fix: six pre-existing integration defects surfaced by the docs audit (#7195)

* fix(docs): pin the generator's sort locale to en-US

localeCompare with no locale argument uses the runtime default, which
varies with LANG and the ICU build. Against the real 254 catalog names,
tr-TR reorders 141 positions, et-EE 45, cs-CZ 2 and lt-LT diverges at
index 40 — so a contributor on any of those regenerates a different
integrations.json and fails CI with no obvious cause.

Pins en-US at all four sort sites. The committed artifacts are unchanged:
regenerating before and after leaves the tree byte-identical.

Adds a guard test asserting the committed catalog matches an explicit
en-US ordering, plus one that fails if an unpinned localeCompare returns.

* fix(vanta): remove the MIME Type field whose value was always discarded

The block rendered an advanced MIME Type input and forwarded it as the
tool's mimeType, but the upload path never reads it: file-input.ts sets
`resolved.contentType || userFile.type || input.mimeType || …`, and every
return path of downloadServableFileFromStorage yields a non-empty content
type — a literal, getMimeTypeFromExtension's GENERIC_MIME_TYPE fallback,
or resolveServableDocBytes' constants and getContentType fallback. The
placeholder claimed it was 'used when the file has no type of its own',
which never happens.

Removes the subBlock, its mapper write and its inputs entry, and marks the
tool param hidden so it is no longer advertised to the model on a path
where it cannot take effect. The param itself stays, because the base64
branch still reads it.

Letting a typed value win instead was rejected: for a compiled artifact
the storage-resolved type is the only one matching the bytes actually
sent, so an override would break the case the resolver exists to fix.

* fix(github): resolve the PR head SHA for file comments

github_comment sent commit_id as undefined for every file comment: the
param was hidden with no subBlock and no mapper write, so GitHub — which
marks commit_id required on POST /pulls/{n}/comments — answered 422 on a
path the commentType dropdown exposes.

When commitId is absent the tool now fetches the pull request first and
uses head.sha, mirroring how Jira resolves cloudId from domain.

Also removes the position param, which GitHub marks deprecated ("Use
line instead"); line is already a real subBlock.

* fix(google-drive): expose the page token so pagination is reachable

list, search, list_comments, list_permissions and list_revisions each
declared a hidden pageToken and forwarded it to Google, but the block had
no subBlock of that name and never has — so every list was capped at one
page and the nextPageToken output had nowhere to go.

Adds a per-operation Page Token field mirroring the block's existing
per-operation pageSize fields, collapses them onto the canonical
pageToken in the params mapper, and flips the tool param to user-only so
it is documented and settable.

* fix(confluence): stop documenting a cloudId users cannot supply

All 46 Confluence tools marked cloudId 'user-only', publishing it on 46
doc rows, but the block has no cloudId subBlock so no user could ever
fill it. createConfluenceClient already resolves the cloud id from the
domain through the shared Atlassian resolver, exactly as Jira does, and
Jira marks the same param hidden.

Marks cloudId hidden to match. domain stays user-only and settable — it
is now the only user-provided param on every Confluence tool.

* fix(docs): teach the source scanner about regex literals

blankStringsAndComments was a single regex with no concept of a regex
literal, so two shapes silently truncated a block's subBlock list:

  /don't/   the apostrophe opened a phantom string that swallowed the
            following entries
  /[}]/     the brace in the character class closed the enclosing object

Both returned a short list with no warning — a confident wrong answer,
which for the hidden-param filter means silently deleting a user-settable
row. No block file uses a regex literal today, so this was latent.

Replaces the regex with a linear scanner that distinguishes a regex
literal from a division by the previous significant character, blanks
regex bodies whole (their last character is arbitrary source, same reason
comments are blanked whole), and tracks ${} nesting so a backtick inside
a template expression cannot end the template early.

The scanner now returns null when it ends inside an unterminated
construct. All three call sites treat that as UNKNOWN rather than
guessing, so the filter switches off instead of stripping.

Generated artifacts are byte-identical and the warning count is unchanged.

* fix(github): gate the commit lookup on path, coerce line, name the failing field

Three corrections to the file-comment fix, from a validation sweep.

needsCommitLookup did not check `path`, and ran before the `path` branch in
request.url. A file comment with an empty File Path — reachable, since path
is not required on the block — went GET /pulls/{n} then POST /comments with
path undefined, a 422. On staging it posted to /pulls/{n}/reviews, which
GitHub documents as creating a pending review and where commit_id is
optional. The lookup is now gated on path, so only a request headed for
/comments triggers it.

