhauls IMAP polling to reuse a single connection and persist uidValidity per mailbox to avoid stale UIDs, adds Outlook pagination with retry and safer folder filtering, and improves RSS polling with ETag/Last-Modified caching, larger GUID history, and more robust item IDs.

Misc fixes and UX improvements: ServiceNow block now exposes triggers and registers a new servicenow webhook provider with secret verification and event matching; workflow deployment diff descriptions become more readable (field labels, capped output, edge/variable details) with extensive tests; credential mutations now invalidate OAuth credential queries; small cleanup in form submission stream draining, resume sync/async branching, schedule execute import, webhook polling lock handling, and a modal size tweak.

^{Reviewed by Cursor Bugbot for commit c393791. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit c393791. Configure here.}

[cursor]

IMAP drops legacy UID fallback causing email reprocessing

High Severity

The fetchNewEmails function no longer falls back to config.lastProcessedUid when determining the last processed email UID. This affects older IMAP webhooks that rely solely on lastProcessedUid for tracking, causing them to lose their position and re-process previously handled emails.

 

^{Reviewed by Cursor Bugbot for commit c393791. Configure here.}

[greptile-apps]

Greptile Summary

This release bundles several independent improvements: pagination fixes for Gmail (history API), IMAP (UIDVALIDITY tracking, shared client), and Outlook (hard-max pagination loop) polling handlers; cross-cache OAUTH_CREDENTIALS_KEY invalidation so credential mutations now bust the OAuth credential picker cache; new JSM ProForma/Forms discovery tools with proper input validation; and ServiceNow webhook triggers with a shared event-matching utility.

The polling refactors are generally well-structured — the releaseLock fix in the poll route and IMAP's shared-client pattern are clear improvements. The main concern is a cross-domain import of fetchWithRetry from @/lib/knowledge/documents/utils into Outlook polling code.

Confidence Score: 5/5

Safe to merge — all findings are P2 style/design suggestions with no blocking correctness issues.

The two issues raised are both P2: the cross-domain fetchWithRetry import is a code-organisation smell with no runtime impact, and the ServiceNow event-type set overlap is an edge-case documentation/UX concern rather than a data-correctness bug. All core logic changes (lock release, UIDVALIDITY tracking, Gmail pagination, credential cache invalidation) are sound.

apps/sim/lib/webhooks/polling/outlook.ts (cross-domain import), apps/sim/triggers/servicenow/utils.ts (ambiguous event sets)

Vulnerabilities

• ServiceNow webhook auth accepts either Authorization: Bearer or X-Sim-Webhook-Secret headers (apps/sim/lib/webhooks/providers/servicenow.ts). Both validate the same secret, so no credential bypass is possible, but the dual-header surface is worth documenting.
• JSM Forms API routes correctly use checkInternalAuth + validateJiraCloudId/validateJiraIssueKey guards before proxying. No injection surface identified.
• No secrets are logged or exposed in new code paths.

