feat(oracle-epm): add guarded foundation by BillLeoutsakosvl346 · Pull Request #7469 · simstudioai/sim

BillLeoutsakosvl346 · 2026-09-04T01:32:53Z

Summary

Add the Oracle EPM integration-user credential with locally minted Basic authentication bound to one environment
Add guarded child-owned route, endpoint, returned-link, polling, and bounded file primitives without a product integration
Keep shared runtime behavior unchanged outside the additive credential descriptor and minter registrations

Type of Change

New feature

Testing

Targeted Vitest suites (18 files, 217 tests)
Root type-check and lint
Block-registry audit, all repository audits, and docs-manifest check

Deferred Platform Work

Generic credential resolution does not enforce that a selected credential matches the tool's registered service; address this in a separate platform-security PR before the first EPM child
Client-credential reconnect may read and decrypt stored credentials while looking for dataCenter on providers that do not declare it; address this in a separate orchestration cleanup PR

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

vercel · 2026-09-04T01:32:58Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Sep 4, 2026 11:47pm UTC

gitguardian · 2026-09-04T01:33:01Z

️✅ There are no secrets present in this pull request anymore.

If these secrets were true positive and are still valid, we highly recommend you to revoke them.
While these secrets were previously flagged, we no longer have a reference to the
specific commits where they were detected. Once a secret has been leaked into a git
repository, you should consider it compromised, even if it was deleted immediately.
Find here more information about risks.

^{_{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}}

greptile-apps · 2026-09-04T01:35:50Z

Greptile Summary

The PR adds a guarded Oracle EPM foundation without exposing a product integration.

Registers an environment-bound Oracle EPM integration-user credential and locally generates Basic authentication.
Adds validated route, endpoint, returned-link, polling, HTTP-client, error, and bounded file primitives.
Serializes download cleanup around multipart completion and presigned-link generation.
Enforces polling deadlines even when a child read does not settle cooperatively.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
apps/sim/lib/internal/oracle-epm/files.server.ts	Adds authorized, size-bounded file streaming and serialized multipart cleanup; the previously reported completion race is addressed.
apps/sim/lib/internal/oracle-epm/jobs.ts	Adds bounded polling with combined cancellation and deadline enforcement; the previously reported non-settling-reader overrun is addressed.
apps/sim/lib/internal/oracle-epm/client.server.ts	Implements the guarded Oracle EPM request boundary over validated endpoint declarations and destinations.
apps/sim/lib/internal/oracle-epm/endpoint.ts	Defines validated and frozen route, endpoint, query, header, retry, and response contracts.
apps/sim/lib/credentials/client-credential-accounts/minters/oracle-epm.ts	Locally generates bounded Basic-auth credentials and binds them to a normalized Oracle EPM environment.
apps/sim/lib/credentials/client-credential-accounts/descriptors.ts	Registers the Oracle EPM integration-user credential descriptor and required fields.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Credential[Oracle EPM integration-user credential] --> Minter[Local Basic-auth minter]
  Minter --> Destination[Normalized environment destination]
  Child[Future child-owned integration] --> Endpoint[Branded route and endpoint declaration]
  Endpoint --> Client[Guarded Oracle EPM client]
  Client --> Destination
  Client --> Links[Validated returned links]
  Client --> Files[Bounded file primitives]
  Client --> Polling[Deadline-bound job polling]

_{Reviews (14): Last reviewed commit: "fix(oracle-epm): reject raw backslashes ..." | Re-trigger Greptile}

cubic-dev-ai

All reported issues were addressed across 33 files

_{Re-trigger cubic}

BillLeoutsakosvl346 · 2026-09-04T01:53:11Z

@greptile

BillLeoutsakosvl346 · 2026-09-04T01:53:17Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-04T01:53:23Z

@cubic-dev-ai review this PR

@BillLeoutsakosvl346 I have started the AI code review. It will take a few minutes to complete.