The block has no tools.config.params, so `line` reached the tool as the
string the short-input produced while GitHub types it as an integer — file
comments would still have 422'd, one API call later. Coerced in
request.body, which runs at execution; anything non-finite is omitted
rather than sent as NaN.

readGitHubErrorMessage returned only the top-level message, so a 422 read
"Validation Failed" with no indication of which field was rejected. The
errors[] detail is now appended. Responses without errors[] are unchanged.

* test(github): cover the comment routing cases the gate changed

Adds the file_comment-without-a-path case (which the commit lookup now skips),
the untouched-block default where commentType is unset, a pr_comment carrying a
path, and the line coercion on both the direct and resolved-commit paths.

* fix(google-drive): let an agent feed the page token back in

A page token is an opaque continuation value produced by a previous tool
response, not an account-specific id the user has to supply, so 'user-only'
hid it from agent blocks: they saw nextPageToken in the result and could not
send it back, silently reporting page one as the whole answer. Every other
pagination token in the tool set is 'user-or-llm'.

Also covers the case the mapper guard actually defends — a per-operation page
token surviving an operation switch, which reaches inputs because
shouldSerializeSubBlock skips condition evaluation for advanced fields.

* docs(generator): name the load-bearing newline rule and report an unscannable source

- Record why '\\n' is in REGEX_ALLOWED_AFTER: formatters emit a binary '/' at
  end-of-line, so every line-leading '/' in blocks/*.ts is a real regex, including
  the ones in table.ts and table_v2.ts. Removing it silently mis-scans those two.
- Split a scanner failure out of the spread-only 'ids: null' case. Both scans come
  back empty for the same reason when blankStringsAndComments bails, so the mapper's
  renames were dropped with no warning; it now reports a parseError and warns. The
  spread case is unchanged, and its TSDoc no longer claims a cause that was false.
- Route every catalog sort through an exported compareCatalogNames so the ordering
  test exercises the generator's comparator instead of re-deriving it, and match
  localeCompare arguments whole so localeCompare() and a variable locale are caught.
- Note that downloadServableFileFromStorage guarantees a non-empty content type, so
  the Vanta mimeType fallback chain reads as deliberately defensive.

Artifacts regenerate byte-identically and the generator warning set is unchanged.

* fix(vanta): declare the removed uploadMimeType subblock as dropped

check-block-registry fails a PR that deletes a subblock id without a
migration entry, because a deployed workflow can still hold a value under
that id. The serializer already discards an orphan silently, but the repo's
contract is that the removal is declared rather than inferred.

Uses the _removed_ form, scoped to upload_document_file: the value has no
replacement field to move to.

* fix(github): run the two-phase PR comment on the secure transport

The file-comment flow posted its comment from `transformResponse` with a bare
global `fetch`, so that request carried no abort signal, no response ceiling and
no DNS/SSRF validation — cancelling a workflow still left the comment posted.

`transformResponse` cannot receive the signal; `directExecution` can. Both tools
now run the lookup and the POST through a new `secureGitHubRequest`, mirroring
`secureBitbucketRead`, with the signal forwarded to each. Routing, line coercion
and the `errors[]` detail are unchanged, and a failed response still throws an
error carrying `status`/`statusText`/`data` as the transport does.

Request bodies and the comment payload are explicitly typed instead of
`Record<string, any>`.

* fix(vanta): keep mimeType an ordinary upload parameter

`mimeType` was marked hidden, but `visibility: 'hidden'` is reserved for
system-injected params such as OAuth tokens. It also left the base64 upload path
with no way to set a content type, since `fileContent` is hidden too.

* fix(generator): lex regex-in-keyword-position and template interpolation

The scanner chose regex-vs-division from the previous significant character, so
a regex in operand position (`return /x/`, `typeof /x/`, `case /x/`, ...) lexed
as a division off the keyword's last letter and its body stayed in the
structural view; `azure_devops.ts` is inert today only because the braces in its
`return /^\d{4}-\d{2}-\d{2}$/` happen to balance.

The `${}` depth counter was also not string-aware, so a brace inside a quoted
expression miscounted, the closing backtick was lost and the block was reported
unreadable — which silently stops filtering resolver-derived hidden params.

