fix(incidentio,trigger_dev): reject path-traversal ids and free the reserved timeout param

apps/docs/content/docs/integrations/trigger_dev.mdx

@@ -1761,7 +1761,7 @@ Create a Trigger.dev waitpoint token that a task can wait on until it is complet
 | Parameter | Type | Required | Description |
 | --------- | ---- | -------- | ----------- |
 | `apiKey` | string | Yes | Trigger.dev secret API key \(starts with tr_\) |
-| `timeout` | string | No | How long before the token times out, as a duration \("30s", "1m", "2h", "3d"\) or an ISO 8601 date |
+| `waitpointTimeout` | string | No | How long before the token times out, as a duration \("30s", "1m", "2h", "3d"\) or an ISO 8601 date |
 | `idempotencyKey` | string | No | Idempotency key; passing the same key before it expires returns the original token |
 | `idempotencyKeyTTL` | string | No | How long the idempotency key is valid, as a duration \("30s", "1m", "2h", "3d"\) |
 | `tags` | string | No | Comma-separated tags to attach to the waitpoint \(max 10, each under 128 characters\) |

apps/sim/blocks/blocks/trigger_dev.ts

@@ -1006,6 +1006,25 @@ Return ONLY the valid JSON object - no explanations, no markdown.`,
           scoped(params.version, ['trigger_dev_list_runs']) ??
           scoped(params.deploymentVersion, ['trigger_dev_promote_deployment'])
         result.data = scoped(params.waitpointData, ['trigger_dev_complete_waitpoint_token'])
+        /**
+         * The `timeout` subBlock keeps its id so saved workflow state stays
+         * valid, but it must not reach the tool under that name: the request
+         * transport reads `params.timeout` as the outbound HTTP deadline in
+         * milliseconds. Remap it here — in `params`, which runs after variable
+         * resolution — and clear the original so it cannot shadow the deadline.
+         *
+         * The second branch is what keeps the agent path working. This function
+         * also runs as the provider `paramsTransform`, whose result is spread
+         * OVER the model's own tool-call arguments, so every key assigned here
+         * overwrites the model's value — including with `undefined`. On that
+         * path the model supplies the tool's own param name,
+         * `waitpointTimeout`, and no `timeout` subBlock value exists, so
+         * reading `params.timeout` alone would erase what the model sent.
+         */
+        result.waitpointTimeout =
+          scoped(params.timeout, ['trigger_dev_create_waitpoint_token']) ??
+          scoped(params.waitpointTimeout, ['trigger_dev_create_waitpoint_token'])
+        result.timeout = undefined
         result.period = scoped(params.period, CREATED_AT_FILTER_OPERATIONS)
         result.from = scoped(params.from, CREATED_AT_FILTER_OPERATIONS)
         result.to = scoped(params.to, CREATED_AT_FILTER_OPERATIONS)

apps/sim/tools/incidentio/actions_show.ts

@@ -3,6 +3,7 @@ import type {
   IncidentioActionsShowResponse,
 } from '@/tools/incidentio/types'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 export const actionsShowTool: ToolConfig<
   IncidentioActionsShowParams,
@@ -29,7 +30,7 @@ export const actionsShowTool: ToolConfig<
   },
 
   request: {
-    url: (params) => `https://api.incident.io/v2/actions/${params.id.trim()}`,
+    url: (params) => `https://api.incident.io/v2/actions/${safeUrlPathSegment(params.id, 'id')}`,
     method: 'GET',
     headers: (params) => ({
       'Content-Type': 'application/json',

apps/sim/tools/incidentio/actions_update.ts

@@ -4,6 +4,7 @@ import {
   type IncidentioActionsUpdateResponse,
 } from '@/tools/incidentio/types'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 export const actionsUpdateTool: ToolConfig<
   IncidentioActionsUpdateParams,
@@ -51,7 +52,7 @@ export const actionsUpdateTool: ToolConfig<
   },
 
   request: {
-    url: (params) => `https://api.incident.io/v2/actions/${encodeURIComponent(params.id.trim())}`,
+    url: (params) => `https://api.incident.io/v2/actions/${safeUrlPathSegment(params.id, 'id')}`,
     method: 'PUT',
     headers: (params) => ({
       'Content-Type': 'application/json',

apps/sim/tools/incidentio/alert_events_create.ts

@@ -4,6 +4,7 @@ import type {
 } from '@/tools/incidentio/types'
 import { parseIncidentioJsonParam } from '@/tools/incidentio/utils'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 export const alertEventsCreateTool: ToolConfig<
   IncidentioAlertEventsCreateParams,
@@ -72,9 +73,7 @@ export const alertEventsCreateTool: ToolConfig<
 
