v0.8.1: grok 4.6, v2 endpoints extension, workflow UI improvements, logrocket, perf improvements

.agents/skills/ship/SKILL.md

@@ -100,6 +100,16 @@ improvement(scope): description for enhancements
 chore(scope): description for maintenance
 ```
 
+## What to Omit
+
+The repo is public. Keep the title and description to the code change and its reasoning — never:
+
+- Customer, company, or user names; workspace/user/org IDs; email addresses
+- Prod or staging operational data: log lines, DB rows, metrics, timestamps, incident details, canary/alert output
+- Infrastructure specifics: hostnames, ARNs, internal URLs, env var values, secret names
+
+Describe the bug by its mechanism, not by how you found it. "Expired OAuth credentials fail to refresh in the worker" — not "the Sheets canary failed at 16:31Z for workspace abc-123".
+
 ## PR Description Format
 
 Use this exact template in the user's voice (concise, bullet points):

.agents/skills/tool-registry-boundary/SKILL.md

@@ -68,6 +68,10 @@ If it fails, do not add the entry to an allowlist — there isn't one. Find the
 
 Run it with `--verbose` to print per-route module counts, which is also the quickest way to see whether a change moved the graph.
 
+The same command also ratchets those counts against `check-tool-registry-boundary.baseline.json`. `--check` (what CI runs) fails when an entry exceeds its baseline by more than `max(25 modules, 2%)`, naming the import chain responsible. This catches bloat the registry rule misses — a prefetch importing `listTables` cost the Tables page 444 modules without ever touching `@/tools/registry`.
+
+Re-record with `--update-baseline` and commit the JSON when growth is deliberate. A *shrink* passes but is reported — re-record then too, or the win is silently spendable again.
+
 ## How to verify an edge actually got cut
 
 Do not eyeball imports — the registry is reached through several redundant paths, so cutting one buys nothing while another survives. Walk the graph:

.claude/commands/ship.md

@@ -99,6 +99,16 @@ improvement(scope): description for enhancements
 chore(scope): description for maintenance
 ```
 
+## What to Omit
+
+The repo is public. Keep the title and description to the code change and its reasoning — never:
+
+- Customer, company, or user names; workspace/user/org IDs; email addresses
+- Prod or staging operational data: log lines, DB rows, metrics, timestamps, incident details, canary/alert output
+- Infrastructure specifics: hostnames, ARNs, internal URLs, env var values, secret names
+
+Describe the bug by its mechanism, not by how you found it. "Expired OAuth credentials fail to refresh in the worker" — not "the Sheets canary failed at 16:31Z for workspace abc-123".
+
 ## PR Description Format
 
 Use this exact template in the user's voice (concise, bullet points):

.claude/commands/tool-registry-boundary.md

@@ -67,6 +67,10 @@ If it fails, do not add the entry to an allowlist — there isn't one. Find the
 
 Run it with `--verbose` to print per-route module counts, which is also the quickest way to see whether a change moved the graph.
 
+The same command also ratchets those counts against `check-tool-registry-boundary.baseline.json`. `--check` (what CI runs) fails when an entry exceeds its baseline by more than `max(25 modules, 2%)`, naming the import chain responsible. This catches bloat the registry rule misses — a prefetch importing `listTables` cost the Tables page 444 modules without ever touching `@/tools/registry`.
+
+Re-record with `--update-baseline` and commit the JSON when growth is deliberate. A *shrink* passes but is reported — re-record then too, or the win is silently spendable again.
+
 ## How to verify an edge actually got cut
 
 Do not eyeball imports — the registry is reached through several redundant paths, so cutting one buys nothing while another survives. Walk the graph:

.claude/rules/sim-architecture.md

@@ -57,6 +57,27 @@ Use the `migrate-application-operation` skill before creating or migrating a pro
 
 Every export of a `'use client'` module becomes a *client reference* on the server — server-evaluated code (RSC pages/layouts, `prefetch.ts`, route handlers, block definitions, triggers) can only *render* it as a component or pass it as a prop, never *call* it (doing so throws at runtime, e.g. `tableKeys.list is not a function`; `next build` does not catch it). Keep server-importable query primitives (key factories, fetchers, mappers, constants) in non-`'use client'` modules — see `.claude/rules/sim-queries.md`. Enforced by `scripts/check-client-boundary-imports.ts`.
 