Both scans now run on one set of lexer primitives: `${}` expressions are lexed
with the same string, comment, regex and template handling as top-level code.
Regenerated docs, tool metadata and the integration catalog are byte-identical
and the generator's warning count is unchanged.

* fix(github): stop forwarding the GitHub token across a redirect origin

secureGitHubRequest passed no redirectPolicy, and the transport only strips
credential headers when one is present, so an api.github.com redirect to another
origin carried the workspace's Authorization: Bearer header to the new host.

Adopts the standard policy already used by the internal Google Drive client.
stripAuthOnRedirect stays off: GitHub redirects same-origin for legitimate
reasons (a renamed repository answers 301), and dropping auth there would turn
a working call into a 401.

* fix(github): reject a fractional comment line instead of truncating it

toLineNumber ran Math.trunc, so line 3.9 posted the review comment on line 3 —
a silent change to what the caller asked for, on a field where landing on the
wrong line of the diff is invisible until someone reads the comment. A
non-integer now fails with a message naming the field, matching how a missing
head commit SHA fails on this path. Blank and unparseable input is still
omitted: line is optional and nothing usable was supplied.

* fix(github): select the comment endpoint by comment type, not by path

The endpoint was chosen by the presence of path, while the body was chosen by
commentType, so a pr_comment naming a file posted a review body to
POST /pulls/{n}/comments. GitHub documents body, commit_id and path as required
there, so that request can only ever 422 — it has been broken since before this
PR. The endpoint now follows the comment type: only a file comment carrying a
path uses /comments, everything else stays on /reviews. The test that codified
the broken routing is corrected, and the full type/path matrix is pinned.

* test(confluence): drop the cloudId visibility invariant test

Removed at request. The visibility change itself is unaffected; it loses
only the guard that would have caught a future edit reverting one of the
46 files.

* fix(github): send an explicit User-Agent and stop downgrading a redirected comment POST

`secureGitHubRequest` powers the GitHub comment tool's `directExecution`
path, which bypasses the declarative transport. Two behaviors the transport
provided did not survive the move.

User-Agent: the transport sets `User-Agent: Sim` on every request it formats
(`request-transport.ts`), and `secureFetchWithPinnedIP` adds none of its own —
it builds the request with raw `node:https` and passes headers through
verbatim. Production runs on Bun, whose `node:http` shim injects
`user-agent: Bun/x.y.z`, so GitHub does not reject these calls today; the
defect is that Sim's deliberate attribution is silently replaced by a runtime
version string, and that the tool depends on an undocumented runtime behavior
that does not hold under Node, where GitHub answers 403 "Request forbidden by
administrative rules". Set in the helper rather than in the tool's header map
so every future caller inherits it; a caller-supplied value still wins.

Redirect method: the policy was `mode: 'standard'`, under which
`resolveRedirectHop` rewrites a 301/302'd POST to a bodyless GET regardless of
origin. GitHub answers 301 within api.github.com for a renamed repository, so
commenting on a PR there would GET `/pulls/{n}/comments`, receive a JSON array,
fail the payload shape check, and report success with no comment created.
`legacy` keeps the method and body across that hop. Cross-origin credential
stripping is unaffected — the guarded follower strips Authorization,
Proxy-Authorization and Cookie whenever `sendCredentialsOnCrossOriginRedirect`
is false, in either mode.

* fix(vanta): drop the dead whenOperation from the removed-subblock entry

migrateBlockSubblockIds handles a _removed_ target before it consults
whenOperation, so the scope was never applied. Mine was the only _removed_
entry in the file carrying one.

Unconditional deletion is also what this case wants. Subblock values are
keyed by id and are not cleared when the operation changes, so a user who
filled the MIME field and then switched the block to another operation has
the value stored under that operation; a scoped delete would strand it
permanently. The field no longer exists for any operation, so it should go
regardless of the stored operation.

* fix(docs-gen): close a regex-vs-division gap and make three guards testable

`REGEX_ALLOWED_AFTER` was missing `'/'`, so a regex directly after a division
operator lexed as a second division: in `x / y / /[}]/` the character class was
left in the structural view and its `}` closed the enclosing object early,
truncating the block's subBlock ids with no warning. Add `'/'`, and guard the
`'+'`/`'-'` entries with a `++`/`--` lookbehind so a postfix update still reads
as a value and `i++ / 2` stays a division rather than a phantom regex that runs
to end-of-input and reports the block unreadable.

