feat(latex): add LaTeX integration with PDF compilation tool, block, and docs by waleedlatif1 · Pull Request #4972 · simstudioai/sim

waleedlatif1 · 2026-06-11T18:29:39Z

Summary

Add latex_compile tool that compiles LaTeX source into a PDF via the LaTeX-on-HTTP service (no OAuth or API key required)
Internal /api/tools/latex route compiles upstream, stores the PDF as an execution file (uploadExecutionFile, with StorageService fallback), and surfaces TeX errors (! lines) on failed builds
Supports compiler selection (pdflatex, xelatex, lualatex, platex, uplatex, context) and supporting resources (images, included .tex files, .bib bibliographies) via content/base64/url
New LaTeX block with contract-bound validation (lib/api/contracts/tools/latex.ts), BlockMeta templates + skills, LaTeX logo icon, and generated docs with manual intro

Type of Change

New feature

Testing

Tested the compile service live (success, compile-error, and multi-resource payloads); typecheck, biome, check:api-validation:strict, and block/registry test suites all pass

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

vercel · 2026-06-11T18:29:45Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Jun 11, 2026 7:55pm

waleedlatif1 · 2026-06-11T18:29:50Z

@greptile

cursor · 2026-06-11T18:29:50Z

PR Summary

Medium Risk
Compile sends user LaTeX and attachments to a third-party host and adds a new authenticated upload route with large payloads and remote resource URLs, though it follows existing tool patterns.

Overview
Adds a LaTeX workflow integration (no API key) so agents can compile documents to PDF and query TeX Live packages/fonts.

Compile path: New latex_compile tool and authenticated POST /api/tools/latex proxy to LaTeX-on-HTTP (latex.ytotech.com), with Zod validation (source size, resource paths/URLs), timeouts, PDF size limits, 422 responses with extracted TeX ! log snippets on build failures, and storage via execution uploads or general storage fallback.

Workflow UI: New LaTeX block with operations for compile (compiler choice, JSON resources), package search/detail, and font listing; wired through block/tool registries, integrations.json, LatexIcon, and docs (latex.mdx + nav) including a third-party data-handling warning.

^{Reviewed by Cursor Bugbot for commit 9c98876. Configure here.}

waleedlatif1 · 2026-06-11T18:29:51Z

@cursor review

waleedlatif1 · 2026-06-11T18:36:03Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 24fd735. Configure here.}

waleedlatif1 · 2026-06-11T18:40:57Z

@greptile

greptile-apps · 2026-06-11T18:45:06Z

Greptile Summary

This PR adds a full LaTeX integration: a latex_compile tool that proxies compilation to the public LaTeX-on-HTTP service, three lookup tools (search_packages, get_package, list_fonts), a block with four operations, and accompanying docs with a third-party disclosure note.

The compile route is well-guarded with a 50 s AbortSignal timeout, 25 MB PDF size limit, TeX error extraction from compiler log files, and a dual storage path (execution file context or StorageService fallback).
The Zod contract enforces path-traversal prevention, http/https-only resource URLs, and min(1) guards on resource content and file fields.
The three lookup tools (search_packages, list_fonts, get_package) call latex.ytotech.com directly via the tool executor's secureFetchWithPinnedIP path (SSRF-protected, 5-minute fallback timeout).

Confidence Score: 5/5

Safe to merge; the compile route is well-bounded and the lookup tools call an unauthenticated public read API with SSRF protection already in place.

The new code adds a clearly scoped integration with no auth state, no database writes, and no mutations to existing paths. Previous review rounds caught and fixed the substantive issues. The two remaining observations are non-blocking style/performance notes.

apps/sim/tools/latex/search_packages.ts — worth investigating whether the upstream /packages endpoint supports a query parameter to avoid downloading the full TeX Live list on every search call.

