simstudioai · TheodoreSpeaks · Aug 11, 2026 · Aug 11, 2026 · Aug 11, 2026 · Aug 11, 2026
diff --git a/apps/docs/openapi-v2-tables.json b/apps/docs/openapi-v2-tables.json
@@ -7017,7 +7017,7 @@
           "size": {
             "type": "integer",
             "minimum": 1,
-            "maximum": 26214400,
+            "maximum": 5368709120,
             "description": "Exact CSV file size in bytes."
           }
         },

diff --git a/apps/sim/app/api/table/[tableId]/import/route.ts b/apps/sim/app/api/table/[tableId]/import/route.ts
@@ -16,7 +16,7 @@ import { statusForOrchestrationError } from '@/lib/core/orchestration/types'
 import { isMultipartError, readMultipart } from '@/lib/core/utils/multipart'
 import { generateRequestId } from '@/lib/core/utils/request'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
-import { CSV_MAX_FILE_SIZE_BYTES, type CsvHeaderMapping } from '@/lib/table'
+import { CSV_SYNC_MAX_FILE_SIZE_BYTES, type CsvHeaderMapping } from '@/lib/table'
 import { performTableCsvImport } from '@/lib/table/orchestration'
 import { getUserSettings } from '@/lib/users/queries'
 import {
@@ -53,7 +53,7 @@ export const POST = withRouteHandler(async (request: NextRequest, { params }: Ro
     let parsed: Awaited<ReturnType<typeof readMultipart>>
     try {
       parsed = await readMultipart(request, {
-        maxFileBytes: CSV_MAX_FILE_SIZE_BYTES,
+        maxFileBytes: CSV_SYNC_MAX_FILE_SIZE_BYTES,
         requiredFieldsBeforeFile: ['workspaceId'],
         signal: request.signal,
       })

diff --git a/apps/sim/app/api/table/import-csv/route.ts b/apps/sim/app/api/table/import-csv/route.ts
@@ -10,7 +10,7 @@ import { isMultipartError, readMultipart } from '@/lib/core/utils/multipart'
 import { generateRequestId } from '@/lib/core/utils/request'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { findActiveFolder } from '@/lib/folders/queries'
-import { CSV_MAX_FILE_SIZE_BYTES } from '@/lib/table'
+import { CSV_SYNC_MAX_FILE_SIZE_BYTES } from '@/lib/table'
 import { performCreateTableFromCsv } from '@/lib/table/orchestration'
 import { getUserSettings } from '@/lib/users/queries'
 import { getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'
@@ -39,7 +39,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
     let parsed: Awaited<ReturnType<typeof readMultipart>>
     try {
       parsed = await readMultipart(request, {
-        maxFileBytes: CSV_MAX_FILE_SIZE_BYTES,
+        maxFileBytes: CSV_SYNC_MAX_FILE_SIZE_BYTES,
         requiredFieldsBeforeFile: ['workspaceId'],
         signal: request.signal,
       })

diff --git a/apps/sim/app/api/v2/custom-tools/[id]/route.test.ts b/apps/sim/app/api/v2/custom-tools/[id]/route.test.ts
@@ -3,6 +3,10 @@
  */
 import { NextRequest } from 'next/server'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  InsufficientWorkspacePermissionsError,
+  NoWorkspaceAccessError,
+} from '@/lib/core/application'
 