The `.`/`#` property guard and the `'\n'` entry both survived their mutants.
`counts.in / 2, m: preturn / 2` is self-cancelling — the mis-lexed regex closes
on the second slash and blanks nothing structural — so the fixtures now leave an
odd number of slashes on the line. The `'\n'` entry had no coverage at all: its
fixture is now the wrapped `.match(` newline `/re/` shape that `blocks/table.ts`
and `blocks/table_v2.ts` produce, which is what that entry (not the preceding
`(`, which the newline overwrites) actually decides. Its comment claimed a count
of line-leading regexes that drifts with the sources; restate it without one.

Drop the two locale tests that could not fail. CI runs under an `en-US` default,
where an unpinned `localeCompare` returns exactly what the pinned one does, so no
behavioural comparison discriminates; and asserting the committed
`integrations.json` against the comparator that produced it agrees by
construction. The source grep for a literal locale argument is the real guard.

Generated output is byte-identical and the extraction differential over
`apps/sim/blocks/blocks/` is empty.

Author: waleedlatif1

apps/docs/content/docs/en/integrations/confluence.mdx

@@ -46,6 +46,7 @@ List files and folders in Google Drive with complete metadata
 | `folderId` | string | No | The ID of the folder to list files from \(internal use\) |
 | `query` | string | No | Search term to filter files by name \(e.g. "budget" finds files with "budget" in the name\). Do NOT use Google Drive query syntax here - just provide a plain search term. |
 | `pageSize` | number | No | The maximum number of files to return \(default: 100\) |
+| `pageToken` | string | No | The page token to use for pagination |
 
 #### Output
 
@@ -484,6 +485,7 @@ Search for files in Google Drive using advanced query syntax (e.g., fullText con
 | --------- | ---- | -------- | ----------- |
 | `query` | string | Yes | Google Drive query string using advanced search syntax \(e.g., "fullText contains 'budget'", "mimeType = 'application/pdf'", "modifiedTime > '2024-01-01'"\) |
 | `pageSize` | number | No | Maximum number of files to return \(default: 100\) |
+| `pageToken` | string | No | Token for fetching the next page of results |
 
 #### Output
 
@@ -671,6 +673,7 @@ List all permissions (who has access) for a file in Google Drive
 | Parameter | Type | Required | Description |
 | --------- | ---- | -------- | ----------- |
 | `fileId` | string | Yes | The ID of the file to list permissions for |
+| `pageToken` | string | No | The page token to use for pagination |
 
 #### Output
 
@@ -720,6 +723,7 @@ List the revision history of a file in Google Drive
 | --------- | ---- | -------- | ----------- |
 | `fileId` | string | Yes | The ID of the file to list revisions for |
 | `pageSize` | number | No | Maximum number of revisions to return \(1-1000, default 200\) |
+| `pageToken` | string | No | The page token to use for pagination |
 
 #### Output
 
@@ -779,6 +783,7 @@ List comments on a file in Google Drive
 | `includeDeleted` | boolean | No | Whether to include deleted comments \(their content is stripped\) |
 | `pageSize` | number | No | Maximum number of comments to return \(1-100, default 20\) |
 | `startModifiedTime` | string | No | Only return comments modified after this RFC 3339 timestamp |
+| `pageToken` | string | No | The page token to use for pagination |
 
 #### Output
 

apps/docs/content/docs/en/integrations/google_drive.mdx

@@ -331,7 +331,7 @@ Upload an evidence file to a Vanta document. Requires credentials with the vanta
 | `documentId` | string | Yes | Unique ID of the document to attach the file to |
 | `file` | file | No | The evidence file to upload |
 | `fileName` | string | No | Optional file name override |
-| `mimeType` | string | No | MIME type of the file \(e.g., application/pdf\). Used only for base64 uploads; ignored for a file from the File input, whose content type is always resolved from storage. |
+| `mimeType` | string | No | MIME type of the file \(e.g., application/pdf\). Applies only to the base64 upload path; a file from the File input always sends the content type resolved from storage. |
 | `description` | string | No | Description of the uploaded evidence \(e.g., "Q3 access review evidence"\) |
 | `effectiveAtDate` | string | No | ISO 8601 date indicating when the document is effective from |
 

