v0.8.0

## Features

- feat(blog): Tracking Secrets Through an Agent Run (#6558)
- feat(library): What Is Retrieval-Augmented Generation (RAG)? (#6555)
- feat(calendly): extend tools with booking, availability, no-shows, and routing forms (#6545)
- feat(search): page-aware cmd+k palette with ask-Sim mode (#6518)
- feat(incidentio): add on-call, alert, catalog, and team tools (#6529)
- feat(salesforce): add JWT bearer flow and sandbox OAuth support (#6508)
- feat(workflows): new workflow block card, progress indicator, colors, dsl for natural language preview, retry configs (#6458)
- feat(comparisons): add code-sandbox and session-policy rows (#6517)

## Improvements

- perf(db): drop 0287's two zero-row scans from the ACCESS EXCLUSIVE hold (#6609)
- improvement(integrations): add Managed Agents templates and guard docs links (#6608)
- refactor(audit): derive updatedFields through one shared helper (#6604)
- improvement(updates): validate update path and fix native mac help (#6580)
- improvement(desktop, executions): fix desktop update script and throw error when thinking enabled on stream false (#6578)
- improvement(desktop): help menu
- improvement(desktop): add apple signing, fix some bugs (#6519)
- improvement(provenance): make the incompleteness reason set closed and complete (#6559)
- improvement(audits): skip the sql-date-binding parse for files without drizzle-orm (#6554)
- improvement(external-endpoints): v2 versions with clean signatures + updated docs based on openapi spec (#5273)
- improvement(ui): align terminal with the workflow design system, fix row hover states (#6534)
- improvement(setup): complete knowledge and update flows (#6521)
- improvement(provenance): name every guard that can latch a registry (#6513)

## Bug Fixes

- fix(executor): carry child provenance across the workflow agent tool result (#6619)
- fix(executor): copy the env map at the workflow-tool boundary (#6618)
- fix(v2): derive the log and run status enums from the persisted status list (#6612)
- fix(docs): restore api-reference URL continuity and fix translated SDK bodies (#6617)
- fix(sdk): make the 0.2.0 SDK release safe to publish (#6616)
- fix(copilot): clamp the legacy int4 size when materializing a chat upload (#6615)
- fix(executor): give the workflow agent tool the caller's env and PII policy (#6611)
- fix(workflows): pin a stored block retry policy when loading it (#6614)
- fix(mcp): stop refusing tool results authored by another workspace member (#6610)
- fix(uploads): sign Azure upload URLs create-only (#6607)
- fix(mcp): audit an upsert that rewrites or revives a server (#6602)
- fix(uploads): make execution attachment completion replay-safe (#6601)
- fix(files): restore CSV preview cancellation (#6596)
- fix(tables): tolerate row deletion during run cancellation (#6600)
- fix(files): order file folders in SQL like every other folder list (#6599)
- fix(mcp): audit the columns an MCP server update wrote, not the params it got (#6598)
- fix(knowledge): return pending status for new documents (#6597)
- fix(workflows): redact run and export secrets (#6591)
- fix(tables): prevent legacy group auto-run dispatch (#6595)
- fix(logs, workflows): snapshot fetch optionality, restore consistent draft read snapshots (#6594)
- fix(tools): bind schema-enrichment reads to executor delegations (#6593)
- fix(api): widen the cancel-execution reason contract to what the route emits (#6592)
- fix(api): wait for knowledge dispatch and encode filenames (#6583)
- fix(desktop): fix background tab spawning (#6590)
- fix(security): redact workflow snapshot secrets (#6581)
- fix(files): preserve slashes in folder paths (#6589)
- fix(logs): restore narrow v1 detail query (#6588)
- fix(api): conceal cross-tenant resource denials on internal routes (#6586)
- fix(tables): preserve group auto-run semantics (#6579)
- fix(docs): preserve items response fields (#6587)
- fix(api): close five defects found auditing the v2 migration against main (#6575)
- fix(authz): enforce credential and workspace boundaries (#6585)
- fix(api): collapse the internal error envelope and restore requestId (#6584)
- fix(tables): cap row pages and use native cursors (#6582)
- fix(api): restore migrated endpoint and SDK compatibility (#6564)
- fix(mship, desktop): fix bugs (#6572)
- fix(agiloft): resolve attachment MIME type instead of trusting the header (#6573)
- fix(v2-api): close three secret disclosures, make the surface consistent, and align docs with signatures (#6560)
- fix(credentials): authorize shared credentials without requiring a workflow (#6571)
- fix(agiloft): repoint the block at the alrest surface and fix EWLogin (#6562)
- fix(forks): detect secrets referenced from advanced-mode fields (#6566)
- fix(files): let a mouse wheel scroll CSV and XLSX previews horizontally (#6563)
- fix(api): align v2 permissions and resource behavior (#6557)
- fix(agiloft): align the integration with the documented ewws REST interface (#6556)
- fix(files): restore horizontal scroll in CSV and XLSX preview tables (#6550)
- fix(provenance): make one length floor the whole substitution rule (#6551)
- fix(auth): rate limit the password reset endpoints (#6553)
- fix(api): restore legacy endpoint compatibility (#6552)
- fix(tools): bound internal tool calls by the plan deadline, not Bun's fetch default (#6547)
- fix(auth): let Microsoft sign-in link via Entra's domain-verified email claim (#6546)
- fix(cmdk): update search-modal assertions to the renamed New chat label (#6549)
- fix(atlassian): share one cached, retrying cloudId resolver across Jira, Confluence, and JSM (#6541)
- fix(v2-api): standardization (#6542)
- fix(cmdk): New Chat -> New chat (#6543)
- fix(knowledge): retain model input provenance (#6540)
- fix(chat): deduplicate chat sends server-side instead of probing for them (#6536)
- fix(executor): restore delegated workflow execution (#6539)
- fix(ci): include auth package in app prune (#6538)
- fix(chat): stop losing sends aborted during mount-settling (#6525)
- fix(chat): stop the streaming transcript floor inventing scroll space (#6527)
- fix(logs): keep run provenance when compaction drops the execution state (#6528)
- fix(workflows): port the canvas card icons off lucide-react (#6523)
- fix(tables): handle row deletion during cell execution (#6520)
- fix(folders): show the folder trail in table and knowledge base headers (#6515)
- fix(knowledge): pluralize the module header and root breadcrumb (#6516)
- fix(sidebar): pluralize the Knowledge bases nav label (#6514)

## Other Changes

- test(export): pin the table and tool-param loss the sanitized export accepts (#6613)
- chore: remove the stray .agiloft-spec working notes (#6605)
- test(table): pin the executor auth pairing on the table read route (#6603)
- docs(salesforce): correct the setup steps that would strand an admin (#6526)

## Contributors

- @Sg312
- @TheodoreSpeaks
- @icecrasher321
- @j15z
- @waleedlatif1

[View changes on GitHub](https://github.com/simstudioai/sim/compare/v0.7.68...v0.8.0)