The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Jun 8, 2026 4:06pm

PR Summary

Medium Risk
Login/signup redirect logic touches auth entry points (mitigated by existing validateCallbackUrl); Todoist block passes user API keys into external API calls as with other integrations.

Overview
Adds a Todoist workflow block (API-key auth) with eight operations—task CRUD/list/close, projects, and comments—wired through conditional sub-blocks and tool param mapping, plus registry registration and a TodoistIcon.

Login and signup pages now redirect in server components when a session exists (or auth is disabled), sending users to a validated callbackUrl or /workspace instead of showing the forms.

Dev-only CSP adds 'unsafe-eval' to script-src. Sandbox bundle build normalizes polyfill import paths on Windows and logs Bun build failures more verbosely.

^{Reviewed by Cursor Bugbot for commit 6cb9530. Bugbot is set up for automated code reviews on this repo. Configure here.}

Greptile Summary

This PR adds a complete Todoist integration (8 tools covering task CRUD, project listing, and comments) plus a few infrastructure fixes: active-session redirects moved from the middleware layer into Server Components, unsafe-eval added to the CSP only in dev mode, optimizeCss disabled in dev, and Windows path normalisation in the sandbox build script.

• Todoist integration (apps/sim/tools/todoist/, apps/sim/blocks/blocks/todoist.ts): eight new tools with correct user-only API-key visibility, proper encodeURIComponent on task IDs in URL paths, and shared mapping utilities for tasks, projects, and comments.
• Auth redirect refactor (proxy.ts, login/page.tsx, signup/page.tsx): middleware redirect removed in favour of Server Component getSession() checks; the login page is correct, but the signup page performs the session check after the registration-disabled guard, so authenticated users who visit /signup while registration is off see the error page instead of being sent to /workspace.
• Dev experience fixes (csp.ts, next.config.ts, build.ts): all scoped to non-production environments or tooling paths.

Confidence Score: 3/5

Safe to merge after fixing the signup-page guard ordering; the Todoist tools and infrastructure changes are solid.

The Todoist integration itself is well-structured and the auth changes on the login page are correct. However, moving the session redirect out of the middleware without matching the guard order in the signup page means authenticated users who visit /signup when registration is disabled will see an error message instead of being redirected — a concrete regression introduced by this PR.

apps/sim/app/(auth)/signup/page.tsx — session check must be reordered to run before the registration-disabled guard.

Important Files Changed

Sequence Diagram

sequenceDiagram
    participant User
    participant Middleware as proxy.ts (middleware)
    participant SC as Server Component
    participant TodoistAPI as Todoist REST API

    Note over User,Middleware: Auth redirect flow (login/signup)
    User->>Middleware: GET /login or /signup
    Middleware->>SC: next() (no session redirect)
    SC->>SC: getSession()
    alt has active session or auth disabled
        SC-->>User: redirect /workspace
    else no session
        SC-->>User: render login/signup form
    end

    Note over User,TodoistAPI: Todoist tool execution
    User->>SC: invoke Todoist block operation
    SC->>TodoistAPI: POST /tasks (create_task)
    TodoistAPI-->>SC: 200 + task JSON
    SC-->>User: mapped TodoistTask output

    SC->>TodoistAPI: POST /tasks/:id (update_task)
    TodoistAPI-->>SC: 200 + updated task
    SC-->>User: mapped TodoistTask output

    SC->>TodoistAPI: POST /tasks/:id/close (close_task)
    TodoistAPI-->>SC: 204 No Content
    SC-->>User: "{ success: true, taskId }"

    SC->>TodoistAPI: DELETE /tasks/:id (delete_task)
    TodoistAPI-->>SC: 204 No Content
    SC-->>User: "{ success: true, taskId }"

    SC->>TodoistAPI: POST /comments (add_comment)
    TodoistAPI-->>SC: 200 + comment JSON
    SC-->>User: mapped TodoistComment output

_{Reviews (1): Last reviewed commit: "commit" | Re-trigger Greptile}

@iamshubham1704 is attempting to deploy a commit to the Sim Team on Vercel.

A member of the Team first needs to authorize it.