feat(latex): add LaTeX integration with PDF compilation tool, block, and docs

[waleedlatif1]

Summary

• Add latex_compile tool that compiles LaTeX source into a PDF via the LaTeX-on-HTTP service (no OAuth or API key required)
• Internal /api/tools/latex route compiles upstream, stores the PDF as an execution file (uploadExecutionFile, with StorageService fallback), and surfaces TeX errors (! lines) on failed builds
• Supports compiler selection (pdflatex, xelatex, lualatex, platex, uplatex, context) and supporting resources (images, included .tex files, .bib bibliographies) via content/base64/url
• New LaTeX block with contract-bound validation (lib/api/contracts/tools/latex.ts), BlockMeta templates + skills, LaTeX logo icon, and generated docs with manual intro

Type of Change

• New feature

Testing

Tested the compile service live (success, compile-error, and multi-resource payloads); typecheck, biome, check:api-validation:strict, and block/registry test suites all pass

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Jun 11, 2026 7:55pm

[waleedlatif1]

@greptile

[cursor]

PR Summary

Medium Risk
Compile sends user LaTeX and attachments to a third-party host and adds a new authenticated upload route with large payloads and remote resource URLs, though it follows existing tool patterns.

Overview
Adds a LaTeX workflow integration (no API key) so agents can compile documents to PDF and query TeX Live packages/fonts.

Compile path: New latex_compile tool and authenticated POST /api/tools/latex proxy to LaTeX-on-HTTP (latex.ytotech.com), with Zod validation (source size, resource paths/URLs), timeouts, PDF size limits, 422 responses with extracted TeX ! log snippets on build failures, and storage via execution uploads or general storage fallback.

Workflow UI: New LaTeX block with operations for compile (compiler choice, JSON resources), package search/detail, and font listing; wired through block/tool registries, integrations.json, LatexIcon, and docs (latex.mdx + nav) including a third-party data-handling warning.

^{Reviewed by Cursor Bugbot for commit 9c98876. Configure here.}

[waleedlatif1]

@cursor review

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 24fd735. Configure here.}

[waleedlatif1]

@greptile

[greptile-apps]

Greptile Summary

This PR adds a full LaTeX integration: a latex_compile tool that proxies compilation to the public LaTeX-on-HTTP service, three lookup tools (search_packages, get_package, list_fonts), a block with four operations, and accompanying docs with a third-party disclosure note.

• The compile route is well-guarded with a 50 s AbortSignal timeout, 25 MB PDF size limit, TeX error extraction from compiler log files, and a dual storage path (execution file context or StorageService fallback).
• The Zod contract enforces path-traversal prevention, http/https-only resource URLs, and min(1) guards on resource content and file fields.
• The three lookup tools (search_packages, list_fonts, get_package) call latex.ytotech.com directly via the tool executor's secureFetchWithPinnedIP path (SSRF-protected, 5-minute fallback timeout).

Confidence Score: 5/5

Safe to merge; the compile route is well-bounded and the lookup tools call an unauthenticated public read API with SSRF protection already in place.

The new code adds a clearly scoped integration with no auth state, no database writes, and no mutations to existing paths. Previous review rounds caught and fixed the substantive issues. The two remaining observations are non-blocking style/performance notes.

apps/sim/tools/latex/search_packages.ts — worth investigating whether the upstream /packages endpoint supports a query parameter to avoid downloading the full TeX Live list on every search call.