Important Files Changed

Filename	Overview
apps/sim/app/api/tools/latex/route.ts	New API route that proxies compile requests to latex.ytotech.com; includes proper timeout (50 s AbortSignal), payload size limits, TeX error extraction from log files, and dual storage paths (execution file vs StorageService fallback). Well-guarded.
apps/sim/lib/api/contracts/tools/latex.ts	Zod contract for the compile request; includes min(1) guards on resource content/file, path traversal refine, and http/https-only URL refine. Minor: superRefine attaches cross-field error to the path property rather than the resource object.
apps/sim/tools/latex/compile.ts	Client-side tool config for latex_compile; routes through the internal API route, correctly injects _context for execution file storage, and handles both pdfFile and pdfUrl fallback in transformResponse.
apps/sim/tools/latex/search_packages.ts	Fetches the full TeX Live package list on every call (no query forwarded to upstream) and filters client-side; functionally correct but downloads a large payload per search.
apps/sim/tools/latex/get_package.ts	Direct lookup to upstream /packages/{name} endpoint; correct error handling with !response.ok
apps/sim/tools/latex/list_fonts.ts	Fetches font list and filters client-side; includes ok/error guard, maxResults clamping, and correct totalMatches reporting on pre-truncation count.
apps/sim/tools/latex/types.ts	Types for all four LaTeX tools; pdf output typed as UserFile
apps/sim/blocks/blocks/latex.ts	Block config with four operations, proper conditional subBlock rendering, JSON parse guard on resources, and eight BlockMeta templates and skills.

_{Reviews (11): Last reviewed commit: "improvement(latex): make relatedPackages..." | Re-trigger Greptile}

greptile-apps · 2026-06-11T18:45:17Z

Greptile Summary

This PR adds a full LaTeX integration — a latex_compile tool, an internal /api/tools/latex proxy route, a LaTeX block with templates and skills, icon assets, and docs. The implementation follows existing tool/block patterns well, with solid input validation (Zod contract with superRefine for the exactly-one-of resource constraint), proper error extraction from compiler log files, and a storage fallback for non-execution contexts.

Route & tool: The API route proxies LaTeX source to latex.ytotech.com, reads the resulting PDF into a bounded buffer (MAX_PDF_BYTES = 25 MB), and stores it via uploadExecutionFile or StorageService, returning a file object and URL to the caller.
Contract & validation: latexCompileBodySchema enforces size limits on source and resources, an enum on supported compilers, and mutually exclusive resource content fields — however, resource path values are not guarded against ../ traversal sequences, and url resources are forwarded to the external service without restricting schemes or host ranges.
Fetch reliability: The upstream fetch to latex.ytotech.com is missing an explicit AbortSignal timeout, unlike other tool routes (e.g. TTS) that use AbortSignal.timeout(); the Vercel maxDuration = 60 is the only backstop.

Confidence Score: 4/5

The new LaTeX integration is well-structured and follows the project's tool/block patterns. The main areas to revisit before merging are the missing fetch timeout on the upstream call and the lack of filtering on url/path resource fields before they are forwarded to the external compilation service.

The integration adds no regressions to existing functionality. The two resource-field issues (unfiltered url and unsanitized path) only affect the external latex.ytotech.com service on the current deployment topology, but could have broader impact if the service is ever self-hosted. The missing AbortSignal is a reliability gap that Vercel's maxDuration partially mitigates. All three are straightforward to fix.

apps/sim/app/api/tools/latex/route.ts and apps/sim/lib/api/contracts/tools/latex.ts need attention for the timeout and resource validation gaps.

Security Review

Unfiltered url resources forwarded to external service (apps/sim/app/api/tools/latex/route.ts): Resource entries with a url field are passed verbatim to latex.ytotech.com, which fetches them during compilation. No scheme (https-only) or host filtering is applied. If the service is self-hosted on an internal network, this could allow probing of unreachable hosts.
Resource path traversal (apps/sim/lib/api/contracts/tools/latex.ts): path values like ../../secret.sty pass schema validation and are forwarded to the compilation sandbox without sanitization against .. segments.

