v0.6.20: oauth default credential name, models pages, new models

[waleedlatif1]

• fix(encryption): specify authTagLength on all AES-GCM cipher/decipher calls (fix(encryption): specify authTagLength on all AES-GCM cipher/decipher calls #3883)
• fix(cost): worker crash incremenental case (fix(cost): worker crash incremenental case #3885)
• fix(envvar): remove dead env var
• improvement(credentials): consolidate OAuth modals and auto-fill credential name (improvement(credentials): consolidate OAuth modals and auto-fill credential name #3887)
• feat(providers): server-side credential hiding for Azure and Bedrock (feat(providers): server-side credential hiding for Azure and Bedrock #3884)
• chore(bun): update bunfig.toml (chore(bun): update bunfig.toml #3889)
• feat(landing): added models pages (feat(landing): added models pages #3888)
• improvement(workflow): seed start block on server side (improvement(workflow): seed start block on server side #3890)
• improvement(providers): audit and update all provider model definitions (improvement(providers): audit and update all provider model definitions #3893)
• feat(credentials) Add google service account support (feat(credentials) Add google service account support #3828)
• feat(rippling): expand Rippling integration from to 86 tools, landing updates (feat(rippling): expand Rippling integration from to 86 tools, landing updates #3886)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview, Comment	Apr 2, 2026 8:33am

[cursor]

PR Summary

High Risk
Introduces a new credential type that stores/encrypts service account private keys and changes token issuance paths for multiple Google APIs; mistakes could cause auth failures or accidental exposure via logging/mis-scoped tokens. Also adds a large SEO surface (/models) that could impact build time and routing if registry data changes.

Overview
Adds first-class Google service account credentials alongside OAuth: new create/update flows validate + encrypt JSON keys, credential listing returns mixed oauth/service_account results, and token endpoints can mint JWT-based access tokens (with optional impersonateEmail) for Google services. Multiple Google tool routes (Drive, Gmail, Sheets, Calendar, Tasks, BigQuery) now request canonical service scopes and surface service-account token errors cleanly.

Launches a new public AI Models Directory at /models with provider/model SEO pages, OpenGraph image generation, JSON-LD structured data, sitemap entries, and a footer link. Also factors a reusable LandingFAQ component and adds docs for configuring Google service accounts with domain-wide delegation.

^{Written by Cursor Bugbot for commit fc6fe19. This will update automatically on new commits. Configure here.}

[greptile-apps]

Greptile Summary

This version bump (v0.6.20) bundles nine incremental improvements across security, credentials UX, landing pages, and provider coverage. The most impactful changes are: (1) the AES-GCM authTagLength fix ensuring consistent cipher behaviour across Node.js versions; (2) server-side credential hiding for Azure and AWS Bedrock so self-hosted deployments can pre-configure keys without exposing them in the UI; (3) consolidation of two OAuth modals into one unified OAuthModal with auto-filled credential names; and (4) atomic workflow creation that seeds the default start block inside the same DB transaction.

Key changes:

• fix(encryption) — authTagLength: 16 now specified on all createCipheriv/createDecipheriv AES-GCM calls in both encryption.ts and crypto.ts, preventing potential auth-tag length ambiguity
• feat(providers) — NEXT_PUBLIC_BEDROCK_DEFAULT_CREDENTIALS and NEXT_PUBLIC_AZURE_CONFIGURED env flags hide credential fields in the Agent block UI when the deployment provides them server-side; byok.ts falls back to AZURE_OPENAI_API_KEY / AZURE_ANTHROPIC_API_KEY env vars automatically
• improvement(credentials) — ConnectCredentialModal and OAuthRequiredModal merged into a single OAuthModal with a mode discriminant; credential name auto-fills from the user's session name
• improvement(workflow) — saveWorkflowToNormalizedTables accepts an optional external transaction, and both POST /api/workflows and createWorkspace now seed the start block atomically within their own transactions
• feat(landing) — new /models, /models/[provider], and /models/[provider]/[model] landing pages with OG images and sitemap entries
• improvement(providers) — new OpenAI models (gpt-5.2-pro, gpt-5-pro, o3-mini, o3-pro) and updated Anthropic/Google model pricing; gemini-3-pro-preview removed from thinking-capable models
• chore — requiresFeature sub-block property renamed to showWhenEnvSet; isSubBlockHiddenByHostedKey renamed to isSubBlockHidden and extended with hideWhenEnvSet support; PROVIDER_PLACEHOLDER_KEY constant replaces the inline 'bedrock-uses-own-credentials' string

One P1 issue identified: vertexProject in blocks/utils.ts is marked password: true, which masks a GCP project ID — a public, non-sensitive identifier — making it unnecessarily hard to verify.