apps/docs/content/docs/en/integrations/vanta.mdx

@@ -0,0 +1,97 @@
+/**
+ * @vitest-environment node
+ */
+import { describe, expect, it, vi } from 'vitest'
+
+vi.mock('@/triggers', () => ({
+  getTrigger: () => ({ subBlocks: [] }),
+}))
+
+import { GoogleDriveBlock } from '@/blocks/blocks/google_drive'
+import { listTool } from '@/tools/google_drive/list'
+import { listCommentsTool } from '@/tools/google_drive/list_comments'
+import { listPermissionsTool } from '@/tools/google_drive/list_permissions'
+import { listRevisionsTool } from '@/tools/google_drive/list_revisions'
+import { searchTool } from '@/tools/google_drive/search'
+
+const paginationCases = [
+  { operation: 'list', subBlockId: 'pageToken', tool: listTool },
+  { operation: 'search', subBlockId: 'searchPageToken', tool: searchTool },
+  { operation: 'list_permissions', subBlockId: 'permissionsPageToken', tool: listPermissionsTool },
+  { operation: 'list_revisions', subBlockId: 'revisionsPageToken', tool: listRevisionsTool },
+  { operation: 'list_comments', subBlockId: 'commentsPageToken', tool: listCommentsTool },
+] as const
+
+describe('GoogleDriveBlock pagination', () => {
+  const buildParams = GoogleDriveBlock.tools.config.params!
+
+  describe.each(paginationCases)('$operation', ({ operation, subBlockId, tool }) => {
+    it('exposes a page token field scoped to the operation', () => {
+      expect(GoogleDriveBlock.subBlocks.find(({ id }) => id === subBlockId)).toMatchObject({
+        type: 'short-input',
+        mode: 'advanced',
+        condition: { field: 'operation', value: operation },
+      })
+    })
+
+    /**
+     * `pageToken` is the canonical tool param, so the `list` case would forward
+     * through `...rest` even without the mapper. The per-operation ids are the
+     * ones the mapper has to translate, and none of them may survive as-is.
+     */
+    it('forwards the page token to the tool under its own id', () => {
+      const params = buildParams({ operation, [subBlockId]: 'token-abc' }, undefined as never)
+
+      expect(params).toMatchObject({ pageToken: 'token-abc' })
+      if (subBlockId !== 'pageToken') expect(params[subBlockId]).toBeUndefined()
+    })
+
+    it('lets an agent feed a nextPageToken back in', () => {
+      expect(tool.params.pageToken?.visibility).toBe('user-or-llm')
+    })
+  })
+
+  it('does not leak a page token into operations that do not paginate', () => {
+    expect(
+      buildParams({ operation: 'get_file', pageToken: 'token-abc' }, undefined as never).pageToken
+    ).toBeUndefined()
+  })
+
+  /**
+   * `shouldSerializeSubBlock` short-circuits for `advanced` fields in basic display
+   * mode without evaluating `condition`, so a page token typed under one operation
+   * genuinely reaches `inputs` after the user switches to another. The mapper must
+   * pick the token belonging to the operation being run and drop the rest.
+   */
+  describe.each(paginationCases.filter(({ subBlockId }) => subBlockId !== 'pageToken'))(
+    '$subBlockId left over from a previous operation',
+    ({ subBlockId }) => {
+      it.each(['upload', 'get_file', 'list'])('is dropped under %s', (operation) => {
+        const params = buildParams({ operation, [subBlockId]: 'stale' }, undefined as never)
+
+        expect(params.pageToken).toBeUndefined()
+        expect(params[subBlockId]).toBeUndefined()
+      })
+    }
+  )
+
+  it('prefers the operation-owned token when a stale sibling is also present', () => {
+    const params = buildParams(
+      {
+        operation: 'search',
+        searchPageToken: 'search-token',
+        commentsPageToken: 'stale',
+        pageToken: 'stale-canonical',
+      },
+      undefined as never
+    )
+
+    expect(params.pageToken).toBe('search-token')
+    expect(params.commentsPageToken).toBeUndefined()
+    expect(params.searchPageToken).toBeUndefined()
+  })
+
+  it('declares pageToken as a block input', () => {
+    expect(GoogleDriveBlock.inputs.pageToken).toBeDefined()
+  })
+})