Important Files Changed

Filename	Overview
apps/sim/app/api/tools/latex/route.ts	Core API route that proxies compilation to latex.ytotech.com and stores the PDF; missing an AbortSignal timeout on the upstream fetch call and resource paths/URLs are forwarded to the external service without sanitization
apps/sim/lib/api/contracts/tools/latex.ts	Zod contract for the LaTeX compile body; validates resource fields well (exactly-one-of enforcement via superRefine) but resource path has no guard against ../ traversal sequences
apps/sim/tools/latex/compile.ts	Tool config that calls the internal /api/tools/latex route; response transformation and output mapping look correct
apps/sim/tools/latex/types.ts	Type definitions for compile params, resources, and response; clean, minimal, and consistent with the rest of the tool layer
apps/sim/blocks/blocks/latex.ts	Block config with sub-blocks, templates, and skills; well-structured with correct params coercion in tools.config.params and comprehensive BlockMeta templates
apps/sim/lib/integrations/integrations.json	Integration metadata entry for LaTeX; correctly set as authType none with documents integrationType
apps/docs/content/docs/en/integrations/latex.mdx	Documentation page for the LaTeX integration; content and parameter tables are accurate

Sequence Diagram

sequenceDiagram
    participant Client as Sim Workflow Executor
    participant Route as /api/tools/latex (Next.js)
    participant Upstream as latex.ytotech.com
    participant Storage as StorageService / uploadExecutionFile

    Client->>Route: POST /api/tools/latex
    Route->>Route: checkInternalAuth + Zod validation
    Route->>Upstream: POST /builds/sync
    Upstream-->>Route: 200 application/pdf OR 400 JSON
    alt Compile success
        Route->>Route: readResponseToBufferWithLimit
        Route->>Storage: uploadExecutionFile or StorageService.uploadFile
        Storage-->>Route: url + path
        Route-->>Client: pdfFile, pdfUrl, fileName, compiler
    else Compile error
        Route->>Route: extractCompilationErrors(log_files)
        Route-->>Client: 422 error with TeX error lines
    else Upstream error
        Route-->>Client: 502 service error
    end

_{Reviews (2): Last reviewed commit: "fix(latex): surface extracted TeX errors..." | Re-trigger Greptile}

greptile-apps · 2026-06-11T18:45:34Z

Greptile Summary

This PR adds a complete LaTeX integration — a latex_compile tool and matching block — that proxies LaTeX source to the public latex.ytotech.com compilation service and stores the resulting PDF as an execution file.

API route (/api/tools/latex): validates input via a Zod contract, forwards the payload to the upstream compile service, extracts TeX error lines from the compiler log on failure, and stores the PDF through uploadExecutionFile (with a StorageService fallback).
Tool & block: full ToolConfig, BlockConfig, BlockMeta templates/skills, icons in both sim and docs, and auto-generated docs — all wired into the block and tool registries.
Contract: well-structured with size limits (1 MB source, 25 resources, 512-char path) and a superRefine check enforcing exactly one content type per resource.

Confidence Score: 4/5

Safe to merge as-is; the integration is fully wired and functional, with two non-blocking quality items worth addressing in a follow-up.

The route, tool, block, and registry additions are well-structured and follow the project's existing patterns. The fetch to latex.ytotech.com lacks an AbortSignal timeout, so a slow or hung external service will hold a serverless slot for the full 60-second window rather than returning cleanly. User LaTeX source is forwarded to that public third-party service with no in-app disclosure, which is an architectural decision that should at minimum be surfaced in documentation. Neither issue causes incorrect behavior under normal conditions.

apps/sim/app/api/tools/latex/route.ts (fetch timeout and third-party disclosure) and apps/sim/tools/latex/types.ts (pdf typed as unknown).