 const { mocks, MockV2ApiKeyUnauthenticatedError } = vi.hoisted(() => {
   class MockV2ApiKeyUnauthenticatedError extends Error {}
@@ -160,4 +164,15 @@ describe('/api/v2/custom-tools/[id]', () => {
     expect(response.status).toBe(401)
     expect(mocks.update).not.toHaveBeenCalled()
   })
+
+  it('conceals cross-tenant access while preserving same-workspace role denials', async () => {
+    mocks.get.mockRejectedValueOnce(new NoWorkspaceAccessError())
+    expect((await GET(request('GET'), context)).status).toBe(404)
+
+    mocks.update.mockRejectedValueOnce(new InsufficientWorkspacePermissionsError())
+    expect(
+      (await PATCH(request('PATCH', { workspaceId: WORKSPACE_ID, code: 'return 2' }), context))
+        .status
+    ).toBe(403)
+  })
 })
diff --git a/apps/sim/app/api/v2/custom-tools/[id]/route.ts b/apps/sim/app/api/v2/custom-tools/[id]/route.ts
@@ -4,9 +4,9 @@ import {
   v2UpdateCustomToolContract,
 } from '@/lib/api/contracts/v2/custom-tools'
 import {
+  createV2ResourceConcealmentPolicy,
   defineV2JsonRoute,
   v2ApiKeyAuth,
-  v2OrchestrationErrorPolicy,
   v2RateLimits,
 } from '@/lib/api/server/routes'
 import { customToolOperations } from '@/lib/custom-tools/application/operations'
@@ -20,13 +20,17 @@ import { toV2CustomTool } from '@/app/api/v2/custom-tools/utils'
 export const dynamic = 'force-dynamic'
 export const revalidate = 0
 
+const customToolResourceErrorPolicy = createV2ResourceConcealmentPolicy({
+  notFoundMessage: 'Custom tool not found',
+})
+
 /** GET /api/v2/custom-tools/[id] — Fetch a single custom tool. */
 export const GET = defineV2JsonRoute({
   contract: v2GetCustomToolContract,
   operation: customToolOperations.read,
   auth: v2ApiKeyAuth,
   rateLimit: v2RateLimits.publicApi,
-  errorPolicy: v2OrchestrationErrorPolicy,
+  errorPolicy: customToolResourceErrorPolicy,
   mapInput: ({ params, query }) => ({ workspaceId: query.workspaceId, toolId: params.id }),
   useCase: getWorkspaceCustomToolUseCase,
   present: ({ tool }) => ({ data: { customTool: toV2CustomTool(tool) } }),
@@ -38,7 +42,7 @@ export const PATCH = defineV2JsonRoute({
   operation: customToolOperations.update,
   auth: v2ApiKeyAuth,
   rateLimit: v2RateLimits.publicApi,
-  errorPolicy: v2OrchestrationErrorPolicy,
+  errorPolicy: customToolResourceErrorPolicy,
   mapInput: ({ params, body }) => ({
     ...body,
     toolId: params.id,
@@ -54,7 +58,7 @@ export const DELETE = defineV2JsonRoute({
   operation: customToolOperations.delete,
   auth: v2ApiKeyAuth,
   rateLimit: v2RateLimits.publicApi,
-  errorPolicy: v2OrchestrationErrorPolicy,
+  errorPolicy: customToolResourceErrorPolicy,
   mapInput: ({ params, query }) => ({
     workspaceId: query.workspaceId,
     toolId: params.id,

diff --git a/apps/sim/app/api/v2/files/[fileId]/metadata/route.test.ts b/apps/sim/app/api/v2/files/[fileId]/metadata/route.test.ts
@@ -113,7 +113,7 @@ describe('GET /api/v2/files/[fileId]/metadata', () => {
     expect(mocks.readMetadata).not.toHaveBeenCalled()
   })
 
-  it('conceals an authorization failure as not found', async () => {
+  it('conceals cross-workspace authorization as not found', async () => {
     mocks.readMetadata.mockRejectedValue(new NoWorkspaceAccessError())
 
     const response = await callGet(`workspaceId=${WORKSPACE_ID}`)

diff --git a/apps/sim/app/api/v2/files/[fileId]/route.test.ts b/apps/sim/app/api/v2/files/[fileId]/route.test.ts
@@ -141,7 +141,7 @@ describe('v2 single-file routes', () => {
     })
   })
 
-  it('conceals download authorization failures', async () => {
+  it('conceals cross-workspace download authorization', async () => {
     mocks.download.mockRejectedValue(new NoWorkspaceAccessError())
 
     const response = await GET(

diff --git a/apps/sim/app/api/v2/files/uploads/utils.ts b/apps/sim/app/api/v2/files/uploads/utils.ts
@@ -38,18 +38,20 @@ function uploadStatus(status: string): V2UploadStatus {
 
 import type { Principal } from '@sim/auth/principal'
 import type { NextRequest, NextResponse } from 'next/server'
+import { createV2ResourceConcealmentPolicy } from '@/lib/api/server/routes'
 import { authenticateV2ApiKey } from '@/lib/api/server/routes/v2-api-key-auth'
-import { v2CaughtOrchestrationError, v2Error } from '@/app/api/v2/lib/response'
+
+const uploadControlErrorPolicy = createV2ResourceConcealmentPolicy({
+  notFoundMessage: 'Upload session not found',
+})
 
