feat(jupyter): add Jupyter integration (contents, kernels, sessions) by waleedlatif1 · Pull Request #5527 · simstudioai/sim

waleedlatif1 · 2026-07-09T01:20:05Z

Summary

Adds a Jupyter integration: 16 tools covering the Contents, Kernels, Kernelspecs, and Sessions REST APIs on a self-hosted Jupyter server
File upload/download handled via UserFile, following the same internal-route pattern used by Box (auth → download from storage → base64 → PUT to server)
New block with an operation dropdown, server URL + token auth fields, and 8 catalog templates
Registered tools + block in the registries, generated docs, bumped the API validation route-count baseline

Type of Change

New feature

Testing

Tested manually (typecheck, biome, check:api-validation:strict, check:bare-icons all pass). Verified tool endpoints/fields against the Jupyter Server REST API spec and cross-checked the file-handling code against Box's established pattern with independent review passes.

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

vercel · 2026-07-09T01:20:11Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Jul 9, 2026 2:29am

cursor · 2026-07-09T01:20:15Z

PR Summary

Medium Risk
Server-side proxying to user-supplied Jupyter URLs (including HTTP/private IPs) and remote file/kernel mutations warrant careful review of SSRF and auth boundaries, though DNS pinning, path checks, and internal auth mitigate much of the exposure.

Overview
Adds a Jupyter workflow integration for self-hosted Jupyter Server instances, authenticated with server URL + token.

16 tools cover Contents (list/read/create/upload/rename/copy/delete), Kernels (list/start/stop/restart/interrupt), Kernelspecs, and Sessions. Most calls go through new internal routes /api/tools/jupyter/proxy and /api/tools/jupyter/upload, which DNS-pin upstream requests, allow HTTP for local/private hosts, disable redirects, and validate paths against traversal (including encoded segments). Uploads follow the existing pattern: resolve UserFile from storage with access checks, then PUT base64 content to Jupyter.

A new Jupyter block exposes an operation dropdown and shared auth fields; tools, block metadata, integrations.json, docs (jupyter.mdx), and JupyterIcon mappings are wired in. API validation baseline increases by 2 routes (proxy + upload).

^{Reviewed by Cursor Bugbot for commit 280ad02. Configure here.}

greptile-apps · 2026-07-09T01:22:48Z

Greptile Summary

This PR adds a Jupyter integration for self-hosted servers. The main changes are:

New tools for Contents, Kernels, Kernelspecs, and Sessions APIs.
Internal proxy and upload routes with DNS-pinned outbound requests.
A new Jupyter block, icon, registry entries, and docs.
Upload handling through existing file storage and UserFile patterns.
API validation baseline updates for the new routes.

Confidence Score: 5/5

This looks safe to merge.

No blocking issues found in the changed code.

Important Files Changed

Filename	Overview
apps/sim/app/api/tools/jupyter/upload/route.ts	Adds the Jupyter upload route with file access checks, destination path encoding, outbound URL validation, pinned fetches, and redirects disabled.
apps/sim/app/api/tools/jupyter/proxy/route.ts	Adds the shared Jupyter proxy route for authenticated calls to Jupyter REST endpoints.
apps/sim/tools/jupyter/utils.ts	Adds shared helpers for Jupyter URL normalization, auth headers, path validation, path encoding, and response mapping.
apps/sim/tools/jupyter/create_file.ts	Adds create-file support for files, directories, and notebooks with invalid notebook JSON surfaced as an error.
apps/sim/blocks/blocks/jupyter.ts	Adds the Jupyter block configuration, operation selector, auth fields, upload fields, and tool parameter mapping.

_{Reviews (8): Last reviewed commit: "fix(jupyter): decode the whole path befo..." | Re-trigger Greptile}

- 16 tools covering Contents, Kernels, Kernelspecs, and Sessions REST APIs - File upload/download via UserFile, following the Box upload pattern - Block with operation dropdown, token auth, and 8 catalog templates - Registered tools + block, generated docs, bumped API validation baseline

…uity, silent notebook fallback - Route uploads through validateUrlWithDNS + secureFetchWithPinnedIP (matches Grafana/1Password pattern) instead of a raw fetch to the user-supplied server URL - Replace the upload path/trailing-slash heuristic with an unambiguous directory + filename split - create_file no longer silently writes an empty notebook when notebook content is malformed JSON — it now errors clearly

Without it, Jupyter Server returns directory metadata with content: null, so jupyter_list_contents always reported an empty items array.