   request: {
     url: (params) =>
-      `https://api.incident.io/v2/alert_events/http/${encodeURIComponent(
-        params.alert_source_config_id.trim()
-      )}`,
+      `https://api.incident.io/v2/alert_events/http/${safeUrlPathSegment(params.alert_source_config_id, 'alert_source_config_id')}`,
     method: 'POST',
     headers: (params) => ({
       'Content-Type': 'application/json',

apps/sim/tools/incidentio/alerts_resolve.ts

@@ -4,6 +4,7 @@ import {
   type IncidentioAlertsResolveResponse,
 } from '@/tools/incidentio/types'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 export const alertsResolveTool: ToolConfig<
   IncidentioAlertsResolveParams,
@@ -32,7 +33,7 @@ export const alertsResolveTool: ToolConfig<
 
   request: {
     url: (params) =>
-      `https://api.incident.io/v2/alerts/${encodeURIComponent(params.id.trim())}/actions/resolve`,
+      `https://api.incident.io/v2/alerts/${safeUrlPathSegment(params.id, 'id')}/actions/resolve`,
     method: 'POST',
     headers: (params) => ({
       'Content-Type': 'application/json',

apps/sim/tools/incidentio/alerts_show.ts

@@ -4,6 +4,7 @@ import {
   type IncidentioAlertsShowResponse,
 } from '@/tools/incidentio/types'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 export const alertsShowTool: ToolConfig<IncidentioAlertsShowParams, IncidentioAlertsShowResponse> =
   {
@@ -28,7 +29,7 @@ export const alertsShowTool: ToolConfig<IncidentioAlertsShowParams, IncidentioAl
     },
 
     request: {
-      url: (params) => `https://api.incident.io/v2/alerts/${encodeURIComponent(params.id.trim())}`,
+      url: (params) => `https://api.incident.io/v2/alerts/${safeUrlPathSegment(params.id, 'id')}`,
       method: 'GET',
       headers: (params) => ({
         'Content-Type': 'application/json',

apps/sim/tools/incidentio/custom_fields_delete.ts

@@ -1,5 +1,6 @@
 import type { CustomFieldsDeleteParams, CustomFieldsDeleteResponse } from '@/tools/incidentio/types'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 export const customFieldsDeleteTool: ToolConfig<
   CustomFieldsDeleteParams,
@@ -26,7 +27,8 @@ export const customFieldsDeleteTool: ToolConfig<
   },
 
   request: {
-    url: (params) => `https://api.incident.io/v2/custom_fields/${params.id.trim()}`,
+    url: (params) =>
+      `https://api.incident.io/v2/custom_fields/${safeUrlPathSegment(params.id, 'id')}`,
     method: 'DELETE',
     headers: (params) => ({
       'Content-Type': 'application/json',

apps/sim/tools/incidentio/custom_fields_show.ts

@@ -1,5 +1,6 @@
 import type { CustomFieldsShowParams, CustomFieldsShowResponse } from '@/tools/incidentio/types'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 export const customFieldsShowTool: ToolConfig<CustomFieldsShowParams, CustomFieldsShowResponse> = {
   id: 'incidentio_custom_fields_show',
@@ -23,7 +24,8 @@ export const customFieldsShowTool: ToolConfig<CustomFieldsShowParams, CustomFiel
   },
 
   request: {
-    url: (params) => `https://api.incident.io/v2/custom_fields/${params.id.trim()}`,
+    url: (params) =>
+      `https://api.incident.io/v2/custom_fields/${safeUrlPathSegment(params.id, 'id')}`,
     method: 'GET',
     headers: (params) => ({
       'Content-Type': 'application/json',

apps/sim/tools/incidentio/custom_fields_update.ts

@@ -1,5 +1,6 @@
 import type { CustomFieldsUpdateParams, CustomFieldsUpdateResponse } from '@/tools/incidentio/types'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 export const customFieldsUpdateTool: ToolConfig<
   CustomFieldsUpdateParams,
@@ -38,7 +39,8 @@ export const customFieldsUpdateTool: ToolConfig<
   },
 
   request: {
-    url: (params) => `https://api.incident.io/v2/custom_fields/${params.id.trim()}`,
+    url: (params) =>
+      `https://api.incident.io/v2/custom_fields/${safeUrlPathSegment(params.id, 'id')}`,
     method: 'PUT',
     headers: (params) => ({
       'Content-Type': 'application/json',