apps/sim/blocks/blocks/google_drive.test.ts

@@ -463,6 +463,14 @@ Return ONLY the query string - no explanations, no quotes around the whole thing
       placeholder: 'Number of results (default: 100, max: 100)',
       condition: { field: 'operation', value: 'list' },
     },
+    {
+      id: 'pageToken',
+      title: 'Page Token',
+      type: 'short-input',
+      placeholder: 'Token from a previous nextPageToken',
+      mode: 'advanced',
+      condition: { field: 'operation', value: 'list' },
+    },
     // Download File Fields - File Selector (basic mode)
     {
       id: 'downloadFileSelector',
@@ -905,6 +913,14 @@ Return ONLY the message text - no subject line, no greetings/signatures, no extr
       condition: { field: 'operation', value: 'list_permissions' },
       required: true,
     },
+    {
+      id: 'permissionsPageToken',
+      title: 'Page Token',
+      type: 'short-input',
+      placeholder: 'Token from a previous nextPageToken',
+      mode: 'advanced',
+      condition: { field: 'operation', value: 'list_permissions' },
+    },
     // Get File Content Fields
     {
       id: 'getContentFileSelector',
@@ -1073,6 +1089,14 @@ Return ONLY the query string - no explanations, no quotes around the whole thing
       mode: 'advanced',
       condition: { field: 'operation', value: 'search' },
     },
+    {
+      id: 'searchPageToken',
+      title: 'Page Token',
+      type: 'short-input',
+      placeholder: 'Token from a previous nextPageToken',
+      mode: 'advanced',
+      condition: { field: 'operation', value: 'search' },
+    },
     // Untrash File Fields
     {
       id: 'untrashFileSelector',
@@ -1191,6 +1215,14 @@ Return ONLY the query string - no explanations, no quotes around the whole thing
       mode: 'advanced',
       condition: { field: 'operation', value: 'list_revisions' },
     },
+    {
+      id: 'revisionsPageToken',
+      title: 'Page Token',
+      type: 'short-input',
+      placeholder: 'Token from a previous nextPageToken',
+      mode: 'advanced',
+      condition: { field: 'operation', value: 'list_revisions' },
+    },
     {
       id: 'getRevisionFileSelector',
       title: 'Select File',
@@ -1255,6 +1287,14 @@ Return ONLY the query string - no explanations, no quotes around the whole thing
       mode: 'advanced',
       condition: { field: 'operation', value: 'list_comments' },
     },
+    {
+      id: 'commentsPageToken',
+      title: 'Page Token',
+      type: 'short-input',
+      placeholder: 'Token from a previous nextPageToken',
+      mode: 'advanced',
+      condition: { field: 'operation', value: 'list_comments' },
+    },
     {
       id: 'includeDeleted',
       title: 'Include Deleted Comments',
@@ -1473,6 +1513,11 @@ Return ONLY the comment text - no explanations, no quotes, no extra formatting.`
           searchPageSize,
           revisionsPageSize,
           commentsPageSize,
+          pageToken,
+          searchPageToken,
+          permissionsPageToken,
+          revisionsPageToken,
+          commentsPageToken,
           getContentExportMimeType,
           exportMimeType,
           ...rest
@@ -1586,6 +1631,13 @@ Return ONLY the comment text - no explanations, no quotes, no extra formatting.`
         else if (params.operation === 'list_revisions') effectivePageSize = revisionsPageSize
         else if (params.operation === 'list_comments') effectivePageSize = commentsPageSize
 
+        let effectivePageToken: string | undefined = pageToken
+        if (params.operation === 'search') effectivePageToken = searchPageToken
+        else if (params.operation === 'list_permissions') effectivePageToken = permissionsPageToken
+        else if (params.operation === 'list_revisions') effectivePageToken = revisionsPageToken
+        else if (params.operation === 'list_comments') effectivePageToken = commentsPageToken
+        else if (params.operation !== 'list') effectivePageToken = undefined
+
         const effectiveQuery = params.operation === 'search' ? searchQuery : query
         const effectiveMimeType =
           params.operation === 'get_content'
@@ -1603,6 +1655,7 @@ Return ONLY the comment text - no explanations, no quotes, no extra formatting.`
           pageSize: effectivePageSize
             ? Number.parseInt(effectivePageSize as string, 10)
             : undefined,
+          pageToken: effectivePageToken?.trim() || undefined,
           query: effectiveQuery,
           mimeType: effectiveMimeType === 'auto' ? undefined : effectiveMimeType,
           type: shareType, // Map shareType to type for share tool
@@ -1660,6 +1713,7 @@ Return ONLY the comment text - no explanations, no quotes, no extra formatting.`
     // List operation inputs
     query: { type: 'string', description: 'Search query' },
     pageSize: { type: 'number', description: 'Results per page' },
+    pageToken: { type: 'string', description: 'Pagination token from a previous nextPageToken' },
     // Copy operation inputs
     newName: { type: 'string', description: 'New name for copied file' },
     // Update operation inputs

