Sim has updated the execution and connection rules for its agent-workflow platform. Version 0.9.48 drops pending network requests when an operation is abandoned or runs out of time, and disposes of the isolated environment after a host timeout. Other changes address one-time verification codes, account-link confirmation and the credentials used during execution.
Sim has changed how its agent-workflow platform ends work inside an isolated execution environment. In version 0.9.48, released on November 8, outstanding network requests are dropped when the worker pool abandons an operation or its budget expires. A timeout on the host also disposes of the isolated environment. Timer bridges receive an upper limit. The project presents these as software fixes, without announcing that the corrected behavior was exploited.[1]
A successful one-time verification code can be used only once under the revised handling. Codes without an expiry are excluded from comparison. Each verification attempt is reserved atomically before the code is checked, addressing simultaneous requests that could share an allowance. Account connections to a workspace also gain confirmation before OAuth starts, and connection launches originating across sites are rejected.[1]
The authentication type determines whose credentials an execution uses, replacing a client-session flag supplied with the request. Archives are rejected if the ZIP library reads beyond the guarded region. Separately, fal.ai video models accept an initial image frame, and saving video settings reads the active start-frame input. Live-search MCP responses also remove duplicate facts.[1]
