feat(network): add organization outbound routing by waleedlatif1 · Pull Request #7786 · simstudioai/sim

waleedlatif1 · 2026-09-11T21:01:14Z

Summary

Add organization outbound routing to the existing validated HTTP helpers and guarded SDK transports, with isolated pools, TLS CONNECT, canonical ownership and fail-closed routing.
Migrate managed requests to explicit destination profiles and extend the existing boundary audit. Preserve supported streaming, uploads, retries, model endpoints and deployment proxies.
Combine session policies and outbound IP addresses in Security settings using shared components. Keep SSO separate and document transport coverage.
Keep credentials and organization assignments in operator configuration. Assigned routes reject unsupported remote sandbox, raw database and SDK transports; initial account OAuth and SDK-owned control traffic remain outside coverage. Activation is separate.
Depends on improvement(network): consolidate validated HTTP transports #7795. This PR contains the organization feature; the prerequisite contains reusable HTTP transport changes.

Type of Change

New feature

Testing

Full combined application regression passed 50,986 tests with 185 skipped before the staging sync. After the sync and final redirect-replay fix, 3,490 focused tests passed with 18 skipped.
All 26 workspace type checks, lint, 46 repository audits, block registry and docs manifest checks passed. Real Node and Bun socket tests cover TLS identity, destination pinning, default ports, proxies and cancellation.
Security settings were verified locally with synthetic data. CI on the new commit, deployed app/worker acceptance and connection coverage remain release gates.

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

vercel · 2026-09-11T21:01:23Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Sep 12, 2026 10:14am UTC

waleedlatif1 · 2026-09-11T21:01:41Z

@greptile

waleedlatif1 · 2026-09-11T21:01:42Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-11T21:01:47Z

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

waleedlatif1 · 2026-09-11T21:02:34Z

@greptile-apps please review this PR.

greptile-apps · 2026-09-11T21:06:56Z

Confidence Score: 4/5

The PR is not yet safe to merge because the redirect-replay change can turn normal large or streaming Request uploads into unbounded in-memory buffering or indefinitely stalled requests.

Findings

Request bodies buffer eagerly ▶

Summary

Resolves routes from canonical organization and workspace ownership and propagates them through guarded outbound transports.
Adds gateway, TLS CONNECT, proxy, destination-pinning, lifecycle, and routing coverage.
Migrates managed provider and integration requests to explicit validated destination profiles.
Adds organization network APIs, query hooks, and consolidated Security settings.
Updates enterprise and self-hosting documentation for outbound-address allowlisting and transport coverage.
Preserves fixes for the previously reviewed OAuth enrollment scope, custom-block publisher scope, and bounded AppConfig snapshot cache.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Resource[Workspace or organization resource] --> Scope[Canonical outbound organization scope]
  Scope --> Resolver[Outbound route resolver]
  Resolver -->|Assigned route| Gateway[Organization gateway pool]
  Resolver -->|Direct route| Environment[Environment proxy or direct transport]
  Gateway --> TLS[TLS CONNECT and destination pinning]
  Environment --> Validation[Validated destination profile]
  TLS --> Validation
  Validation --> Providers[Providers and SDK clients]
  Validation --> Tools[Tools and connectors]
  Validation --> Jobs[Background jobs and webhooks]
  Settings[Security settings] --> NetworkAPI[Organization network API]
  NetworkAPI --> Resolver

_{Reviews (9) · Last reviewed commit: "feat(network): add organization outbound..."}

waleedlatif1 · 2026-09-11T21:23:29Z

@greptile-apps please review this PR.

waleedlatif1 · 2026-09-11T21:23:30Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-11T21:23:35Z

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

waleedlatif1 · 2026-09-11T21:37:30Z

@greptile-apps please review this PR.

waleedlatif1 · 2026-09-11T21:37:31Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-11T21:37:39Z

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

waleedlatif1 · 2026-09-11T21:46:55Z

@greptile-apps please review this PR.

waleedlatif1 · 2026-09-11T21:46:56Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-11T21:47:01Z

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

waleedlatif1 · 2026-09-11T21:59:13Z

@greptile-apps please review this PR.

waleedlatif1 · 2026-09-11T21:59:14Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-11T21:59:21Z

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

waleedlatif1 · 2026-09-11T22:24:46Z

@greptile

waleedlatif1 · 2026-09-11T22:24:52Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-11T22:24:59Z

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

waleedlatif1 · 2026-09-11T22:37:59Z

@greptile

waleedlatif1 · 2026-09-11T22:38:03Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-11T22:38:10Z

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

waleedlatif1 · 2026-09-12T00:07:31Z

@greptile

waleedlatif1 · 2026-09-12T00:07:32Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-12T00:07:40Z

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

waleedlatif1 · 2026-09-12T00:09:14Z

@greptile

waleedlatif1 · 2026-09-12T09:57:44Z

@greptile

waleedlatif1 · 2026-09-12T09:57:45Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-12T09:58:01Z

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

waleedlatif1 · 2026-09-12T10:13:34Z

@greptile

waleedlatif1 · 2026-09-12T10:13:35Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-12T10:13:42Z

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

waleedlatif1 requested a review from a team as a code owner September 11, 2026 21:01

vercel Bot deployed to Preview September 11, 2026 21:02 View deployment

greptile-apps Bot reviewed Sep 11, 2026

View reviewed changes

Comment thread apps/sim/lib/credential-groups/standard-oauth-provider.ts Outdated

Comment thread apps/sim/lib/workflows/executor/execution-core.ts

vercel Bot temporarily deployed to Preview September 11, 2026 21:22 Inactive

greptile-apps Bot reviewed Sep 11, 2026

View reviewed changes

Comment thread apps/sim/lib/core/config/appconfig.ts Outdated

vercel Bot temporarily deployed to Preview September 11, 2026 21:37 Inactive

vercel Bot deployed to Preview September 11, 2026 21:48 View deployment

vercel Bot temporarily deployed to Preview September 11, 2026 21:58 Inactive

vercel Bot temporarily deployed to Preview September 11, 2026 22:24 Inactive

vercel Bot deployed to Preview September 11, 2026 22:38 View deployment

vercel Bot deployed to Preview September 12, 2026 00:08 View deployment

waleedlatif1 force-pushed the codex/organization-egress branch from 94d423e to 3b319c5 Compare September 12, 2026 09:57

waleedlatif1 changed the base branch from staging to codex/http-transport-foundation September 12, 2026 09:57

vercel Bot deployed to Preview September 12, 2026 09:59 View deployment

feat(network): add organization outbound routing

7169f79

waleedlatif1 force-pushed the codex/organization-egress branch from 3b319c5 to 7169f79 Compare September 12, 2026 10:13

vercel Bot deployed to Preview September 12, 2026 10:15 View deployment

Uh oh!

Conversation

waleedlatif1 commented Sep 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Type of Change

Testing

Checklist

Uh oh!

vercel Bot commented Sep 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

waleedlatif1 commented Sep 11, 2026

Uh oh!

waleedlatif1 commented Sep 11, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 11, 2026

Uh oh!

waleedlatif1 commented Sep 11, 2026

Uh oh!

greptile-apps Bot commented Sep 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 4/5

Findings

Summary

Diagram

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Sep 11, 2026

Uh oh!

waleedlatif1 commented Sep 11, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 11, 2026

Uh oh!

Uh oh!

waleedlatif1 commented Sep 11, 2026

Uh oh!

waleedlatif1 commented Sep 11, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 11, 2026

Uh oh!

waleedlatif1 commented Sep 11, 2026

Uh oh!

waleedlatif1 commented Sep 11, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 11, 2026

Uh oh!

waleedlatif1 commented Sep 11, 2026

Uh oh!

waleedlatif1 commented Sep 11, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 11, 2026

Uh oh!

waleedlatif1 commented Sep 11, 2026

Uh oh!

waleedlatif1 commented Sep 11, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 11, 2026

Uh oh!

waleedlatif1 commented Sep 11, 2026

Uh oh!

waleedlatif1 commented Sep 11, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 11, 2026

Uh oh!

waleedlatif1 commented Sep 12, 2026

Uh oh!

waleedlatif1 commented Sep 12, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 12, 2026

Uh oh!

waleedlatif1 commented Sep 12, 2026

Uh oh!

waleedlatif1 commented Sep 12, 2026

Uh oh!

waleedlatif1 commented Sep 12, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 12, 2026

Uh oh!

waleedlatif1 commented Sep 11, 2026 •

edited

Loading

vercel Bot commented Sep 11, 2026 •

edited

Loading

greptile-apps Bot commented Sep 11, 2026 •

edited

Loading