apps/sim/tools/incidentio/escalation_paths_delete.ts

@@ -3,6 +3,7 @@ import type {
   IncidentioEscalationPathsDeleteResponse,
 } from '@/tools/incidentio/types'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 export const escalationPathsDeleteTool: ToolConfig<
   IncidentioEscalationPathsDeleteParams,
@@ -29,7 +30,8 @@ export const escalationPathsDeleteTool: ToolConfig<
   },
 
   request: {
-    url: (params) => `https://api.incident.io/v2/escalation_paths/${params.id.trim()}`,
+    url: (params) =>
+      `https://api.incident.io/v2/escalation_paths/${safeUrlPathSegment(params.id, 'id')}`,
     method: 'DELETE',
     headers: (params) => ({
       'Content-Type': 'application/json',

apps/sim/tools/incidentio/escalation_paths_show.ts

@@ -3,6 +3,7 @@ import type {
   IncidentioEscalationPathsShowResponse,
 } from '@/tools/incidentio/types'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 export const escalationPathsShowTool: ToolConfig<
   IncidentioEscalationPathsShowParams,
@@ -29,7 +30,8 @@ export const escalationPathsShowTool: ToolConfig<
   },
 
   request: {
-    url: (params) => `https://api.incident.io/v2/escalation_paths/${params.id.trim()}`,
+    url: (params) =>
+      `https://api.incident.io/v2/escalation_paths/${safeUrlPathSegment(params.id, 'id')}`,
     method: 'GET',
     headers: (params) => ({
       'Content-Type': 'application/json',

apps/sim/tools/incidentio/escalation_paths_update.ts

@@ -3,6 +3,7 @@ import type {
   IncidentioEscalationPathsUpdateResponse,
 } from '@/tools/incidentio/types'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 export const escalationPathsUpdateTool: ToolConfig<
   IncidentioEscalationPathsUpdateParams,
@@ -48,7 +49,8 @@ export const escalationPathsUpdateTool: ToolConfig<
   },
 
   request: {
-    url: (params) => `https://api.incident.io/v2/escalation_paths/${params.id.trim()}`,
+    url: (params) =>
+      `https://api.incident.io/v2/escalation_paths/${safeUrlPathSegment(params.id, 'id')}`,
     method: 'PUT',
     headers: (params) => ({
       'Content-Type': 'application/json',

apps/sim/tools/incidentio/escalations_cancel.ts

@@ -3,6 +3,7 @@ import type {
   IncidentioEscalationsCancelResponse,
 } from '@/tools/incidentio/types'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 export const escalationsCancelTool: ToolConfig<
   IncidentioEscalationsCancelParams,
@@ -31,7 +32,7 @@ export const escalationsCancelTool: ToolConfig<
 
   request: {
     url: (params) =>
-      `https://api.incident.io/v2/escalations/${encodeURIComponent(params.id.trim())}/actions/cancel`,
+      `https://api.incident.io/v2/escalations/${safeUrlPathSegment(params.id, 'id')}/actions/cancel`,
     method: 'POST',
     headers: (params) => ({
       'Content-Type': 'application/json',

apps/sim/tools/incidentio/escalations_show.ts

@@ -3,6 +3,7 @@ import type {
   IncidentioEscalationsShowResponse,
 } from '@/tools/incidentio/types'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 export const escalationsShowTool: ToolConfig<
   IncidentioEscalationsShowParams,
@@ -29,7 +30,8 @@ export const escalationsShowTool: ToolConfig<
   },
 
   request: {
-    url: (params) => `https://api.incident.io/v2/escalations/${params.id.trim()}`,
+    url: (params) =>
+      `https://api.incident.io/v2/escalations/${safeUrlPathSegment(params.id, 'id')}`,
     method: 'GET',
     headers: (params) => ({
       'Content-Type': 'application/json',

apps/sim/tools/incidentio/follow_ups_show.ts

@@ -3,6 +3,7 @@ import type {
   IncidentioFollowUpsShowResponse,
 } from '@/tools/incidentio/types'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 export const followUpsShowTool: ToolConfig<
   IncidentioFollowUpsShowParams,
@@ -29,7 +30,7 @@ export const followUpsShowTool: ToolConfig<
   },
 
   request: {
-    url: (params) => `https://api.incident.io/v2/follow_ups/${params.id.trim()}`,
+    url: (params) => `https://api.incident.io/v2/follow_ups/${safeUrlPathSegment(params.id, 'id')}`,
     method: 'GET',
     headers: (params) => ({
       'Content-Type': 'application/json',