 /** Re-authenticates the API key for each upload control leg. */
 export async function authenticateUploadPrincipal(request: NextRequest): Promise<Principal> {
   const auth = await authenticateV2ApiKey(request.headers.get('x-api-key'))
   return auth.principal
 }
 
-/** Resource-ID upload controls conceal authorization failures as absence. */
+/** Conceals cross-tenant upload-session authorization while preserving same-workspace denials. */
 export function v2UploadControlError(error: unknown): NextResponse | null {
-  const response = v2CaughtOrchestrationError(error)
-  if (!response) return null
-  return response.status === 403 ? v2Error('NOT_FOUND', 'Upload session not found') : response
+  return uploadControlErrorPolicy.render(error)
 }
diff --git a/apps/sim/app/api/v2/knowledge/[id]/documents/[documentId]/route.ts b/apps/sim/app/api/v2/knowledge/[id]/documents/[documentId]/route.ts
@@ -71,7 +71,7 @@ export const DELETE = defineV2JsonRoute({
   auth: v2ApiKeyAuth,
   operation: knowledgeOperations.deleteDocument,
   rateLimit: v2RateLimits.publicApi,
-  errorPolicy: v2KnowledgeErrorPolicies.default,
+  errorPolicy: v2KnowledgeErrorPolicies.concealKnowledgeBaseAuthorization,
   mapInput: ({ params, query }) => ({
     knowledgeBaseId: params.id,
     documentId: params.documentId,

diff --git a/apps/sim/app/api/v2/knowledge/[id]/documents/route.ts b/apps/sim/app/api/v2/knowledge/[id]/documents/route.ts
@@ -106,7 +106,7 @@ export const POST = defineV2BodyLifecycleRoute({
   auth: v2ApiKeyAuth,
   operation: knowledgeOperations.uploadDocument,
   rateLimit: v2RateLimits.publicApi,
-  errorPolicy: v2KnowledgeErrorPolicies.documentUpload,
+  errorPolicy: v2KnowledgeErrorPolicies.concealKnowledgeBaseUploadAuthorization,
   admission: {
     mapInput: ({ params, query }) => ({
       knowledgeBaseId: params.id,

diff --git a/apps/sim/app/api/v2/knowledge/[id]/route.ts b/apps/sim/app/api/v2/knowledge/[id]/route.ts
@@ -41,7 +41,7 @@ export const PATCH = defineV2JsonRoute({
   auth: v2ApiKeyAuth,
   operation: knowledgeOperations.update,
   rateLimit: v2RateLimits.publicApi,
-  errorPolicy: v2KnowledgeErrorPolicies.default,
+  errorPolicy: v2KnowledgeErrorPolicies.concealKnowledgeBaseAuthorization,
   parseOptions: {
     invalidJsonResponse: () => v2Error('BAD_REQUEST', 'Request body must be valid JSON'),
   },
@@ -66,7 +66,7 @@ export const DELETE = defineV2JsonRoute({
   auth: v2ApiKeyAuth,
   operation: knowledgeOperations.delete,
   rateLimit: v2RateLimits.publicApi,
-  errorPolicy: v2KnowledgeErrorPolicies.default,
+  errorPolicy: v2KnowledgeErrorPolicies.concealKnowledgeBaseAuthorization,
   mapInput: ({ params, query }) => ({
     knowledgeBaseId: params.id,
     assertedWorkspaceId: query.workspaceId,

diff --git a/apps/sim/app/api/v2/knowledge/search/route.test.ts b/apps/sim/app/api/v2/knowledge/search/route.test.ts
@@ -70,13 +70,14 @@ describe('POST /api/v2/knowledge/search', () => {
     })
   })
 