Important Files Changed

Filename	Overview
apps/sim/app/api/webhooks/poll/[provider]/route.ts	Fixes a lock-release gap by moving the acquire/release into a nested try-finally, ensuring the distributed lock is always freed even when pollProvider throws.
apps/sim/lib/webhooks/polling/gmail.ts	Adds paginated history-API fetching, restricts to messageAdded events, and refreshes historyId from the profile endpoint after an invalid-history error to prevent polling stalls.
apps/sim/lib/webhooks/polling/imap.ts	Shares one ImapFlow client between fetch and mark-as-read phases, adds UIDVALIDITY tracking to discard stale UIDs after folder resets, and fixes the messageFlagsAdd call to pass the UID directly.
apps/sim/lib/webhooks/polling/outlook.ts	Adds paginated Graph API fetching with a hard 200-email cap; replaces bare fetch with fetchWithRetry — but imports the utility from @/lib/knowledge/documents/utils, creating an unintended cross-domain dependency.
apps/sim/hooks/queries/credentials.ts	Adds OAUTH_CREDENTIALS_KEY cross-cache invalidation to create, update, and delete credential mutations so the OAuth picker updates immediately after credential changes.
apps/sim/hooks/queries/credential-sets.ts	Converts all mutation cache-invalidation callbacks from onSuccess to onSettled across 7 mutations, ensuring cache is reconciled even when a mutation fails.
apps/sim/triggers/servicenow/utils.ts	Shared event-matching logic for ServiceNow triggers; INCIDENT_CREATED and CHANGE_REQUEST_CREATED share generic event tokens (insert, created) that can match both trigger types when no table name is present in the payload.
apps/sim/lib/webhooks/providers/servicenow.ts	New ServiceNow webhook provider handler with token-based auth (accepts both Authorization Bearer and X-Sim-Webhook-Secret headers) and dynamic import of event-matching logic.
apps/sim/tools/jsm/get_issue_forms.ts	New JSM tool for listing ProForma forms attached to an issue; delegates to /api/tools/jsm/forms/issue with proper OAuth params.
apps/sim/app/api/tools/jsm/forms/issue/route.ts	API route for JSM issue forms with internal auth check, cloudId and issueKey validation, and well-structured error forwarding.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Cron: GET /api/webhooks/poll/provider] --> B{Auth OK?}
    B -- No --> Z[401 Unauthorized]
    B -- Yes --> C{Provider known?}
    C -- No --> Z2[404 Not Found]
    C -- Yes --> D[acquireLock provider-polling-lock]
    D -- Already locked --> E[202 Skipped]
    D -- Acquired --> F[pollProvider]
    F --> G{Provider}
    G -- gmail --> H[Gmail: paginated historyId loop - messageAdded filter only]
    G -- imap --> I[IMAP: shared ImapFlow client - UIDVALIDITY tracking]
    G -- outlook --> J[Outlook: paginated Graph API - hard cap 200 emails]
    G -- rss --> K[RSS: ETag / Last-Modified - MAX_GUIDS 500]
    H & I & J & K --> L[processEmails / trigger workflows]
    L --> M[releaseLock - always in finally]
    M --> N[200 Completed]

    subgraph ServiceNow Webhook
        SN1[POST /api/webhooks/provider/servicenow] --> SN2{verifyAuth Bearer or X-Sim-Webhook-Secret}
        SN2 -- fail --> SN3[401]
        SN2 -- pass --> SN4[matchEvent isServiceNowEventMatch]
        SN4 -- no match --> SN5[skip]
        SN4 -- match --> SN6[execute workflow]
    end

Loading

_{Reviews (1): Last reviewed commit: "docs(openapi): add Human in the Loop API..." | Re-trigger Greptile}

[greptile-apps]

Cross-domain import of fetchWithRetry

fetchWithRetry is only exported from @/lib/knowledge/documents/utils, a module scoped to the knowledge-base feature. Importing it here couples the webhook polling domain to an unrelated feature — any refactor or removal of the knowledge module would silently break Outlook polling.

The function should be lifted to a shared location (e.g. @/lib/core/utils/fetch) and imported from there in both the knowledge code and here.

Suggested change

	import { fetchWithRetry } from '@/lib/knowledge/documents/utils'
	import { fetchWithRetry } from '@/lib/core/utils/fetch'

[greptile-apps]

Ambiguous event-type sets across incident and change-request triggers

INCIDENT_CREATED and CHANGE_REQUEST_CREATED share the same generic tokens ('insert', 'created', 'create', 'after_insert', 'afterinsert'). When a payload arrives with no tableName field and no configuredTableName is set on the trigger, isServiceNowEventMatch will return true for both servicenow_incident_created and servicenow_change_request_created. Any workflow that users configure with the wrong default would fire on every insert from either table.

Consider requiring tableName in the payload or in trigger configuration before accepting generic event tokens, or document that table-name configuration is mandatory for users who have both trigger types active.