Important Files Changed

Filename	Overview
apps/sim/app/api/tools/latex/route.ts	New API route that proxies compile requests to latex.ytotech.com; includes proper timeout (50 s AbortSignal), payload size limits, TeX error extraction from log files, and dual storage paths (execution file vs StorageService fallback). Well-guarded.
apps/sim/lib/api/contracts/tools/latex.ts	Zod contract for the compile request; includes min(1) guards on resource content/file, path traversal refine, and http/https-only URL refine. Minor: superRefine attaches cross-field error to the path property rather than the resource object.
apps/sim/tools/latex/compile.ts	Client-side tool config for latex_compile; routes through the internal API route, correctly injects _context for execution file storage, and handles both pdfFile and pdfUrl fallback in transformResponse.
apps/sim/tools/latex/search_packages.ts	Fetches the full TeX Live package list on every call (no query forwarded to upstream) and filters client-side; functionally correct but downloads a large payload per search.
apps/sim/tools/latex/get_package.ts	Direct lookup to upstream /packages/{name} endpoint; correct error handling with !response.ok
apps/sim/tools/latex/list_fonts.ts	Fetches font list and filters client-side; includes ok/error guard, maxResults clamping, and correct totalMatches reporting on pre-truncation count.
apps/sim/tools/latex/types.ts	Types for all four LaTeX tools; pdf output typed as UserFile
apps/sim/blocks/blocks/latex.ts	Block config with four operations, proper conditional subBlock rendering, JSON parse guard on resources, and eight BlockMeta templates and skills.

_{Reviews (11): Last reviewed commit: "improvement(latex): make relatedPackages..." | Re-trigger Greptile}

[greptile-apps]

Greptile Summary

This PR adds a full LaTeX integration — a latex_compile tool, an internal /api/tools/latex proxy route, a LaTeX block with templates and skills, icon assets, and docs. The implementation follows existing tool/block patterns well, with solid input validation (Zod contract with superRefine for the exactly-one-of resource constraint), proper error extraction from compiler log files, and a storage fallback for non-execution contexts.

• Route & tool: The API route proxies LaTeX source to latex.ytotech.com, reads the resulting PDF into a bounded buffer (MAX_PDF_BYTES = 25 MB), and stores it via uploadExecutionFile or StorageService, returning a file object and URL to the caller.
• Contract & validation: latexCompileBodySchema enforces size limits on source and resources, an enum on supported compilers, and mutually exclusive resource content fields — however, resource path values are not guarded against ../ traversal sequences, and url resources are forwarded to the external service without restricting schemes or host ranges.
• Fetch reliability: The upstream fetch to latex.ytotech.com is missing an explicit AbortSignal timeout, unlike other tool routes (e.g. TTS) that use AbortSignal.timeout(); the Vercel maxDuration = 60 is the only backstop.

Confidence Score: 4/5

The new LaTeX integration is well-structured and follows the project's tool/block patterns. The main areas to revisit before merging are the missing fetch timeout on the upstream call and the lack of filtering on url/path resource fields before they are forwarded to the external compilation service.

The integration adds no regressions to existing functionality. The two resource-field issues (unfiltered url and unsanitized path) only affect the external latex.ytotech.com service on the current deployment topology, but could have broader impact if the service is ever self-hosted. The missing AbortSignal is a reliability gap that Vercel's maxDuration partially mitigates. All three are straightforward to fix.

apps/sim/app/api/tools/latex/route.ts and apps/sim/lib/api/contracts/tools/latex.ts need attention for the timeout and resource validation gaps.

Security Review

• Unfiltered url resources forwarded to external service (apps/sim/app/api/tools/latex/route.ts): Resource entries with a url field are passed verbatim to latex.ytotech.com, which fetches them during compilation. No scheme (https-only) or host filtering is applied. If the service is self-hosted on an internal network, this could allow probing of unreachable hosts.
• Resource path traversal (apps/sim/lib/api/contracts/tools/latex.ts): path values like ../../secret.sty pass schema validation and are forwarded to the compilation sandbox without sanitization against .. segments.

Important Files Changed

Filename	Overview
apps/sim/app/api/tools/latex/route.ts	Core API route that proxies compilation to latex.ytotech.com and stores the PDF; missing an AbortSignal timeout on the upstream fetch call and resource paths/URLs are forwarded to the external service without sanitization
apps/sim/lib/api/contracts/tools/latex.ts	Zod contract for the LaTeX compile body; validates resource fields well (exactly-one-of enforcement via superRefine) but resource path has no guard against ../ traversal sequences
apps/sim/tools/latex/compile.ts	Tool config that calls the internal /api/tools/latex route; response transformation and output mapping look correct
apps/sim/tools/latex/types.ts	Type definitions for compile params, resources, and response; clean, minimal, and consistent with the rest of the tool layer
apps/sim/blocks/blocks/latex.ts	Block config with sub-blocks, templates, and skills; well-structured with correct params coercion in tools.config.params and comprehensive BlockMeta templates
apps/sim/lib/integrations/integrations.json	Integration metadata entry for LaTeX; correctly set as authType none with documents integrationType
apps/docs/content/docs/en/integrations/latex.mdx	Documentation page for the LaTeX integration; content and parameter tables are accurate

Sequence Diagram

sequenceDiagram
participant Client as Sim Workflow Executor
participant Route as /api/tools/latex (Next.js)
participant Upstream as latex.ytotech.com
participant Storage as StorageService / uploadExecutionFile
Client->>Route: POST /api/tools/latex
Route->>Route: checkInternalAuth + Zod validation
Route->>Upstream: POST /builds/sync
Upstream-->>Route: 200 application/pdf OR 400 JSON
alt Compile success
Route->>Route: readResponseToBufferWithLimit
Route->>Storage: uploadExecutionFile or StorageService.uploadFile
Storage-->>Route: url + path
Route-->>Client: pdfFile, pdfUrl, fileName, compiler
else Compile error
Route->>Route: extractCompilationErrors(log_files)
Route-->>Client: 422 error with TeX error lines
else Upstream error
Route-->>Client: 502 service error
end

Loading

_{Reviews (2): Last reviewed commit: "fix(latex): surface extracted TeX errors..." | Re-trigger Greptile}

[greptile-apps]

Greptile Summary

This PR adds a complete LaTeX integration — a latex_compile tool and matching block — that proxies LaTeX source to the public latex.ytotech.com compilation service and stores the resulting PDF as an execution file.

• API route (/api/tools/latex): validates input via a Zod contract, forwards the payload to the upstream compile service, extracts TeX error lines from the compiler log on failure, and stores the PDF through uploadExecutionFile (with a StorageService fallback).
• Tool & block: full ToolConfig, BlockConfig, BlockMeta templates/skills, icons in both sim and docs, and auto-generated docs — all wired into the block and tool registries.
• Contract: well-structured with size limits (1 MB source, 25 resources, 512-char path) and a superRefine check enforcing exactly one content type per resource.

Confidence Score: 4/5

Safe to merge as-is; the integration is fully wired and functional, with two non-blocking quality items worth addressing in a follow-up.

The route, tool, block, and registry additions are well-structured and follow the project's existing patterns. The fetch to latex.ytotech.com lacks an AbortSignal timeout, so a slow or hung external service will hold a serverless slot for the full 60-second window rather than returning cleanly. User LaTeX source is forwarded to that public third-party service with no in-app disclosure, which is an architectural decision that should at minimum be surfaced in documentation. Neither issue causes incorrect behavior under normal conditions.

apps/sim/app/api/tools/latex/route.ts (fetch timeout and third-party disclosure) and apps/sim/tools/latex/types.ts (pdf typed as unknown).

Security Review

• Third-party data forwarding: All LaTeX source and resource payloads are forwarded verbatim to the public latex.ytotech.com service (no authentication, no DPA). Users compiling sensitive documents are not notified of this data flow; no in-app disclosure exists today.
• No injection, SSRF on stored files, or authentication bypass issues were identified in the new code paths.
• buildPdfFileName correctly strips directory components before constructing file names, preventing path traversal in stored file names.

Important Files Changed

Filename	Overview
apps/sim/app/api/tools/latex/route.ts	Core API route; correctly validates input, stores PDFs, and surfaces TeX errors. Missing AbortSignal timeout on the upstream fetch and no in-app disclosure that user content is forwarded to latex.ytotech.com.
apps/sim/tools/latex/compile.ts	Tool definition follows existing patterns. Error-path returns pdf as '' (empty string), which pairs poorly with the unknown type in types.ts.
apps/sim/tools/latex/types.ts	Types are consistent with other tools, but pdf is typed as unknown — worth tightening to a concrete interface for downstream type safety.
apps/sim/lib/api/contracts/tools/latex.ts	Well-structured Zod contract with correct size limits (1 MB source, 25 resources), URL validation, and the superRefine exactly-one-of check for resource content type.
apps/sim/blocks/blocks/latex.ts	Block config, templates, and skills all look correct; resource JSON parsing and compiler defaulting are handled cleanly.
apps/sim/tools/registry.ts	latex_compile added correctly in alphabetical order alongside other tools.
apps/sim/blocks/registry.ts	LatexBlock and LatexBlockMeta registered correctly and in alphabetical order.
apps/docs/content/docs/en/integrations/latex.mdx	Documentation is clear and well-structured; does not mention that source is compiled via the external latex.ytotech.com service.

Sequence Diagram

sequenceDiagram
participant Client as Sim Executor
participant Route as /api/tools/latex
participant Upstream as latex.ytotech.com
participant Storage as Storage (Execution / Copilot)
Client->>Route: "POST {content, compiler, resources, executionId?}"
Route->>Route: checkInternalAuth + Zod validate
Route->>Upstream: "POST /builds/sync {compiler, resources[{main:true, content}, ...]}"
alt success (200 + application/pdf)
Upstream-->>Route: PDF binary
Route->>Route: "readResponseToBufferWithLimit (<=25 MB)"
alt executionId present
Route->>Storage: uploadExecutionFile(pdfBuffer)
else fallback
Route->>Storage: StorageService.uploadFile(pdfBuffer, context:copilot)
end
Storage-->>Route: pdfFile / fileInfo
Route-->>Client: "{pdfFile, pdfUrl, fileName, compiler}"
else compile failure (4xx + error JSON)
Upstream-->>Route: "{error, log_files}"
Route->>Route: extractCompilationErrors(log_files)
Route-->>Client: "422 {error: LaTeX compilation failed}"
else service error (5xx / unexpected)
Upstream-->>Route: error response
Route-->>Client: "502 {error: LaTeX compile service error}"
end

Loading

_{Reviews (3): Last reviewed commit: "fix(latex): surface extracted TeX errors..." | Re-trigger Greptile}

[waleedlatif1]

Addressed all three Greptile findings in 2ae901b:

• Fetch timeout: the upstream compile call now uses AbortSignal.timeout(50s) (headroom within the route's 60s maxDuration to store the PDF), returning 504 on timeout instead of holding compute until the platform cutoff
• Error-code interpolation: the third-party error field is now capped at 100 chars via truncate() before being included in client-facing messages
• Empty resource payloads: content and file resource fields now have min(1) guards, so zero-byte resources are rejected at validation

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[waleedlatif1]

Pushed two updates in bd67bd7 (and rebased the branch onto origin/staging so the PR contains only the LaTeX commits):

• New tools: latex_search_packages (search the 5,000+ TeX Live packages by name/description), latex_get_package (exact package lookup with install status, license, topics, related packages), and latex_list_fonts (filterable list of the 2,700+ fonts available to xelatex/lualatex via fontspec) — all verified against the live API
• Block now has an operation dropdown (Compile Document / Search Packages / Get Package Details / List Fonts) with per-operation conditions, and the fix-compilation-errors skill references the new lookups

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[waleedlatif1]

@greptile review

[waleedlatif1]

@greptile review

[waleedlatif1]

@cursor review

[waleedlatif1]

@greptile review

[waleedlatif1]

@cursor review

[waleedlatif1]

@greptile review

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 9c98876. Configure here.}