-  it('delegates normalized IDs through the semantic operation', async () => {
+  it('delegates normalized IDs and the selected search mode through the semantic operation', async () => {
     const request = buildRequest(
       JSON.stringify({
         workspaceId: WORKSPACE_ID,
         knowledgeBaseIds: 'kb-1',
         query: 'hello',
         topK: 10,
+        searchMode: 'hybrid',
       })
     )
 
@@ -91,6 +92,7 @@ describe('POST /api/v2/knowledge/search', () => {
         query: 'hello',
         topK: 10,
         tagFilters: undefined,
+        searchMode: 'hybrid',
       },
       request,
     })

diff --git a/apps/sim/app/api/v2/knowledge/search/route.ts b/apps/sim/app/api/v2/knowledge/search/route.ts
@@ -14,7 +14,7 @@ export const POST = defineV2JsonRoute({
   auth: v2ApiKeyAuth,
   operation: knowledgeOperations.search,
   rateLimit: v2RateLimits.publicApi,
-  errorPolicy: v2KnowledgeErrorPolicies.usage,
+  errorPolicy: v2KnowledgeErrorPolicies.concealKnowledgeBaseUsageAuthorization,
   parseOptions: {
     invalidJsonResponse: () => v2Error('BAD_REQUEST', 'Request body must be valid JSON'),
   },
@@ -26,6 +26,7 @@ export const POST = defineV2JsonRoute({
     query: body.query,
     topK: body.topK,
     tagFilters: body.tagFilters,
+    searchMode: body.searchMode,
   }),
   useCase: searchKnowledge,
   present: (result) => ({ data: result }),

diff --git a/apps/sim/app/api/v2/logs/[runId]/route.test.ts b/apps/sim/app/api/v2/logs/[runId]/route.test.ts
@@ -24,7 +24,7 @@ vi.mock('@/lib/logs/application/get-public-log', () => ({
   getPublicLog: { operation: { id: 'logs.read_detail' }, execute: mocks.execute },
 }))
 
-import { OrchestrationError } from '@/lib/core/orchestration/types'
+import { NoWorkspaceAccessError } from '@/lib/core/application'
 import { GET } from '@/app/api/v2/logs/[runId]/route'
 
 const auth = {
@@ -95,9 +95,7 @@ describe('GET /api/v2/logs/[runId]', () => {
   })
 
   it('conceals canonical workspace authorization as log not-found', async () => {
-    mocks.execute.mockRejectedValueOnce(
-      new OrchestrationError('forbidden', 'Workspace API key cannot perform this operation')
-    )
+    mocks.execute.mockRejectedValueOnce(new NoWorkspaceAccessError())
 
     const response = await GET(new NextRequest('http://localhost:3000/api/v2/logs/run-1'), {
       params: Promise.resolve({ runId: 'run-1' }),

diff --git a/apps/sim/app/api/v2/mcp-servers/[id]/route.test.ts b/apps/sim/app/api/v2/mcp-servers/[id]/route.test.ts
@@ -4,6 +4,10 @@
 import type { mcpServers } from '@sim/db/schema'
 import { NextRequest } from 'next/server'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  InsufficientWorkspacePermissionsError,
+  NoWorkspaceAccessError,
+} from '@/lib/core/application'
 
