[waleedlatif1]

Summary

• Standard Webhooks verifier: one verifyStandardWebhook in @sim/security/standard-webhooks (+ verifyStandardWebhookRequest 401 adapter in lib/webhooks/providers/utils.ts) replaces six hand-rolled copies (Clerk, Resend, Linq, Granola, incident.io, Loops) and the svix SDK in the AgentMail receiver; drops svix
  • Each provider keeps its header names, ±300s tolerance, and exact 401 messages; AgentMail still routes by inbox_id and checks exactly one secret
  • Fixes an empty-HMAC-key forgery: a secret like whsec_ / whsec_A decoded to zero bytes, so anyone could sign a delivery
  • Strictens to the documented scheme: only v1, signatures count, secrets must be base64, timestamps must be plain decimal seconds; Loops keeps its own <prefix>_ secret stripping
• MCP SDK 1.31.0 → 1.32.1 with no behavior change: 1.32 makes the SDK refuse cross-origin redirects itself, so the transport passes redirectPolicy: 'follow' and the OAuth guarded fetch now owns redirects by default (per-hop SSRF check, cross-origin header stripping, cross-origin 307/308 body replay still refused) — outcomes match 1.31 for metadata, token, registration, refresh, and revoke legs; only the auth-type probe opts back into the caller's redirect: 'manual'
• tiptap 3.30.5 → 3.31.4 with root overrides pinning one copy each of prosemirror-model/view/state/transform, picking up the prosemirror-view paste XSS fix (GHSA-c8x8-7fp4-3x9w, fixed in 1.42.3)
  • parseMarkdown overrides use this.parent (3.31 typed this)
  • Drops our text-input-rule wrapper since tiptap now inserts-then-converts natively (it double-inserted); in collaborative editing the first undo now restores the typed Markdown, a second removes it
  • Keeps the 2-space nested indent under ordered items — upstream's 3-space alignment plus its tokenizer stripping one column less would add a space to fenced code inside numbered items on every save and flip those files to read-only
  • @tiptap/y-tiptap stays at 3.0.7: 3.0.8's move reconciliation drops a peer's concurrent list edits in our two-peer tests
• pi 1.1 is intentionally not included (needs Pi sandbox image rebuilds coordinated with deploy)

Type of Change

• Bug fix
• Improvement

Testing

• standard-webhooks.test.ts (24, incl. the published Standard Webhooks vector, empty-key forgery, tolerance; each guard reverted → red), provider + AgentMail route tests; helper agreed with svix Webhook.verify on 3000/3000 randomized deliveries before removal
• transport-redirects.server.test.ts over real loopback servers (SSE redirect, OAuth discovery redirect, token 307 refusal; red without redirectPolicy / with the old 'caller' default) + 46 MCP-related files (464 tests)
• rich-markdown-editor, file-viewer, collab-doc suites (839 tests) incl. a new fenced-code-in-numbered-list byte-stability regression (red on unpatched list-item); lockfile has a single prosemirror copy
• Type-check, check:audits, lint, full tests, and e2e run in CI
• Manual QA worth a pass: link/image input rules + undo (solo and two peers), image resize handles vs Cmd+A, paste from Docs/Word, numbered list with a fenced block stays editable

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[gitguardian]

️✅ There are no secrets present in this pull request anymore.

If these secrets were true positive and are still valid, we highly recommend you to revoke them.
While these secrets were previously flagged, we no longer have a reference to the
specific commits where they were detected. Once a secret has been leaked into a git
repository, you should consider it compromised, even if it was deleted immediately.
Find here more information about risks.

---

^{_{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Oct 19, 2026 11:58pm UTC

[cubic-dev-ai]

All reported issues were addressed across 30 files

<sub>This PR changes authentication, authorization, or input validation. Ultrareviews find 2.4x more serious bugs than standard reviews. Comment @cubic-dev-ai ultrareview to run one.

Turn on auto-fix | Re-trigger cubic</sub>

[greptile-apps]

Confidence Score: 5/5

[High impact] The PR appears safe to merge; no actionable new issues were found.

Summary

Consolidates seven webhook receivers onto verifyStandardWebhook and updates MCP and editor dependencies.

• Webhook deliveries share one signature verifier.
• MCP requests keep guarded redirects after the SDK update.
• The Markdown editor converts typed syntax and preserves numbered-list code.

No actionable new issues were found.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Provider webhook] --> B[Provider adapter]
  C[AgentMail webhook] --> D[Select workspace by inbox_id]
  B --> E[verifyStandardWebhook]
  D --> E
  E --> F{Headers, timestamp, key and signature valid?}
  F -->|Yes| G[Continue receiver]
  F -->|No| H[Return 401]

Loading

_{Reviews (3) · Last reviewed commit: "chore(security): drop a duplicated malfo..." · Reviewed by Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 30 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 30 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}