BillLeoutsakosvl346 · 2026-09-04T01:56:11Z

@greptile

BillLeoutsakosvl346 · 2026-09-04T01:56:15Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-04T01:56:22Z

@cubic-dev-ai review this PR

@BillLeoutsakosvl346 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

All reported issues were addressed across 34 files

_{Re-trigger cubic}

BillLeoutsakosvl346 · 2026-09-04T02:10:20Z

@cubic-dev-ai review this PR

BillLeoutsakosvl346 · 2026-09-04T02:10:20Z

@greptile

cubic-dev-ai · 2026-09-04T02:10:27Z

@cubic-dev-ai review this PR

@BillLeoutsakosvl346 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

All reported issues were addressed across 34 files

_{Fix all with cubic | Re-trigger cubic}

BillLeoutsakosvl346 · 2026-09-04T02:24:28Z

@cubic-dev-ai review this PR

BillLeoutsakosvl346 · 2026-09-04T02:24:29Z

@greptile

cubic-dev-ai · 2026-09-04T02:24:34Z

@cubic-dev-ai review this PR

@BillLeoutsakosvl346 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

All reported issues were addressed across 34 files

_{Fix all with cubic | Re-trigger cubic}

BillLeoutsakosvl346 · 2026-09-04T23:05:31Z

@cubic
@greptile

cubic-dev-ai · 2026-09-04T23:05:41Z

@cubic
@greptile

@BillLeoutsakosvl346 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

1 issue found across 26 files

Confidence score: 4/5

In apps/sim/lib/internal/oracle-epm/endpoint.ts, validatePath rejects valid non-BMP literals such as 😀 because the surrogate-range check matches both halves, preventing them from being encoded; update the validation to reject only malformed UTF-16 pairs.

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/sim/lib/internal/oracle-epm/endpoint.ts">

<violation number="1" location="apps/sim/lib/internal/oracle-epm/endpoint.ts:57">
P2: When a child declares a valid non-BMP literal such as `😀`, `validatePath` rejects it because the surrogate-range branch matches both halves. Reject only malformed UTF-16 pairs so valid literals remain encodable.</violation>
</file>

_{You've manually re-run cubic several times on this PR. Each manual re-review checks the full PR again and counts toward your usage quota. To preserve your usage limits, we recommend letting cubic automatically review new commits.

Fix all with cubic | Re-trigger cubic}

BillLeoutsakosvl346 · 2026-09-04T23:21:31Z

@greptile

BillLeoutsakosvl346 · 2026-09-04T23:21:32Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-04T23:21:37Z

@cubic-dev-ai review this PR

@BillLeoutsakosvl346 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

All reported issues were addressed across 26 files

_{Heads up: you’re close to your flex budget. Increase your flex budget so reviews don’t pause.

You've manually re-run cubic several times on this PR. Each manual re-review checks the full PR again and counts toward your usage quota. To preserve your usage limits, we recommend letting cubic automatically review new commits.

Fix all with cubic | Re-trigger cubic}

BillLeoutsakosvl346 · 2026-09-04T23:31:44Z

@greptile

BillLeoutsakosvl346 · 2026-09-04T23:31:45Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-04T23:31:51Z

@cubic-dev-ai review this PR

@BillLeoutsakosvl346 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

All reported issues were addressed across 26 files

_{Heads up: you’re close to your flex budget. Increase your flex budget so reviews don’t pause.

You've manually re-run cubic several times on this PR. Each manual re-review checks the full PR again and counts toward your usage quota. To preserve your usage limits, we recommend letting cubic automatically review new commits.

Fix all with cubic | Re-trigger cubic}

BillLeoutsakosvl346 · 2026-09-04T23:41:00Z

@greptile

BillLeoutsakosvl346 · 2026-09-04T23:41:01Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-04T23:41:07Z

@cubic-dev-ai review this PR

@BillLeoutsakosvl346 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

All reported issues were addressed across 26 files

_{Heads up: you’re close to your flex budget. Increase your flex budget so reviews don’t pause.

You've manually re-run cubic several times on this PR. Each manual re-review checks the full PR again and counts toward your usage quota. To preserve your usage limits, we recommend letting cubic automatically review new commits.

Fix all with cubic | Re-trigger cubic}

BillLeoutsakosvl346 · 2026-09-04T23:48:13Z

@greptile

BillLeoutsakosvl346 · 2026-09-04T23:48:14Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-04T23:48:20Z

@cubic-dev-ai review this PR

@BillLeoutsakosvl346 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 26 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Heads up: you’re close to your flex budget. Increase your flex budget so reviews don’t pause.

You've manually re-run cubic several times on this PR. Each manual re-review checks the full PR again and counts toward your usage quota. To preserve your usage limits, we recommend letting cubic automatically review new commits.

