feat(oci): add native Vision integration

[BillLeoutsakosvl346]

Summary

• Add native OCI Vision image analysis, batch create/get/cancel, project/model list/get, and scoped batch-output list/download: ten tools and three selectors.
• Reuse the OCI signing-key provider, authoritative credential resolution, trusted workspace context, and createOciClient from parent feat(oci): add native foundation #7444. This PR is stacked on feat/oci-foundation; no foundation, executor, generator, or Object Storage child changes.
• Support classification, object detection, English scene-text OCR, and face detection with bounded typed outputs. Accept authorized Sim files or explicit OCI object references; return downloaded output as a UserFile.
• Exclude training, resource mutations, video, document extraction, face recognition, automatic staging, and batch-file parsing.

Analysis and unkeyed job creation use one foundation attempt. A stable caller-supplied job retry token enables bounded tokenized retries; opt-in whole-block retries can replay paid analysis or duplicate unkeyed jobs. Job creation returns immediately, status reads do not poll, and cancellation only acknowledges the request. Output prefix membership does not guarantee exclusive job ownership when prefixes are reused.

Type of Change

• New integration

Testing

• Focused synthetic tests added for feature variants, authorization/provenance, limits/projections, model/selector filtering, pagination, job behavior, and scoped file downloads.
• Independent validate-integration/validate-selector review approved the exact final child revision; three child findings fixed and re-reviewed, with no remaining child correctness or security findings.
• Required metadata/docs/deployment generators completed. No local tests, builds, lint, type checks, or live OCI operations were run.
• Current-revision validation: run 34004741620, successful at e461983517e5586d9ba066c5fd5a5dbf1bf53ec2. All four jobs passed, including lint, repository audits, workspace type checking, all test shards, and app build. Greptile reports 5/5 for this exact revision; all review threads are resolved. Security and Vercel checks also passed. Cubic execution is excluded from the completion gate.
• Earlier runs: 34004112521 identified child test/type/format issues, fixed; 34004381566 and 34004570407 passed build and independent test shards but stopped at remaining formatting diagnostics, now fixed.
• This stacked base requires explicit workflow dispatch; absent automatic PR checks are not counted as passing.

Inspected revisions and API evidence

• Foundation: 3fa59e758f5d282e95978aca7482a91a4f3dcee5 (feat(oci): add native foundation #7444).
• Current child: e461983517e5586d9ba066c5fd5a5dbf1bf53ec2.
• Oracle Vision API /20220125: official specification.
• Object Storage: official specification.
• Oracle TypeScript SDK: 8ed954762e04a3329b057f4f634ae193c924efb3.
• Vision models, limits, IAM.

Review notes

• Foundation PR change requests: None.
• Scope deviations: None.
• Shared documentation extractor limitation: some aliased/spread output fields are omitted from generated MDX, while generated tool output metadata contains them. No shared generator change is bundled.
• Existing whole-block retry behavior is preserved and its paid replay risk documented. The generic handler does not preserve a returned retryable=false marker when constructing its error; no executor change is bundled. Existing shared upload-helper filename/storage-key logging is also unchanged and remains a platform concern.
• Greptile accepted the prefix-ownership finding as a false positive after reviewing the credential/IAM and documented location-membership boundaries. Its const-assertion finding was fixed. Both threads were individually answered and resolved; the final Greptile review confirms 5/5 with no outstanding findings.

Checklist

• Self-reviewed and independently reviewed integration scope
• Required generated artifacts refreshed
• GitHub validation completed successfully for the latest commit
• Greptile 5/5 for the latest commit

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Sep 6, 2026 1:48am UTC

[BillLeoutsakosvl346]

GitHub validation dispatched for current head 43e830b97da5ae534bf1c1c044d5e8f614eb5c89: https://github.com/simstudioai/sim/actions/runs/34004112521. Independent validation review approved the scoped implementation after fixes. Greptile is running for this revision; no local tests or checks were run.

[greptile-apps]

Greptile Summary

Adds a native OCI Vision integration spanning workflow configuration, ten executable tools, three resource selectors, credential registration, generated metadata, documentation, and deployment configuration.

• Supports image classification, object detection, scene-text OCR, and face detection.
• Adds batch job creation, status, cancellation, and scoped output retrieval.
• Adds bounded normalization, file validation, pagination, retry-token handling, and focused contract tests.
• The latest revision applies const assertions to fixed operation arrays while preserving mutable condition-array contracts through shallow copies.

Confidence Score: 5/5

The PR appears safe to merge, with no outstanding correctness, security, or repository-rule findings.

The const-assertion requirement is fully addressed at the current revision, and the manually resolved output-prefix thread required no code change after Greptile conceded that the documented behavior does not bypass OCI or workspace authorization.

Important Files Changed

Filename	Overview
apps/sim/blocks/blocks/oci_vision.ts	Defines the OCI Vision workflow block and now const-asserts fixed operation arrays while copying them where mutable condition arrays are required.
apps/sim/lib/internal/oci-vision/operations.ts	Implements bounded OCI Vision and Object Storage operations, including analysis, job management, discovery, and output retrieval.
apps/sim/lib/internal/oci-vision/image-input.ts	Validates authorized Sim image inputs and enforces supported image constraints.
apps/sim/lib/internal/oci-vision/normalizers.ts	Projects provider responses into bounded typed workflow outputs with explicit truncation metadata.
apps/sim/lib/selectors/server/providers/oci-vision.ts	Implements authorized, filtered OCI Vision project and model selectors.
apps/sim/tools/oci_vision/index.ts	Exports the ten OCI Vision tool definitions registered by the integration.
apps/sim/tools/oci_vision/download_image_job_output.ts	Defines bounded output download behavior that returns an OCI object as a Sim UserFile.
apps/sim/lib/internal/oci-vision/operations.test.ts	Covers provider contracts, limits, pagination, projections, job behavior, and output scoping.
apps/docs/content/docs/integrations/oci_vision.mdx	Documents all OCI Vision operations, inputs, outputs, limits, retry behavior, and output-prefix semantics.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Block[OCI Vision workflow block] --> Tool[Registered OCI Vision tool]
  Selector[Project and model selectors] --> Vision
  Tool --> Operation[Trusted in-process operation]
  Operation --> Auth[Resolved OCI signing credential]
  Auth --> Vision[OCI Vision API]
  Vision --> Result[Bounded normalized workflow output]
  Operation --> Storage[OCI Object Storage]
  Storage --> File[Authorized Sim UserFile]

Loading

_{Reviews (4): Last reviewed commit: "feat(oci): add native Vision integration" | Re-trigger Greptile}

[BillLeoutsakosvl346]

@greptile Please review the current head 343e8a1. This revision fixes the GitHub-reported selector count, string truncation bound, image metadata type, and selector detail narrowing, and applies GitHub formatting diagnostics.

[BillLeoutsakosvl346]

@greptile Please review b8a6277. The latest changes only apply GitHub formatting suggestions; prior build and both independent test shards passed. Please consider the evidence in the resolved prefix thread: Oracle IAM remains the object authorization boundary, and these tools explicitly provide location-scoped reads without claiming exclusive job authorship.

[BillLeoutsakosvl346]

@greptile Please review current head e461983. Const assertions are fixed with no shared changes. Both review threads have individual dispositions; the prefix finding was accepted as requiring no code change in your thread reply. GitHub validation has been dispatched for this exact revision.