apps/sim/tools/incidentio/follow_ups_update.ts

@@ -4,6 +4,7 @@ import {
   type IncidentioFollowUpsUpdateResponse,
 } from '@/tools/incidentio/types'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 export const followUpsUpdateTool: ToolConfig<
   IncidentioFollowUpsUpdateParams,
@@ -80,8 +81,7 @@ export const followUpsUpdateTool: ToolConfig<
   },
 
   request: {
-    url: (params) =>
-      `https://api.incident.io/v2/follow_ups/${encodeURIComponent(params.id.trim())}`,
+    url: (params) => `https://api.incident.io/v2/follow_ups/${safeUrlPathSegment(params.id, 'id')}`,
     method: 'PUT',
     headers: (params) => ({
       'Content-Type': 'application/json',

apps/sim/tools/incidentio/incident_roles_delete.ts

@@ -3,6 +3,7 @@ import type {
   IncidentioIncidentRolesDeleteResponse,
 } from '@/tools/incidentio/types'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 export const incidentRolesDeleteTool: ToolConfig<
   IncidentioIncidentRolesDeleteParams,
@@ -29,7 +30,8 @@ export const incidentRolesDeleteTool: ToolConfig<
   },
 
   request: {
-    url: (params) => `https://api.incident.io/v2/incident_roles/${params.id.trim()}`,
+    url: (params) =>
+      `https://api.incident.io/v2/incident_roles/${safeUrlPathSegment(params.id, 'id')}`,
     method: 'DELETE',
     headers: (params) => ({
       'Content-Type': 'application/json',

apps/sim/tools/incidentio/incident_roles_show.ts

@@ -3,6 +3,7 @@ import type {
   IncidentioIncidentRolesShowResponse,
 } from '@/tools/incidentio/types'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 export const incidentRolesShowTool: ToolConfig<
   IncidentioIncidentRolesShowParams,
@@ -29,7 +30,8 @@ export const incidentRolesShowTool: ToolConfig<
   },
 
   request: {
-    url: (params) => `https://api.incident.io/v2/incident_roles/${params.id.trim()}`,
+    url: (params) =>
+      `https://api.incident.io/v2/incident_roles/${safeUrlPathSegment(params.id, 'id')}`,
     method: 'GET',
     headers: (params) => ({
       'Content-Type': 'application/json',

apps/sim/tools/incidentio/incident_roles_update.ts

@@ -3,6 +3,7 @@ import type {
   IncidentioIncidentRolesUpdateResponse,
 } from '@/tools/incidentio/types'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 export const incidentRolesUpdateTool: ToolConfig<
   IncidentioIncidentRolesUpdateParams,
@@ -53,7 +54,8 @@ export const incidentRolesUpdateTool: ToolConfig<
   },
 
   request: {
-    url: (params) => `https://api.incident.io/v2/incident_roles/${params.id.trim()}`,
+    url: (params) =>
+      `https://api.incident.io/v2/incident_roles/${safeUrlPathSegment(params.id, 'id')}`,
     method: 'PUT',
     headers: (params) => ({
       'Content-Type': 'application/json',

apps/sim/tools/incidentio/incident_timestamps_show.ts

@@ -3,6 +3,7 @@ import type {
   IncidentioIncidentTimestampsShowResponse,
 } from '@/tools/incidentio/types'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 export const incidentTimestampsShowTool: ToolConfig<
   IncidentioIncidentTimestampsShowParams,
@@ -29,7 +30,8 @@ export const incidentTimestampsShowTool: ToolConfig<
   },
 
   request: {
-    url: (params) => `https://api.incident.io/v2/incident_timestamps/${params.id.trim()}`,
+    url: (params) =>
+      `https://api.incident.io/v2/incident_timestamps/${safeUrlPathSegment(params.id, 'id')}`,
     method: 'GET',
     headers: (params) => ({
       'Content-Type': 'application/json',

apps/sim/tools/incidentio/incidents_show.ts

@@ -3,6 +3,7 @@ import type {
   IncidentioIncidentsShowResponse,
 } from '@/tools/incidentio/types'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 export const incidentsShowTool: ToolConfig<
   IncidentioIncidentsShowParams,
@@ -30,7 +31,7 @@ export const incidentsShowTool: ToolConfig<
   },
 
   request: {
-    url: (params) => `https://api.incident.io/v2/incidents/${params.id.trim()}`,
+    url: (params) => `https://api.incident.io/v2/incidents/${safeUrlPathSegment(params.id, 'id')}`,
     method: 'GET',
     headers: (params) => ({
       'Content-Type': 'application/json',