waleedlatif1 · 2026-07-09T01:33:32Z

@greptile

waleedlatif1 · 2026-07-09T01:33:33Z

@cursor review

encodeJupyterPath now rejects '.'/'..' segments across the whole path (shared by all 16 tools, not just upload); the upload route returns a clean 400 when it's hit.

waleedlatif1 · 2026-07-09T01:41:14Z

@greptile

waleedlatif1 · 2026-07-09T01:41:15Z

@cursor review

…gaps - extract the traversal check out of encodeJupyterPath into a shared assertion, and apply it to body-only path fields (rename newPath, copy copyFromPath, session path) that never flowed through URL encoding and so skipped the check - pass stripAuthOnRedirect to the upload route's secureFetchWithPinnedIP call so a malicious Jupyter server can't redirect the PUT to another origin and receive the caller's token

waleedlatif1 · 2026-07-09T01:50:21Z

@greptile

waleedlatif1 · 2026-07-09T01:50:22Z

@cursor review

A segment like %2e%2e wouldn't match the literal '..' check. Now decodes each segment before comparing, in addition to the literal check, so an already-encoded traversal attempt is caught too.

waleedlatif1 · 2026-07-09T01:58:53Z

@greptile

waleedlatif1 · 2026-07-09T01:58:54Z

@cursor review

…for HTTP/private-host support and no redirects The generic external tool executor blocks plain-HTTP and non-localhost private-IP hosts by default, so every non-upload Jupyter operation could fail against typical self-hosted setups (LAN IP, docker hostname, or even literal localhost on a hosted deployment) even though the upload route worked via its own internal route. Added /api/tools/jupyter/proxy (DNS-pinned, allowHttp, maxRedirects: 0) that mirrors the upstream Jupyter response verbatim, matching the established pattern for self-hosted-arbitrary-host integrations (Grafana, 1Password) instead of the generic executor path. Each tool's request block now posts to the proxy instead of building a direct external URL; transformResponse and outputs are unchanged since the proxy response mirrors upstream status/body exactly. Also switches the upload route from stripAuthOnRedirect to maxRedirects: 0 — stronger, since it stops the uploaded file body (not just the token) from ever reaching a redirect target.

waleedlatif1 · 2026-07-09T02:14:47Z

@greptile

waleedlatif1 · 2026-07-09T02:14:48Z

@cursor review

…separators in upload filename - The proxy route now independently validates the incoming path field for traversal segments instead of only relying on tool-side validation before the request reaches it — the route is a shared internal boundary, not something only our own tool code can call - The upload route's fileName can come from an advanced override or the legacy fileContent path and could itself contain '/' or '\', silently nesting the upload deeper than the directory param specified. Now rejected outright before joining.

waleedlatif1 · 2026-07-09T02:22:41Z

@greptile

waleedlatif1 · 2026-07-09T02:22:42Z

@cursor review

…-split segment A segment like foo%2f..%2fsecret has no literal slash, so splitting on literal '/' first and decoding each piece in isolation treats it as one opaque segment and never notices the '..' hiding behind the encoded slash. Decode the full path once, then split and check every segment the target server's own single URL-decode pass would see.

waleedlatif1 · 2026-07-09T02:30:33Z

@greptile

waleedlatif1 · 2026-07-09T02:30:35Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 280ad02. Configure here.}

cursor Bot reviewed Jul 9, 2026

View reviewed changes

Comment thread apps/sim/tools/jupyter/list_contents.ts Outdated

Comment thread apps/sim/tools/jupyter/create_file.ts

greptile-apps Bot reviewed Jul 9, 2026

View reviewed changes

Comment thread apps/sim/app/api/tools/jupyter/upload/route.ts Outdated

Comment thread apps/sim/app/api/tools/jupyter/upload/route.ts Outdated

Comment thread apps/sim/tools/jupyter/create_file.ts Outdated

Comment thread apps/sim/tools/jupyter/get_content.ts

waleedlatif1 force-pushed the worktree-add-jupyter-integration branch from 7cdc405 to 55caa9e Compare July 9, 2026 01:23

waleedlatif1 mentioned this pull request Jul 9, 2026

chore(skill): check branch is synced with origin/staging before pushing #5529

Merged

6 tasks

vercel Bot deployed to Preview July 9, 2026 01:28 View deployment

waleedlatif1 added 2 commits July 8, 2026 18:31

fix(jupyter): request content=1 when listing directory contents

d1d326a

Without it, Jupyter Server returns directory metadata with content: null, so jupyter_list_contents always reported an empty items array.