Confidence Score: 4/5

• Safe to merge after fixing the vertexProject password masking issue; all other findings are minor style/UX concerns.
• The encryption fix, atomic workflow seeding, and Azure/Bedrock server-side credential hiding are all well-implemented. One P1 defect exists: vertexProject is incorrectly marked password: true, which masks a non-secret GCP project ID in the UI and would create real confusion for Vertex AI users. The displayName session-race and modal-reset observations are low-risk P2s given how better-auth hydrates sessions from cookies synchronously in most cases.
• apps/sim/blocks/utils.ts — the password: true flag on vertexProject should be removed before merging.

Important Files Changed

Filename	Overview
apps/sim/lib/core/security/encryption.ts	Fixes AES-GCM cipher/decipher by explicitly specifying authTagLength: 16 on all cipher/decipher calls, preventing ambiguity with the Node.js crypto defaults. Also improves error handling with error instanceof Error.
apps/sim/lib/api-key/crypto.ts	Parallel fix to encryption.ts — adds authTagLength: 16 to AES-GCM cipher/decipher, and cleans up the decryption parsing to use fixed-index parts instead of the generic slice(1, -1).join(':') approach.
apps/sim/app/workspace/[workspaceId]/components/oauth-modal.tsx	New unified OAuth modal consolidating ConnectCredentialModal and OAuthRequiredModal. Auto-fills credential name from session, but the useState initializer runs once before session resolves, and handleClose doesn't reset displayName state.
apps/sim/blocks/utils.ts	Centralizes provider credential sub-blocks. Adds hideWhenEnvSet to Azure/Bedrock credential fields and canonicalParamId for Vertex. However, vertexProject is incorrectly marked password: true (project IDs are public identifiers).
apps/sim/providers/bedrock/index.ts	Removes hard requirement for bedrockAccessKeyId/bedrockSecretKey, falling back to AWS default credential chain when neither is provided. Validates that credentials are either both present or both absent to prevent misconfiguration.
apps/sim/lib/api-key/byok.ts	Azure OpenAI and Azure Anthropic now fall back to server-side env vars (AZURE_OPENAI_API_KEY, AZURE_ANTHROPIC_API_KEY) when no user-provided key exists. Uses PROVIDER_PLACEHOLDER_KEY constant for Bedrock.
apps/sim/lib/workflows/persistence/utils.ts	Refactors saveWorkflowToNormalizedTables to accept an optional external transaction, enabling callers to compose it within their own transaction without double-wrapping. Errors propagate correctly when externalTx is provided.
apps/sim/app/api/workflows/route.ts	Workflow creation now seeds a default start block atomically within the same transaction as the workflow row insert, preventing partial state where a workflow exists without any blocks.
apps/sim/providers/models.ts	Adds new OpenAI model definitions (gpt-5.2-pro, gpt-5-pro, o3-mini, o3-pro) and updates pricing updatedAt dates. o3-pro has no reasoningEffort capability defined, which is consistent with the model running at max reasoning by default.
apps/sim/providers/azure-openai/index.ts	Validates and narrows apiKey before use, passes it explicitly via spread to all sub-calls. Falls back to env.AZURE_OPENAI_ENDPOINT and env.AZURE_OPENAI_API_VERSION from server env vars.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Agent Block UI] --> B{isSubBlockHidden?}
    B -->|hideWhenHosted| C{isHosted?}
    B -->|hideWhenEnvSet| D{NEXT_PUBLIC_* truthy?}
    C -->|yes| E[Field hidden]
    C -->|no| F[Field shown]
    D -->|yes| E
    D -->|no| F
    F --> G[User enters credentials]
    G --> H[byok.ts]
    H --> I{Provider type}
    I -->|Bedrock| J[PROVIDER_PLACEHOLDER_KEY -- uses IAM/IRSA]
    I -->|Azure OpenAI/Anthropic| K[userKey OR server env var]
    I -->|Other| L[userKey OR hosted key]
    J --> M[Provider executeRequest]
    K --> M
    L --> M

Loading

_{Reviews (1): Last reviewed commit: "improvement(providers): audit and update..." | Re-trigger Greptile}

[greptile-apps]

displayName initialized before session data is available

useState runs its initializer exactly once on the first render. At that point session may still be null (the auth query hasn't resolved yet), so getDefaultCredentialName receives null and produces "My {Provider} 1" instead of the user-personalized "{User}'s {Provider} 1". When the session later resolves, the state is never updated.

Adding a useEffect to sync the name after the session loads would fix this:

// After the useState line:
const [hasUserEdited, setHasUserEdited] = useState(false)

useEffect(() => {
  if (isConnect && !hasUserEdited && session?.user?.name) {
    setDisplayName(getDefaultCredentialName(session.user.name, providerName, credentialCount))
  }
}, [session?.user?.name, isConnect, hasUserEdited, providerName, credentialCount])

// In the onChange handler, set hasUserEdited = true

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

There are 4 total unresolved issues (including 2 from previous reviews).

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}