apps/sim/blocks/blocks/google_drive.ts

@@ -286,14 +286,6 @@ export const VantaBlock: BlockConfig<ToolResponse> = {
       condition: { field: 'operation', value: 'upload_document_file' },
       mode: 'advanced',
     },
-    {
-      id: 'uploadMimeType',
-      title: 'MIME Type',
-      type: 'short-input',
-      placeholder: 'e.g., application/pdf (used when the file has no type of its own)',
-      condition: { field: 'operation', value: 'upload_document_file' },
-      mode: 'advanced',
-    },
     {
       id: 'uploadDescription',
       title: 'Description',
@@ -930,7 +922,6 @@ export const VantaBlock: BlockConfig<ToolResponse> = {
             const normalizedFile = normalizeFileInput(rest.file, { single: true })
             if (normalizedFile) result.file = normalizedFile
             result.fileName = optionalString(rest.uploadFileName)
-            result.mimeType = optionalString(rest.uploadMimeType)
             result.description = optionalString(rest.uploadDescription)
             result.effectiveAtDate = optionalString(rest.effectiveAtDate)
             break
@@ -993,10 +984,6 @@ export const VantaBlock: BlockConfig<ToolResponse> = {
     uploadedFileId: { type: 'string', description: 'Uploaded file ID' },
     file: { type: 'json', description: 'Evidence file to upload' },
     uploadFileName: { type: 'string', description: 'Optional file name override' },
-    uploadMimeType: {
-      type: 'string',
-      description: 'MIME type override used when the uploaded content has no type of its own',
-    },
     uploadDescription: { type: 'string', description: 'Description of the uploaded evidence' },
     effectiveAtDate: { type: 'string', description: 'Effective date of the document (ISO 8601)' },
     frameworkMatchesAny: { type: 'string', description: 'Comma-separated framework ID filters' },

apps/sim/blocks/blocks/vanta.ts

@@ -70,6 +70,11 @@ export async function resolveVantaUploadFile(
         signal: context.signal,
       })
       context.signal?.throwIfAborted()
+      /**
+       * Every return path of `downloadServableFileFromStorage` yields a non-empty content
+       * type, so `resolved.contentType` always wins. The remaining operands are defensive
+       * fallbacks kept in place in case that guarantee is ever relaxed.
+       */
       return {
         buffer: resolved.buffer,
         fileName: input.fileName || userFile.name,

apps/sim/lib/internal/vanta/file-input.ts

@@ -292,6 +292,13 @@ export const SUBBLOCK_ID_MIGRATIONS: Record<string, readonly SubblockIdMigration
    * dropped outright.
    */
   sap_concur: [{ from: 'forwardId', to: '_removed_forwardId' }],
+  /**
+   * `uploadMimeType` was an advanced MIME Type input on Upload Document File whose
+   * value the upload path never read: the content type is resolved from storage and
+   * that resolution is never empty, so the field's value lost the `||` chain every
+   * time. Dropped rather than renamed — there is no field for the value to move to.
+   */
+  vanta: [{ from: 'uploadMimeType', to: '_removed_uploadMimeType' }],
 }
 
 /** Reads the value out of a stored subblock entry, tolerating a bare value. */

apps/sim/lib/workflows/migrations/subblock-migrations.ts

@@ -68,7 +68,7 @@ export const confluenceAddLabelTool: InternalToolConfig<
     cloudId: {
       type: 'string',
       required: false,
-      visibility: 'user-only',
+      visibility: 'hidden',
       description:
         'Confluence Cloud ID for the instance. If not provided, it will be fetched using the domain.',
     },

apps/sim/tools/confluence/add_label.ts

@@ -84,7 +84,7 @@ export const confluenceCreateBlogPostTool: InternalToolConfig<
     cloudId: {
       type: 'string',
       required: false,
-      visibility: 'user-only',
+      visibility: 'hidden',
       description:
         'Confluence Cloud ID for the instance. If not provided, it will be fetched using the domain.',
     },