vercel Bot temporarily deployed to Preview July 9, 2026 01:32 Inactive

cursor Bot reviewed Jul 9, 2026

View reviewed changes

Comment thread apps/sim/app/api/tools/jupyter/upload/route.ts Outdated

greptile-apps Bot reviewed Jul 9, 2026

View reviewed changes

Comment thread apps/sim/app/api/tools/jupyter/upload/route.ts

Comment thread apps/sim/blocks/blocks/jupyter.ts

fix(jupyter): reject path-traversal segments in Jupyter content paths

c27da33

encodeJupyterPath now rejects '.'/'..' segments across the whole path (shared by all 16 tools, not just upload); the upload route returns a clean 400 when it's hit.

vercel Bot temporarily deployed to Preview July 9, 2026 01:41 Inactive

cursor Bot reviewed Jul 9, 2026

View reviewed changes

Comment thread apps/sim/tools/jupyter/rename_content.ts Outdated

greptile-apps Bot reviewed Jul 9, 2026

View reviewed changes

Comment thread apps/sim/app/api/tools/jupyter/upload/route.ts

vercel Bot temporarily deployed to Preview July 9, 2026 01:48 Inactive

cursor Bot reviewed Jul 9, 2026

View reviewed changes

Comment thread apps/sim/tools/jupyter/utils.ts

fix(jupyter): also reject percent-encoded traversal segments

c6afd79

A segment like %2e%2e wouldn't match the literal '..' check. Now decodes each segment before comparing, in addition to the literal check, so an already-encoded traversal attempt is caught too.

vercel Bot temporarily deployed to Preview July 9, 2026 01:56 Inactive

greptile-apps Bot reviewed Jul 9, 2026

View reviewed changes

Comment thread apps/sim/app/api/tools/jupyter/upload/route.ts

cursor Bot reviewed Jul 9, 2026

View reviewed changes

Comment thread apps/sim/tools/jupyter/list_contents.ts Outdated

Comment thread apps/sim/tools/jupyter/get_content.ts Outdated

vercel Bot deployed to Preview July 9, 2026 02:16 View deployment

cursor Bot reviewed Jul 9, 2026

View reviewed changes

Comment thread apps/sim/app/api/tools/jupyter/proxy/route.ts

greptile-apps Bot reviewed Jul 9, 2026

View reviewed changes

Comment thread apps/sim/app/api/tools/jupyter/upload/route.ts

vercel Bot temporarily deployed to Preview July 9, 2026 02:20 Inactive

cursor Bot reviewed Jul 9, 2026

View reviewed changes

Comment thread apps/sim/tools/jupyter/utils.ts

vercel Bot temporarily deployed to Preview July 9, 2026 02:29 Inactive

cursor Bot reviewed Jul 9, 2026

View reviewed changes

waleedlatif1 merged commit 6e87d74 into staging Jul 9, 2026
18 checks passed

waleedlatif1 deleted the worktree-add-jupyter-integration branch July 9, 2026 02:35

waleedlatif1 mentioned this pull request Jul 9, 2026

v0.7.27: document tags improvements, grok 4.5, forking, custom blocks, library, typescript 7, jupyter notebook, o11y, meta muse, gpt 5.6 #5531

Merged

Uh oh!

Conversation

waleedlatif1 commented Jul 9, 2026

Summary

Type of Change

Testing

Checklist

Uh oh!

vercel Bot commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

Uh oh!

Uh oh!

greptile-apps Bot commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Jul 9, 2026

Uh oh!

waleedlatif1 commented Jul 9, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Jul 9, 2026

Uh oh!

waleedlatif1 commented Jul 9, 2026

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Jul 9, 2026

Uh oh!

waleedlatif1 commented Jul 9, 2026

Uh oh!

Uh oh!

waleedlatif1 commented Jul 9, 2026

Uh oh!

waleedlatif1 commented Jul 9, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Jul 9, 2026

Uh oh!

waleedlatif1 commented Jul 9, 2026

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Jul 9, 2026

Uh oh!

waleedlatif1 commented Jul 9, 2026

Uh oh!

Uh oh!

waleedlatif1 commented Jul 9, 2026

Uh oh!

waleedlatif1 commented Jul 9, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vercel Bot commented Jul 9, 2026 •

edited

Loading

cursor Bot commented Jul 9, 2026 •

edited

Loading

greptile-apps Bot commented Jul 9, 2026 •

edited

Loading