Security Review

Third-party data forwarding: All LaTeX source and resource payloads are forwarded verbatim to the public latex.ytotech.com service (no authentication, no DPA). Users compiling sensitive documents are not notified of this data flow; no in-app disclosure exists today.
No injection, SSRF on stored files, or authentication bypass issues were identified in the new code paths.
buildPdfFileName correctly strips directory components before constructing file names, preventing path traversal in stored file names.

Important Files Changed

Filename	Overview
apps/sim/app/api/tools/latex/route.ts	Core API route; correctly validates input, stores PDFs, and surfaces TeX errors. Missing AbortSignal timeout on the upstream fetch and no in-app disclosure that user content is forwarded to latex.ytotech.com.
apps/sim/tools/latex/compile.ts	Tool definition follows existing patterns. Error-path returns pdf as '' (empty string), which pairs poorly with the unknown type in types.ts.
apps/sim/tools/latex/types.ts	Types are consistent with other tools, but pdf is typed as unknown — worth tightening to a concrete interface for downstream type safety.
apps/sim/lib/api/contracts/tools/latex.ts	Well-structured Zod contract with correct size limits (1 MB source, 25 resources), URL validation, and the superRefine exactly-one-of check for resource content type.
apps/sim/blocks/blocks/latex.ts	Block config, templates, and skills all look correct; resource JSON parsing and compiler defaulting are handled cleanly.
apps/sim/tools/registry.ts	latex_compile added correctly in alphabetical order alongside other tools.
apps/sim/blocks/registry.ts	LatexBlock and LatexBlockMeta registered correctly and in alphabetical order.
apps/docs/content/docs/en/integrations/latex.mdx	Documentation is clear and well-structured; does not mention that source is compiled via the external latex.ytotech.com service.

Sequence Diagram

sequenceDiagram
    participant Client as Sim Executor
    participant Route as /api/tools/latex
    participant Upstream as latex.ytotech.com
    participant Storage as Storage (Execution / Copilot)

    Client->>Route: "POST {content, compiler, resources, executionId?}"
    Route->>Route: checkInternalAuth + Zod validate
    Route->>Upstream: "POST /builds/sync {compiler, resources[{main:true, content}, ...]}"
    alt success (200 + application/pdf)
        Upstream-->>Route: PDF binary
        Route->>Route: "readResponseToBufferWithLimit (<=25 MB)"
        alt executionId present
            Route->>Storage: uploadExecutionFile(pdfBuffer)
        else fallback
            Route->>Storage: StorageService.uploadFile(pdfBuffer, context:copilot)
        end
        Storage-->>Route: pdfFile / fileInfo
        Route-->>Client: "{pdfFile, pdfUrl, fileName, compiler}"
    else compile failure (4xx + error JSON)
        Upstream-->>Route: "{error, log_files}"
        Route->>Route: extractCompilationErrors(log_files)
        Route-->>Client: "422 {error: LaTeX compilation failed}"
    else service error (5xx / unexpected)
        Upstream-->>Route: error response
        Route-->>Client: "502 {error: LaTeX compile service error}"
    end

_{Reviews (3): Last reviewed commit: "fix(latex): surface extracted TeX errors..." | Re-trigger Greptile}

waleedlatif1 · 2026-06-11T18:47:20Z

Addressed all three Greptile findings in 2ae901b:

Fetch timeout: the upstream compile call now uses AbortSignal.timeout(50s) (headroom within the route's 60s maxDuration to store the PDF), returning 504 on timeout instead of holding compute until the platform cutoff
Error-code interpolation: the third-party error field is now capped at 100 chars via truncate() before being included in client-facing messages
Empty resource payloads: content and file resource fields now have min(1) guards, so zero-byte resources are rejected at validation

waleedlatif1 · 2026-06-11T18:47:21Z

@greptile

waleedlatif1 · 2026-06-11T18:47:22Z

@cursor review

…and docs

…ect empty resource payloads

waleedlatif1 · 2026-06-11T18:59:33Z

Pushed two updates in bd67bd7 (and rebased the branch onto origin/staging so the PR contains only the LaTeX commits):