Re-trigger cubic}

greptile-apps Bot reviewed Sep 4, 2026

View reviewed changes

Comment thread apps/sim/lib/internal/oracle-epm/files.server.ts

Comment thread apps/sim/lib/internal/oracle-epm/jobs.ts Outdated

cubic-dev-ai Bot reviewed Sep 4, 2026

View reviewed changes

vercel Bot temporarily deployed to Preview September 4, 2026 01:51 Inactive

Bill Leoutsakos added 2 commits September 3, 2026 18:55

feat(oracle-epm): add guarded foundation

287603d

fix(oracle-epm): harden guarded foundation

7ba3213

BillLeoutsakosvl346 force-pushed the feat/oracle-epm-foundation branch from ff77e58 to 7ba3213 Compare September 4, 2026 01:55

vercel Bot temporarily deployed to Preview September 4, 2026 01:56 Inactive

cubic-dev-ai Bot reviewed Sep 4, 2026

View reviewed changes

fix(oracle-epm): address follow-up review findings

c000b7b

vercel Bot temporarily deployed to Preview September 4, 2026 02:09 Inactive

cubic-dev-ai Bot reviewed Sep 4, 2026

View reviewed changes

Comment thread apps/sim/lib/internal/oracle-epm/client.server.ts Outdated

Comment thread apps/sim/lib/internal/oracle-epm/client.server.ts

fix(oracle-epm): validate raw returned-link paths

5e32a64

vercel Bot temporarily deployed to Preview September 4, 2026 02:24 Inactive

cubic-dev-ai Bot reviewed Sep 4, 2026

View reviewed changes

Comment thread apps/sim/lib/internal/oracle-epm/client.server.ts

fix(oracle-epm): reject unusable link policies

893d086

vercel Bot temporarily deployed to Preview September 4, 2026 22:25 Inactive

test(oracle-epm): cover credential setup guidance

8c5f26c

vercel Bot temporarily deployed to Preview September 4, 2026 22:39 Inactive

cubic-dev-ai Bot reviewed Sep 4, 2026

View reviewed changes

Comment thread apps/sim/lib/internal/oracle-epm/client.server.ts

Comment thread apps/sim/lib/internal/oracle-epm/client.server.ts Outdated

Comment thread apps/sim/lib/internal/oracle-epm/endpoint.ts

fix(oracle-epm): bound DNS waits and validate header values

7840639

vercel Bot temporarily deployed to Preview September 4, 2026 23:20 Inactive

cubic-dev-ai Bot reviewed Sep 4, 2026

View reviewed changes

Comment thread apps/sim/lib/internal/oracle-epm/client.server.ts

fix(oracle-epm): reject malformed returned-link entries

fbb5a4e

vercel Bot temporarily deployed to Preview September 4, 2026 23:31 Inactive

cubic-dev-ai Bot reviewed Sep 4, 2026

View reviewed changes

Comment thread apps/sim/lib/internal/oracle-epm/client.server.ts Outdated

fix(oracle-epm): validate typed returned-link queries

68df997

vercel Bot temporarily deployed to Preview September 4, 2026 23:40 Inactive

cubic-dev-ai Bot reviewed Sep 4, 2026

View reviewed changes

Comment thread apps/sim/lib/internal/oracle-epm/client.server.ts Outdated

fix(oracle-epm): reject raw backslashes before link parsing

9ec1be0

vercel Bot temporarily deployed to Preview September 4, 2026 23:47 Inactive

cubic-dev-ai Bot reviewed Sep 4, 2026

View reviewed changes

Uh oh!

Conversation

BillLeoutsakosvl346 commented Sep 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Type of Change

Testing

Deferred Platform Work

Checklist

Uh oh!

vercel Bot commented Sep 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gitguardian Bot commented Sep 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

️✅ There are no secrets present in this pull request anymore.

Uh oh!

greptile-apps Bot commented Sep 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Flowchart

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

BillLeoutsakosvl346 commented Sep 4, 2026

Uh oh!

BillLeoutsakosvl346 commented Sep 4, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 4, 2026

Uh oh!

BillLeoutsakosvl346 commented Sep 4, 2026

Uh oh!

BillLeoutsakosvl346 commented Sep 4, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 4, 2026

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

BillLeoutsakosvl346 commented Sep 4, 2026

Uh oh!

BillLeoutsakosvl346 commented Sep 4, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 4, 2026

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

BillLeoutsakosvl346 commented Sep 4, 2026

Uh oh!

BillLeoutsakosvl346 commented Sep 4, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 4, 2026

Uh oh!

BillLeoutsakosvl346 commented Sep 4, 2026 •

edited

Loading

vercel Bot commented Sep 4, 2026 •

edited

Loading

gitguardian Bot commented Sep 4, 2026 •

edited

Loading

greptile-apps Bot commented Sep 4, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading