fix(integrations): correct claims that overstated or invented provider behavior

- restore firecrawl's conditional country default; the server applies 'us'
  only when location is unset, and flattening it to the OpenAPI's bare
  default was the regression
- declare firecrawl's six undeclared subBlocks in inputs
- agentmail's justification claimed no trash exists; it does. The operative
  point stands: the endpoint takes no deletion-mode parameter
- drop apify's synthesized status; the sync 201 declares no status field,
  matching the runId removal this branch already made
- daytona documents no timeout default, and reserves 'combined output' for
  session commands, not these two
- elasticsearch's scheme guard is belt-and-braces: the transport rejects a
  scheme-less external URL before it resolves. Both the TSDoc and the
  user-facing error said otherwise.

Author: waleedlatif1

apps/sim/blocks/blocks/agentmail.ts

@@ -336,10 +336,14 @@ export const AgentMailBlock: BlockConfig = {
 
     // Delete Thread fields
     /**
-     * AgentMail's DELETE thread endpoint takes no deletion-mode parameter and its own
-     * description reads "Permanently deletes a thread and all of its messages." There is no
-     * trash to move a thread to, so this id — which used to render a dropdown defaulting to
-     * "No (move to trash)" — is now a read-only notice. Keeping the id claimed means the
+     * AgentMail's DELETE thread endpoint declares no deletion-mode parameter — its only
+     * documented inputs are the path ids and the `Authorization` header — and its own
+     * description reads "Permanently deletes a thread and all of its messages." So the choice
+     * this id used to render — a dropdown defaulting to "No (move to trash)" — could not
+     * change the request Sim sends, and named an outcome the endpoint does not document. It is
+     * now a read-only notice. (AgentMail does have a trash label — `include_trash` filters
+     * list results, `label_trash_read` is an API-key scope — but nothing in the delete
+     * endpoint's contract routes a thread there.) Keeping the id claimed means the
      * warning appears exactly where the misleading choice used to sit, and no future subBlock
      * inherits the orphaned 'true'/'false' value still stored in existing workflows.
      */

apps/sim/blocks/blocks/daytona.ts

@@ -285,7 +285,7 @@ export const DaytonaBlock: BlockConfig = {
       id: 'timeout',
       title: 'Timeout (seconds)',
       type: 'short-input',
-      placeholder: 'Timeout in seconds (defaults to 10)',
+      placeholder: 'Timeout in seconds (0 disables the server-side limit)',
       mode: 'advanced',
       condition: { field: 'operation', value: ['execute_command', 'run_code'] },
     },
@@ -600,7 +600,7 @@ export const DaytonaBlock: BlockConfig = {
     },
     result: {
       type: 'string',
-      description: 'Combined stdout/stderr output (execute command and run code operations)',
+      description: 'Standard output (execute command and run code operations)',
     },
     artifacts: { type: 'json', description: 'Run artifacts such as charts (run code operation)' },
     uploadedPath: {

apps/sim/blocks/blocks/firecrawl.ts

@@ -833,6 +833,13 @@ Example 2 - Product Data:
     urls: { type: 'json', description: 'Array of URLs for extraction or batch scraping' },
     jobId: { type: 'string', description: 'Job ID for status/cancel operations' },
     query: { type: 'string', description: 'Search query terms' },
+    sources: { type: 'json', description: 'Search result sources (web, news, images)' },
+    categories: {
+      type: 'json',
+      description: 'Search result categories to restrict web results to',
+    },
+    location: { type: 'string', description: 'Location to search from' },
+    country: { type: 'string', description: 'ISO country code for geo-targeting search results' },
     prompt: { type: 'string', description: 'Extraction prompt' },
     limit: { type: 'string', description: 'Result/page limit' },
     formats: { type: 'json', description: 'Output formats array' },
@@ -876,6 +883,8 @@ Example 2 - Product Data:
     removeBase64Images: { type: 'boolean', description: 'Remove base64 images, keep alt text' },
     blockAds: { type: 'boolean', description: 'Block ads and popups during parsing' },
     proxy: { type: 'string', description: 'Proxy mode (basic or auto)' },
+    maxConcurrency: { type: 'string', description: 'Maximum number of concurrent scrapes' },
+    ignoreInvalidURLs: { type: 'boolean', description: 'Skip URLs that are invalid for Firecrawl' },
     zeroDataRetention: { type: 'boolean', description: 'Enable zero data retention' },
   },
   outputs: {

apps/sim/tools/apify/apify.test.ts

@@ -125,6 +125,14 @@ describe('apify run_actor_sync response contract', () => {
     expect(apifyRunActorSyncTool.outputs?.runId).toBeUndefined()
   })
 
+  it('emits no fabricated run status — the sync body carries no status field', async () => {
+    for (const tool of [apifyRunActorSyncTool, apifyRunTaskTool]) {
+      const result = await tool.transformResponse!(jsonResponse([{ a: 1 }]))
+      expect(Object.hasOwn(result.output, 'status')).toBe(false)
+      expect(tool.outputs?.status).toBeUndefined()
+    }
+  })
+
   it('guards a non-array response body', async () => {
     const result = await apifyRunActorSyncTool.transformResponse!(jsonResponse({ error: 'nope' }))
     expect(result.output.items).toEqual([])

apps/sim/tools/apify/run_actor_sync.ts

@@ -92,7 +92,7 @@ export const apifyRunActorSyncTool: ToolConfig<RunActorParams, RunActorResult> =
       const errorText = await response.text()
       return {
         success: false,
-        output: { success: false, status: 'ERROR', items: [] },
+        output: { success: false, items: [] },
         error: `APIFY API error: ${errorText}`,
       }
     }
@@ -102,21 +102,25 @@ export const apifyRunActorSyncTool: ToolConfig<RunActorParams, RunActorResult> =
       success: true,
       output: {
         success: true,
-        status: 'SUCCEEDED',
         items: Array.isArray(items) ? items : [],
       },
     }
   },
 
   /**
-   * The sync endpoint answers with a bare dataset-items array and documents no run
-   * identifier — neither in the body nor in a response header (only the
-   * `X-Apify-Pagination-*` family is returned) — so no `runId` is emitted. Wiring a
-   * fabricated id into `apify_get_run` would 404 every time.
+   * The sync endpoint answers with a bare dataset-items array and documents neither a run
+   * identifier nor a run status — not in the body, and not in a response header (only the
+   * `X-Apify-Pagination-*` family is returned). So neither `runId` nor `status` is emitted:
+   * a fabricated id wired into `apify_get_run` would 404 every time, and a hardcoded
+   * `'SUCCEEDED'` would claim a terminal state nothing in the response reports. Whether a
+   * failed run can still answer 201 is unknown — the spec's 201 carries an empty description
+   * — so there is no honest replacement value to substitute.
    */
   outputs: {
-    success: { type: 'boolean', description: 'Whether the actor run succeeded' },
-    status: { type: 'string', description: 'Run status (SUCCEEDED, FAILED, etc.)' },
+    success: {
+      type: 'boolean',
+      description: "Whether the request returned dataset items (not the run's own terminal status)",
+    },
     items: { type: 'array', description: 'Dataset items produced by the run' },
   },
 }

apps/sim/tools/apify/run_task.ts

@@ -100,7 +100,7 @@ export const apifyRunTaskTool: ToolConfig<RunTaskParams, RunTaskResult> = {
       const errorText = await response.text()
       return {
         success: false,
-        output: { success: false, status: 'ERROR', items: [] },
+        output: { success: false, items: [] },
         error: `APIFY API error: ${errorText}`,
       }
     }
@@ -110,15 +110,20 @@ export const apifyRunTaskTool: ToolConfig<RunTaskParams, RunTaskResult> = {
       success: true,
       output: {
         success: true,
-        status: 'SUCCEEDED',
         items: Array.isArray(items) ? items : [],
       },
     }
   },
 
+  /**
+   * Same contract as `apify_run_actor_sync`: the task sync endpoint returns dataset items
+   * with no run identifier and no run status, so neither is synthesized here.
+   */
   outputs: {
-    success: { type: 'boolean', description: 'Whether the task run succeeded' },
-    status: { type: 'string', description: 'Run status (SUCCEEDED, FAILED, etc.)' },
+    success: {
+      type: 'boolean',
+      description: "Whether the request returned dataset items (not the run's own terminal status)",
+    },
     items: { type: 'array', description: 'Dataset items produced by the run' },
   },
 }

apps/sim/tools/apify/types.ts

@@ -5,8 +5,10 @@ import type { ToolResponse } from '@/tools/types'
  * endpoints.
  *
  * Apify documents that "If the Actor run exceeds 300 seconds, the HTTP response
- * will return the 408 status code (Request Timeout)" on both the actor and the
- * actor-task variant. Sim's own transport falls back to `options.timeout || 300000`
+ * will return the 408 status code (Request Timeout)" on the actor variant. The
+ * actor-task variant's prose is weaker — "The run must finish in 300 seconds
+ * otherwise the HTTP request fails with a timeout error" — and only its
+ * response-code list names 408. Sim's own transport falls back to `options.timeout || 300000`
  * in `lib/core/security/input-validation.server.ts` — the same number — so a run
  * that lands on the boundary is a race between Apify's structured 408 and a
  * generic `Request timed out after 300000ms` that names neither the actor nor the
@@ -59,7 +61,8 @@ export interface RunActorResult extends ToolResponse {
     success: boolean
     /** Absent for the sync endpoint, whose response carries no run identifier. */
     runId?: string
-    status: string
+    /** Absent for the sync endpoint, whose response carries no run status. */
+    status?: string
     datasetId?: string
     items?: unknown[]
   }
@@ -78,7 +81,6 @@ export interface RunTaskParams {
 export interface RunTaskResult extends ToolResponse {
   output: {
     success: boolean
-    status: string
     items: unknown[]
   }
 }

apps/sim/tools/daytona/execute_command.ts

@@ -50,7 +50,8 @@ export const daytonaExecuteCommandTool: ToolConfig<
       type: 'number',
       required: false,
       visibility: 'user-or-llm',
-      description: 'Timeout in seconds (defaults to 10 seconds)',
+      description:
+        'Maximum time in seconds to wait for the command to complete; 0 disables the server-side limit. Daytona documents no default, so leaving this blank uses whatever the toolbox daemon applies.',
     },
   },
 
@@ -93,6 +94,6 @@ export const daytonaExecuteCommandTool: ToolConfig<
       type: 'number',
       description: 'Exit code of the command (-1 if missing from the response)',
     },
-    result: { type: 'string', description: 'Combined stdout/stderr output of the command' },
+    result: { type: 'string', description: 'Standard output from the command' },
   },
 }

apps/sim/tools/daytona/run_code.ts

@@ -44,7 +44,8 @@ export const daytonaRunCodeTool: ToolConfig<DaytonaRunCodeParams, DaytonaRunCode
       type: 'number',
       required: false,
       visibility: 'user-or-llm',
-      description: 'Timeout in seconds (defaults to 10 seconds)',
+      description:
+        'Maximum time in seconds to wait for the code run to complete; 0 disables the server-side limit. Daytona documents no default, so leaving this blank uses whatever the toolbox daemon applies.',
     },
   },
 
@@ -88,7 +89,10 @@ export const daytonaRunCodeTool: ToolConfig<DaytonaRunCodeParams, DaytonaRunCode
       type: 'number',
       description: 'Exit code of the code run (-1 if missing from the response)',
     },
-    result: { type: 'string', description: 'Combined stdout/stderr output of the code run' },
+    result: {
+      type: 'string',
+      description: 'Standard output from the code (same as artifacts.stdout)',
+    },
     artifacts: {
       type: 'json',
       description: 'Artifacts produced by the run (e.g., matplotlib charts)',

apps/sim/tools/elasticsearch/utils.ts

@@ -299,27 +299,27 @@ const SELF_HOSTED_SCHEME_PATTERN = /^https?:\/\//i
 /**
  * Normalizes and validates a self-hosted host into an absolute origin.
  *
- * The scheme requirement is a credential-exposure control, not tidiness. A
- * host without one stays a **relative** URL, and the executor resolves every
- * tool URL as `new URL(endpointUrl, getBaseUrl())` — with Sim's own origin as
- * the base:
- *
- * ```
- * new URL('es.internal/products/_search', 'https://sim.ai')
- * // => https://sim.ai/es.internal/products/_search
- * new URL('//evil.example.com/x', 'https://sim.ai')
- * // => https://evil.example.com/x   (protocol-relative, inherits the scheme)
- * new URL('localhost:9200/products/_search', 'https://sim.ai')
- * // => protocol "localhost:", origin null
- * ```
- *
- * {@link buildAuthHeaders} attaches `Authorization: ApiKey …` or `Basic …`
- * regardless, so the caller's Elasticsearch credential is sent to Sim's public
- * origin — or, for the protocol-relative form, to an attacker's. The SSRF
- * guard does not catch it either, because the resolved host really is Sim.
- * Only a scheme makes the value absolute, so it is required rather than
- * guessed at: prefixing `https://` ourselves would silently redirect a
- * plaintext-only cluster and turn a typo into a different host.
+ * The scheme requirement is belt-and-braces, not the load-bearing control. A
+ * scheme-less host would be a **relative** URL, and the executor does resolve
+ * tool URLs against Sim's own origin (`new URL(endpointUrl, baseUrl)` in
+ * `tools/index.ts`) — which would send the credential {@link buildAuthHeaders}
+ * attaches to `https://sim.ai/es.internal/...`, or, for a protocol-relative
+ * `//evil.example.com/...`, to an attacker. That resolution is real but
+ * unreachable from here: `assertRequestUrlMatchesTrust` in
+ * `tools/request-transport.ts` runs first, parses every external tool URL with
+ * `new URL(url)` and **no base**, and pins the protocol to `http:`/`https:`.
+ * Both scheme-less forms throw on that parse, and `localhost:9200/...` parses
+ * but fails the protocol pin.
+ *
+ * What this check buys is the error the user sees. It fires at configuration
+ * time, names the field, and says what to type, instead of letting the request
+ * die later against the transport's generic "invalid external URL" rejection.
+ * Keep it for the message, and do not weaken the transport guard on the
+ * assumption that this one is holding the line — it is the other way round.
+ *
+ * The scheme is required rather than guessed at: prefixing `https://`
+ * ourselves would silently redirect a plaintext-only cluster and turn a typo
+ * into a different host.
  *
  * The parse that follows catches a scheme-ful value the URL parser still
  * cannot resolve (`https://`, `http://[`). The original string — not the
@@ -341,7 +341,7 @@ function normalizeSelfHostedHost(rawHost: unknown): string {
   if (!SELF_HOSTED_SCHEME_PATTERN.test(host)) {
     throw new Error(
       `Host must start with "http://" or "https://" (received "${host}"). ` +
-        'A host without a scheme is a relative URL and would send your Elasticsearch credential to Sim instead of your cluster.'
+        'A host without a scheme is not an absolute URL, so the request cannot be addressed to your cluster.'
     )
   }