feat(connectors): add 9 knowledge base connectors - #6699

What

Adds 9 knowledge base connectors, closing the highest-frequency gaps in our catalog. Every service already shipped a block, so OAuth providers, credentials, and icons were reused — no new auth plumbing.

Selected by surveying the published connector catalogs of Glean, Onyx, Dust, Vectara, Writer, Guru, Elastic, Microsoft 365 Copilot, Notion AI, Unstructured, and Airbyte, then intersecting the gaps with services that already have a Sim block. Box was the single biggest gap — 7-8 of ~10 catalogs, and the default content store in financial services, life sciences, and government.

Validation

Every connector was validated against live provider documentation twice, independently. The second pass was told to treat the first pass's conclusions as unproven — which mattered, because it found defects in the first pass's own fixes.

Data-loss class

The sync engine hard-deletes documents past a cap not flagged with listingCapped. Paths found and fixed across both passes:

• Mintlify — three independent listing-collapse paths. An empty discovery (both llms.txt and sitemap.xml 404, or an HTTP-200 HTML interstitial, which docs.cursor.com really serves) reconciled the whole KB away. A sitemap-index child that 404s was silently skipped despite a comment claiming failure was fatal. The origin-level index returned early with 13 of 306 pages for a sub-path site.
• Trello — cards in archived lists vanished from an unflagged listing; listingCapped latched permanently on any list of 1000+ cards; then the fix for that stopped flagging multi-page lists while resting on an ordering guarantee Trello does not document.
• Zoho Desk — the flag never fired at the default caps (500/50 and 500/100 are exact multiples); then the fix's probe walked into Zoho's hard from <= 4999 ceiling and 422'd the whole listing at the documented 5000 maximum.
• PagerDuty — more: true with zero incidents ended the listing unflagged.
• SFTP — depth-limit pruning set the flag on every sync of a deep tree, permanently suppressing legitimate deletions.

Because five of ten audited connectors had some path here, the engine also gained a backstop: an empty or collapsed listing now blocks deletion reconciliation until the same observation repeats on a consecutive sync. No migration — the previous run is reconstructed from existing sync-log counters. Corroboration is only trusted from a run that could not have been incremental, otherwise a bad listing confirms itself.

Correctness

• Zoho Desk — desk.zoho.ca does not resolve. Canada is desk.zohocloud.ca. All 11 data centers were then re-verified by DNS and an authenticated probe returning 401 UNAUTHORIZED, which proves the host serves the Desk v1 API. Singapore and UAE were missing entirely.
• Zoho Desk — modifiedTime is absent from GET /tickets, so the stub and hydrated hashes never matched and every ticket re-embedded on every sync, forever.
• Trello — Atlassian documents that some edits bump dateLastActivity without creating an action, and never published which. The hash now folds in badges counters, which arrive with the listing at no extra cost.
• Microsoft Excel — dates and currency indexed as raw serial numbers (42019, not 1/15/2015), unlike Google Sheets. Graph documents that Range.text is independent of cell width, so the ####### objection does not apply. A content-format token forces one re-index, since the metadata-only hash would otherwise keep stale content.
• PagerDuty — the 10,000-record ceiling bounds offset + limit, so the guard admitted a request that 400s after any short page. The incremental window was also only half pinned.
• Google Vault — one call per matter per kind truncated at ~249 matters, silently never indexed on any run. Now ~3,500.
• SFTP — the incremental cutoff compared against the remote clock, permanently skipping same-second writes.
• Box — extracted_text gave up before polling when a representation was not yet generated.
• Mintlify — a site whose .md route 404s hydrated every page to nothing while validateConfig passed. The HTML fallback then indexed <script> contents: 294KB of RSC payload per page, 98% noise.

Security

• SFTP — getDocument used stat, which follows symlinks. Filenames from readdir were composed into paths unchecked. Host-key verification was absent entirely; an optional fingerprint now verifies during key exchange, before any password is sent. It is opt-in and blank by default, so an unconfigured source retains the original MITM exposure — IP pinning does not mitigate this, since the pin derives from the same DNS answer an attacker would poison.
• Trello — user-supplied board ids were interpolated into URL paths raw.
• Google Vault — narrowed from read-write ediscovery (which grants delete on matters and holds) to ediscovery.readonly.
• Dataverse tools — getDataverseBaseUrl accepted any host while every request attaches a bearer token. Pinned to Microsoft's Dataverse domains. This is pre-existing shipped code, fixed here.

Removed: Microsoft Dataverse

Built, then cut. Its OAuth cannot complete consent, and never could. Dataverse requires a per-environment resource (<environment-url>/user_impersonation); the provider declares a static https://dynamics.microsoft.com/user_impersonation, which is not an Entra Application ID URI. The scope is fixed at Better Auth config time with no per-connection override, and the environment URL is only collected after the credential exists — so nothing can supply it at authorize time. Entra rejects at /authorize with AADSTS500011.

This predates the PR and affects the 12 shipped tools/microsoft_dataverse/* tools. Added in a bulk tool-authoring PR (#3257) with zero tests; the later "align with live API docs" PR (#5481) touched no OAuth file. A real fix needs a contract, route, and UI change plus an Entra app-registration permission, so it belongs in its own change. One-minute confirmation: open the authorize URL in a browser signed into any work tenant.

Also cut earlier: Google Groups (no public API returns conversations — the Migration API is insert-only) and Workday (native file APIs need OAuth we haven't wired; only custom-report rows were reachable).

Claims corrected during validation

Stated in an earlier revision of this description and since disproven:

• PagerDuty does have a postmortem API — GET /status_pages/{id}/posts/{post_id}/postmortem. But StatusPagePost.linked_resource.type is an untyped string with no documented incident join, so it belongs in a separate status-pages connector, not the incident walk.
• .well-known/llms.txt is not a real Mintlify location — 404s on every site checked.
• The Google Vault cursor bug was unreachable — the engine reads sourceConfig once before the pagination loop, so enabled kinds cannot change mid-sync. The defensive branch is gone.
• Trello's before pagination is not a reliable completeness guarantee, only a usable dedup bound.

Known gaps

• SFTP host verification is opt-in. Consider requiring it, or TOFU-pinning the first-seen key.
• PagerDuty created_at:asc plus the 10k ceiling leaves a permanent hole on large accounts. asc is correct for offset-pagination integrity, so the fix is time-window chunking, not flipping to desc.
• Excel indexes hidden sheets, and issues one request for up to 200,000 cells against Microsoft's explicit large-range guidance.
• Box [markdown] representation would preserve table structure that flat extracted_text destroys.
• Mintlify cannot configure a docs site that redirects cross-host (docs.anthropic.com → platform.claude.com); needs url on SecureFetchResponse.
• Google Slides / Docs — a fetch failure on an add is invisible in sync counters. Shared with google-docs; belongs in a follow-up covering both.
• No connector has tests.

Still missing from the catalog

A generic web crawler (6/10 catalogs, backstops every source not in the catalog), Bitbucket, Guru, Coda, and a database/warehouse source. None have blocks today.

Testing

• bun run type-check clean
• biome check clean across 229 files
• bun run check:api-validation passes
• 245 tests pass, including 13 new sync-engine guard tests verified to fail when the guard is reverted

Not exercised against live tenants. Validation was documentation-based, with live DNS and HTTP probes where a host or response shape could be checked without credentials.