v0.7.60: tables, memory, sso improvements

[waleedlatif1]

• fix(memory): provenance checks (fix(memory): empty memory case #6322)
• fix(tables): stop row writes 500ing on a column outside the table schema (fix(tables): stop row writes 500ing on a column outside the table schema #6323)
• fix(sso): show the saved client secret as a masked fact with an explicit Replace action (fix(sso): show the saved client secret as a masked fact with an explicit Replace action #6321)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 6, 2026 9:34am

[cursor]

PR Summary

Medium Risk
Changes sit on SSO credential handling and provenance validation for memory/table writes; behavior is tightened with tests but mis-handling could affect secret retention or provenance completeness for tool execution.

Overview
Fixes three production issues around secret provenance, table writes, and SSO OIDC editing.

Memory: GET /api/memory/[id] now routes the “no row” case through createMemoryResponse so internal tool callers that negotiate provenance metadata get a verified complete-empty provenance envelope (with response header), while normal callers still see { success: true, data: null }. The contract response type allows nullable data.

Tables: Row-write secret provenance no longer throws when a submitted column name does not map to the schema (same keys the wire translator drops). Targets keep a null columnId for dropped columns so bundle completeness still pairs one selection per submitted column, but no provenance is stored for values that were never persisted.

SSO: The providers API still redacts clientSecret but may attach clientSecretHint (last four characters when the stored secret is long enough). The settings UI treats a saved OIDC secret as a masked read-only row with Replace / Keep saved, skips required validation while keeping the secret, and on update sends the [REDACTED] sentinel (trimmed) unless the admin explicitly replaces it.

^{Reviewed by Cursor Bugbot for commit c4ccee0. Configure here.}

[greptile-apps]

Greptile Summary

The PR improves secret-provenance handling for empty memory lookups and unknown table columns, and adds an explicit masked/replace workflow for stored SSO client secrets. The SSO replacement path currently normalizes an opaque credential, which can save a value different from the identity provider’s secret.

• Returns exact-empty provenance metadata for missing memories while making the GET response contract nullable.
• Keeps table writes from failing when submitted keys are absent from the table schema.
• Shows stored SSO secrets as a fixed mask with an optional suffix and explicit replacement controls.
• Preserves an existing secret through the redaction sentinel when no replacement is supplied.

Confidence Score: 4/5

The SSO credential-normalization defect should be fixed before merging because it can save a client secret different from the identity provider’s configured value.

The memory and table provenance changes preserve their existing trust and persistence invariants, but the new SSO replacement path trims an opaque secret before storage and can break OIDC authentication for credentials containing boundary whitespace.

Files Needing Attention: apps/sim/ee/sso/components/sso-settings.tsx

Important Files Changed

Filename	Overview
apps/sim/ee/sso/components/sso-settings.tsx	Adds the masked-secret replacement workflow, but trims replacement credentials and can therefore change valid opaque secret values.
apps/sim/app/api/auth/sso/providers/route.ts	Redacts stored client secrets and exposes a four-character hint only for sufficiently long secrets to already-authorized provider viewers.
apps/sim/app/api/table/row-secret-provenance.ts	Represents translator-dropped columns with null targets and consistently omits their provenance because those columns are not persisted.
apps/sim/app/api/memory/[id]/route.ts	Routes empty lookups through the existing authenticated metadata response helper so internal tools receive verified exact-empty provenance.
apps/sim/lib/api/contracts/memory.ts	Correctly permits null data for successful GET requests where no matching memory exists.

Sequence Diagram

sequenceDiagram
  participant Admin
  participant UI as SSO Settings
  participant API as SSO Register API
  participant Store as Provider Store
  Admin->>UI: Edit OIDC provider
  UI->>Admin: Show fixed mask and Replace action
  alt Keep saved secret
    UI->>API: "clientSecret = REDACTED_MARKER"
    API->>Store: Load and preserve exact stored secret
  else Replace secret
    Admin->>UI: Enter replacement value
    UI->>UI: trim replacement
    UI->>API: Submit normalized value
    API->>Store: Save normalized secret
  end

Loading

_{Reviews (1): Last reviewed commit: "fix(sso): show the saved client secret a..." | Re-trigger Greptile}

[greptile-apps]

Replacement secret bytes are altered

When an OIDC client secret begins or ends with whitespace, this submission path trims the opaque credential before saving it, causing the stored value to differ from the identity provider's secret and subsequent authentication to fail.

Suggested change

	clientSecret:
	hasStoredClientSecret && !formData.clientSecret.trim()
	? REDACTED_MARKER
	: formData.clientSecret.trim(),
	clientSecret:
	hasStoredClientSecret && !formData.clientSecret.trim()
	? REDACTED_MARKER
	: formData.clientSecret,