New tools: latex_search_packages (search the 5,000+ TeX Live packages by name/description), latex_get_package (exact package lookup with install status, license, topics, related packages), and latex_list_fonts (filterable list of the 2,700+ fonts available to xelatex/lualatex via fontspec) — all verified against the live API
Block now has an operation dropdown (Compile Document / Search Packages / Get Package Details / List Fonts) with per-operation conditions, and the fix-compilation-errors skill references the new lookups

waleedlatif1 · 2026-06-11T18:59:35Z

@greptile

waleedlatif1 · 2026-06-11T18:59:36Z

@cursor review

…ttp(s)-only resource urls, timeout abort handling, typed pdf output, NaN-safe maxResults, empty-query rejection, third-party disclosure

waleedlatif1 · 2026-06-11T19:09:13Z

@greptile

waleedlatif1 · 2026-06-11T19:09:14Z

@cursor review

waleedlatif1 · 2026-06-11T19:18:06Z

@greptile

waleedlatif1 · 2026-06-11T19:18:07Z

@cursor review

waleedlatif1 · 2026-06-11T19:28:46Z

@greptile review

waleedlatif1 · 2026-06-11T19:37:37Z

@greptile review

waleedlatif1 · 2026-06-11T19:37:38Z

@cursor review

… boundary

waleedlatif1 · 2026-06-11T19:44:28Z

@greptile review

waleedlatif1 · 2026-06-11T19:44:29Z

@cursor review

waleedlatif1 · 2026-06-11T19:51:13Z

@greptile review

waleedlatif1 · 2026-06-11T19:51:14Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 9c98876. Configure here.}

cursor Bot reviewed Jun 11, 2026

View reviewed changes

Comment thread apps/sim/app/api/tools/latex/route.ts

vercel Bot deployed to Preview June 11, 2026 18:35 View deployment

vercel Bot temporarily deployed to Preview June 11, 2026 18:35 Inactive

cursor Bot reviewed Jun 11, 2026

View reviewed changes

greptile-apps Bot reviewed Jun 11, 2026

View reviewed changes

Comment thread apps/sim/app/api/tools/latex/route.ts Outdated

Comment thread apps/sim/lib/api/contracts/tools/latex.ts

Comment thread apps/sim/app/api/tools/latex/route.ts

greptile-apps Bot reviewed Jun 11, 2026

View reviewed changes

Comment thread apps/sim/app/api/tools/latex/route.ts Outdated

Comment thread apps/sim/lib/api/contracts/tools/latex.ts Outdated

Comment thread apps/sim/app/api/tools/latex/route.ts Outdated

greptile-apps Bot reviewed Jun 11, 2026

View reviewed changes

Comment thread apps/sim/app/api/tools/latex/route.ts Outdated

Comment thread apps/sim/app/api/tools/latex/route.ts Outdated

Comment thread apps/sim/tools/latex/types.ts

vercel Bot temporarily deployed to Preview June 11, 2026 18:47 Inactive

cursor Bot reviewed Jun 11, 2026

View reviewed changes

Comment thread apps/sim/app/api/tools/latex/route.ts

waleedlatif1 added 4 commits June 11, 2026 11:54

feat(latex): add LaTeX integration with PDF compilation tool, block, …

1371fec

…and docs

fix(latex): surface extracted TeX errors on all failed compile responses

07f54aa

improvement(latex): add compile timeout, cap upstream error code, rej…

c908687

…ect empty resource payloads

feat(latex): add package search/lookup and font listing tools

bd67bd7

waleedlatif1 force-pushed the feat/latex-integration branch from 2ae901b to bd67bd7 Compare June 11, 2026 18:59

cursor Bot reviewed Jun 11, 2026

View reviewed changes

Comment thread apps/sim/blocks/blocks/latex.ts Outdated

Comment thread apps/sim/tools/latex/search_packages.ts Outdated

vercel Bot deployed to Preview June 11, 2026 19:03 View deployment

improvement(latex): address review findings — path traversal guard, h…

e84a50a

…ttp(s)-only resource urls, timeout abort handling, typed pdf output, NaN-safe maxResults, empty-query rejection, third-party disclosure

cursor Bot reviewed Jun 11, 2026

View reviewed changes

Comment thread apps/sim/tools/latex/compile.ts

Comment thread apps/sim/tools/latex/get_package.ts

fix(latex): fail compile/package lookups that return no payload

81bf092

vercel Bot temporarily deployed to Preview June 11, 2026 19:18 Inactive

greptile-apps Bot reviewed Jun 11, 2026

View reviewed changes

Comment thread apps/sim/tools/latex/list_fonts.ts

cursor Bot reviewed Jun 11, 2026

View reviewed changes

Comment thread apps/sim/tools/latex/get_package.ts

improvement(latex): guard lookup tool responses against upstream errors

da18c79

vercel Bot temporarily deployed to Preview June 11, 2026 19:41 Inactive

improvement(latex): reject whitespace-only package names at the block…

22516fe

… boundary

cursor Bot reviewed Jun 11, 2026

View reviewed changes

Comment thread apps/sim/tools/latex/get_package.ts Outdated

improvement(latex): make relatedPackages fallback explicit

9c98876

cursor Bot reviewed Jun 11, 2026

View reviewed changes

vercel Bot temporarily deployed to Preview June 11, 2026 19:55 Inactive

waleedlatif1 merged commit 493c64f into staging Jun 11, 2026
15 checks passed

waleedlatif1 deleted the feat/latex-integration branch June 11, 2026 20:53

waleedlatif1 mentioned this pull request Jun 11, 2026

v0.7.4: round-robin byok support, table block fix, db read replica routing, trigger.dev, temporal, latex integrations #4978

Open

Conversation

waleedlatif1 commented Jun 11, 2026

Summary

Type of Change

Testing

Checklist

Uh oh!

vercel Bot commented Jun 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

waleedlatif1 commented Jun 11, 2026

Uh oh!

cursor Bot commented Jun 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

waleedlatif1 commented Jun 11, 2026

Uh oh!

Uh oh!

waleedlatif1 commented Jun 11, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

waleedlatif1 commented Jun 11, 2026

Uh oh!

greptile-apps Bot commented Jun 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Uh oh!

Uh oh!

Uh oh!

Uh oh!

greptile-apps Bot commented Jun 11, 2026

Greptile Summary

Confidence Score: 4/5

Security Review

Important Files Changed

Sequence Diagram

Uh oh!

Uh oh!

Uh oh!

Uh oh!

greptile-apps Bot commented Jun 11, 2026

Greptile Summary

Confidence Score: 4/5

Security Review

Important Files Changed

Sequence Diagram

Uh oh!

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Jun 11, 2026

Uh oh!

waleedlatif1 commented Jun 11, 2026

Uh oh!

waleedlatif1 commented Jun 11, 2026

Uh oh!

Uh oh!

waleedlatif1 commented Jun 11, 2026

Uh oh!

waleedlatif1 commented Jun 11, 2026

Uh oh!

waleedlatif1 commented Jun 11, 2026

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Jun 11, 2026

Uh oh!

waleedlatif1 commented Jun 11, 2026

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Jun 11, 2026

Uh oh!

waleedlatif1 commented Jun 11, 2026

Uh oh!

vercel Bot commented Jun 11, 2026 •

edited

Loading

cursor Bot commented Jun 11, 2026 •

edited

Loading

greptile-apps Bot commented Jun 11, 2026 •

edited

Loading