 const { mocks, MockV2ApiKeyUnauthenticatedError } = vi.hoisted(() => {
   class MockV2ApiKeyUnauthenticatedError extends Error {}
@@ -178,4 +182,15 @@ describe('/api/v2/mcp-servers/[id]', () => {
     expect(response.status).toBe(401)
     expect(mocks.update).not.toHaveBeenCalled()
   })
+
+  it('conceals cross-tenant access while preserving same-workspace role denials', async () => {
+    mocks.get.mockRejectedValueOnce(new NoWorkspaceAccessError())
+    expect((await GET(request('GET'), context)).status).toBe(404)
+
+    mocks.update.mockRejectedValueOnce(new InsufficientWorkspacePermissionsError())
+    expect(
+      (await PATCH(request('PATCH', { workspaceId: WORKSPACE_ID, name: 'New docs' }), context))
+        .status
+    ).toBe(403)
+  })
 })
diff --git a/apps/sim/app/api/v2/mcp-servers/[id]/route.ts b/apps/sim/app/api/v2/mcp-servers/[id]/route.ts
@@ -4,9 +4,9 @@ import {
   v2UpdateMcpServerContract,
 } from '@/lib/api/contracts/v2/mcp-servers'
 import {
+  createV2ResourceConcealmentPolicy,
   defineV2JsonRoute,
   v2ApiKeyAuth,
-  v2OrchestrationErrorPolicy,
   v2RateLimits,
 } from '@/lib/api/server/routes'
 import { mcpServerOperations } from '@/lib/mcp/application/operations'
@@ -21,13 +21,17 @@ import { toV2McpServer } from '@/app/api/v2/mcp-servers/utils'
 export const dynamic = 'force-dynamic'
 export const revalidate = 0
 
+const mcpServerResourceErrorPolicy = createV2ResourceConcealmentPolicy({
+  notFoundMessage: 'MCP server not found',
+})
+
 /** GET /api/v2/mcp-servers/[id] — Fetch a single MCP server. */
 export const GET = defineV2JsonRoute({
   contract: v2GetMcpServerContract,
   operation: mcpServerOperations.read,
   auth: v2ApiKeyAuth,
   rateLimit: v2RateLimits.publicApi,
-  errorPolicy: v2OrchestrationErrorPolicy,
+  errorPolicy: mcpServerResourceErrorPolicy,
   mapInput: ({ params, query }) => ({ workspaceId: query.workspaceId, serverId: params.id }),
   useCase: getMcpServerUseCase,
   present: ({ server }) => ({ data: { mcpServer: toV2McpServer(server) } }),
@@ -39,7 +43,7 @@ export const PATCH = defineV2JsonRoute({
   operation: mcpServerOperations.update,
   auth: v2ApiKeyAuth,
   rateLimit: v2RateLimits.publicApi,
-  errorPolicy: v2OrchestrationErrorPolicy,
+  errorPolicy: mcpServerResourceErrorPolicy,
   mapInput: ({ params, body }) => ({ ...body, serverId: params.id, source: 'api' as const }),
   useCase: updateMcpServerUseCase,
   present: ({ server }) => ({ data: { mcpServer: toV2McpServer(server) } }),
@@ -51,7 +55,7 @@ export const DELETE = defineV2JsonRoute({
   operation: mcpServerOperations.delete,
   auth: v2ApiKeyAuth,
   rateLimit: v2RateLimits.publicApi,
-  errorPolicy: v2OrchestrationErrorPolicy,
+  errorPolicy: mcpServerResourceErrorPolicy,
   mapInput: ({ params, query }) => ({
     workspaceId: query.workspaceId,
     serverId: params.id,

diff --git a/apps/sim/app/api/v2/skills/[id]/route.test.ts b/apps/sim/app/api/v2/skills/[id]/route.test.ts
@@ -3,6 +3,10 @@
  */
 import { NextRequest } from 'next/server'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  InsufficientWorkspacePermissionsError,
+  NoWorkspaceAccessError,
+} from '@/lib/core/application'
 
 const { mocks, MockV2ApiKeyUnauthenticatedError } = vi.hoisted(() => {
   class MockV2ApiKeyUnauthenticatedError extends Error {}
@@ -165,4 +169,15 @@ describe('/api/v2/skills/[id]', () => {
     expect(response.status).toBe(401)
     expect(mocks.update).not.toHaveBeenCalled()
   })
+
+  it('conceals cross-tenant access while preserving same-workspace role denials', async () => {
+    mocks.get.mockRejectedValueOnce(new NoWorkspaceAccessError())
+    expect((await GET(request('GET'), context)).status).toBe(404)
+
+    mocks.update.mockRejectedValueOnce(new InsufficientWorkspacePermissionsError())
+    expect(
+      (await PATCH(request('PATCH', { workspaceId: WORKSPACE_ID, content: '# Updated' }), context))
+        .status
+    ).toBe(403)
+  })
 })