+## The app/worker runtime boundary
+
+Server code runs in two runtimes with **different environments**. The app container loads the
+full env from `SIM_ENV_SECRET_ID` (Secrets Manager). Trigger.dev workers — which execute
+workflows, so every block handler and every tool call — get their env from the Trigger.dev
+dashboard, and `trigger.config.ts` syncs only `DB_APP_NAME`. The repo cannot see what the
+dashboard holds.
+
+So before replacing a worker's HTTP call to our own API with an in-process call, ask what env
+that work reads *on the app side*. Anything gated by a `require*Capability` helper is the sharp
+case: those **throw** when the variable is absent (`requireOAuthClientCapability` →
+`EnvCapabilityConfigurationError`), and the throw may be caught and reported as something
+unrelated. OAuth token refresh is the known example — moving it into the worker turns every
+expired credential into `Failed to refresh access token`, while a still-valid token hides the
+bug entirely, so it surfaces hours later and only for whoever's token lapsed first.
+
+An in-process conversion is safe when the same work already runs in that runtime (the agent
+block has always called `executeProviderRequest` in-process, so router and evaluator joining it
+is proven), or when the caller and the callee are both the app (a route calling a lib module, an
+RSC prefetch reading the data layer). It is not safe on reasoning alone.
+
 ## Feature Organization
 
 Features live under `app/workspace/[workspaceId]/`:

.claude/rules/sim-queries.md

@@ -143,6 +143,22 @@ const handler = useCallback(() => {
 }, [data])
 ```
 
+## Server prefetching
+
+A server prefetch fills the *same* cache key a client hook fills, so it must be indistinguishable from a client fetch. Five rules:
+
+1. **Read the data layer, never our own API over HTTP.** A server-to-server call to `/api/...` costs a round trip and a second authentication for data the process can already read. Where the route runs an application use case, call that same use case with a principal from the same auth policy the route declares — not a manager underneath it.
+2. **Match the wire shape the hook caches.** The hook's data is whatever `requestJson(contract, …)` produced, so the seed must equal it. Two traps: a contract field declared `z.coerce.date()` means the hook holds a `Date` where raw route JSON holds a string; a passthrough response schema (`z.custom`) means the hook caches route JSON *verbatim*, so seeding raw rows leaks `Date`s and server-only fields. When the route projects before responding, share that projection — have the route and the prefetch call one function.
+3. **Prove the viewer.** Data-layer reads carry no authorization; the route used to provide it. Resolve the viewer (`getWorkspaceHostContextForViewer`, already `cache`d by the layout so it costs nothing) and return early on failure, caching nothing — the client fetch then reaches the route for the real 403. Never widen what a viewer can see.
+4. **Always `await`.** Only a settled query is dehydrated, so an unawaited prefetch is silently dropped from the payload and the pane waterfalls anyway.
+5. **Don't repeat what the layout already seeded.** `getQueryClient()` builds a new client per server call, so a page re-seeding a layout key is a genuine second read — and `HydrationBoundary` defers an already-seen query to an effect, which SSR never runs, so it never reaches the server render either.
+
+Reuse the hook's exported `staleTime` constant and its key factory; `dehydrate` carries neither options nor `staleTime`, and freshness is per-observer.
+
+Seed with `setQueryData` only when the prefetch must be able to *decline* to create an entry (an empty list that has to fall through to a route's creation path). `prefetchQuery` and `ensureQueryData` always create one.
+
+Keep prefetch imports light. A page prefetch's imports land in that route's server graph, so pulling a barrel to reach one function can drag thousands of modules behind it — `bun run check:tool-registry-boundary` gates this per page.
+
 ## Boundary Types
 
 - Hooks import named type aliases from `@/lib/api/contracts/**` (e.g., `import { listEntitiesContract, type EntityList } from '@/lib/api/contracts/entities'`). Never write `z.input<...>` / `z.output<...>` in hooks, and never `import { z } from 'zod'` in client code.

.cursor/commands/ship.md

@@ -94,6 +94,16 @@ improvement(scope): description for enhancements
 chore(scope): description for maintenance
 ```
 
+## What to Omit
+
+The repo is public. Keep the title and description to the code change and its reasoning — never:
+
+- Customer, company, or user names; workspace/user/org IDs; email addresses
+- Prod or staging operational data: log lines, DB rows, metrics, timestamps, incident details, canary/alert output
+- Infrastructure specifics: hostnames, ARNs, internal URLs, env var values, secret names
+
+Describe the bug by its mechanism, not by how you found it. "Expired OAuth credentials fail to refresh in the worker" — not "the Sheets canary failed at 16:31Z for workspace abc-123".
+
 ## PR Description Format
 
 Use this exact template in the user's voice (concise, bullet points):

.cursor/commands/tool-registry-boundary.md

@@ -63,6 +63,10 @@ If it fails, do not add the entry to an allowlist — there isn't one. Find the
 
 Run it with `--verbose` to print per-route module counts, which is also the quickest way to see whether a change moved the graph.
 
+The same command also ratchets those counts against `check-tool-registry-boundary.baseline.json`. `--check` (what CI runs) fails when an entry exceeds its baseline by more than `max(25 modules, 2%)`, naming the import chain responsible. This catches bloat the registry rule misses — a prefetch importing `listTables` cost the Tables page 444 modules without ever touching `@/tools/registry`.
+
+Re-record with `--update-baseline` and commit the JSON when growth is deliberate. A *shrink* passes but is reported — re-record then too, or the win is silently spendable again.
+
 ## How to verify an edge actually got cut
 
 Do not eyeball imports — the registry is reached through several redundant paths, so cutting one buys nothing while another survives. Walk the graph: