feat(jupyter): add Jupyter integration (contents, kernels, sessions) by waleedlatif1 · Pull Request #5527 · simstudioai/sim

waleedlatif1 · 2026-07-09T01:20:05Z

Summary

Adds a Jupyter integration: 16 tools covering the Contents, Kernels, Kernelspecs, and Sessions REST APIs on a self-hosted Jupyter server
File upload/download handled via UserFile, following the same internal-route pattern used by Box (auth → download from storage → base64 → PUT to server)
New block with an operation dropdown, server URL + token auth fields, and 8 catalog templates
Registered tools + block in the registries, generated docs, bumped the API validation route-count baseline

Type of Change

New feature

Testing

Tested manually (typecheck, biome, check:api-validation:strict, check:bare-icons all pass). Verified tool endpoints/fields against the Jupyter Server REST API spec and cross-checked the file-handling code against Box's established pattern with independent review passes.

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

vercel · 2026-07-09T01:20:11Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Jul 9, 2026 2:29am

cursor · 2026-07-09T01:20:15Z

PR Summary

Medium Risk
Server-side proxying to user-supplied Jupyter URLs (including HTTP/private IPs) and remote file/kernel mutations warrant careful review of SSRF and auth boundaries, though DNS pinning, path checks, and internal auth mitigate much of the exposure.

Overview
Adds a Jupyter workflow integration for self-hosted Jupyter Server instances, authenticated with server URL + token.

16 tools cover Contents (list/read/create/upload/rename/copy/delete), Kernels (list/start/stop/restart/interrupt), Kernelspecs, and Sessions. Most calls go through new internal routes /api/tools/jupyter/proxy and /api/tools/jupyter/upload, which DNS-pin upstream requests, allow HTTP for local/private hosts, disable redirects, and validate paths against traversal (including encoded segments). Uploads follow the existing pattern: resolve UserFile from storage with access checks, then PUT base64 content to Jupyter.

A new Jupyter block exposes an operation dropdown and shared auth fields; tools, block metadata, integrations.json, docs (jupyter.mdx), and JupyterIcon mappings are wired in. API validation baseline increases by 2 routes (proxy + upload).

^{Reviewed by Cursor Bugbot for commit 280ad02. Configure here.}

greptile-apps · 2026-07-09T01:22:48Z

Greptile Summary

This PR adds a Jupyter integration for self-hosted servers. The main changes are:

New tools for Contents, Kernels, Kernelspecs, and Sessions APIs.
Internal proxy and upload routes with DNS-pinned outbound requests.
A new Jupyter block, icon, registry entries, and docs.
Upload handling through existing file storage and UserFile patterns.
API validation baseline updates for the new routes.

Confidence Score: 5/5

This looks safe to merge.

No blocking issues found in the changed code.

Important Files Changed

Filename	Overview
apps/sim/app/api/tools/jupyter/upload/route.ts	Adds the Jupyter upload route with file access checks, destination path encoding, outbound URL validation, pinned fetches, and redirects disabled.
apps/sim/app/api/tools/jupyter/proxy/route.ts	Adds the shared Jupyter proxy route for authenticated calls to Jupyter REST endpoints.
apps/sim/tools/jupyter/utils.ts	Adds shared helpers for Jupyter URL normalization, auth headers, path validation, path encoding, and response mapping.
apps/sim/tools/jupyter/create_file.ts	Adds create-file support for files, directories, and notebooks with invalid notebook JSON surfaced as an error.
apps/sim/blocks/blocks/jupyter.ts	Adds the Jupyter block configuration, operation selector, auth fields, upload fields, and tool parameter mapping.

_{Reviews (8): Last reviewed commit: "fix(jupyter): decode the whole path befo..." | Re-trigger Greptile}

- 16 tools covering Contents, Kernels, Kernelspecs, and Sessions REST APIs - File upload/download via UserFile, following the Box upload pattern - Block with operation dropdown, token auth, and 8 catalog templates - Registered tools + block, generated docs, bumped API validation baseline

…uity, silent notebook fallback - Route uploads through validateUrlWithDNS + secureFetchWithPinnedIP (matches Grafana/1Password pattern) instead of a raw fetch to the user-supplied server URL - Replace the upload path/trailing-slash heuristic with an unambiguous directory + filename split - create_file no longer silently writes an empty notebook when notebook content is malformed JSON — it now errors clearly

Without it, Jupyter Server returns directory metadata with content: null, so jupyter_list_contents always reported an empty items array.

waleedlatif1 · 2026-07-09T01:33:32Z

@greptile

waleedlatif1 · 2026-07-09T01:33:33Z

@cursor review

encodeJupyterPath now rejects '.'/'..' segments across the whole path (shared by all 16 tools, not just upload); the upload route returns a clean 400 when it's hit.

waleedlatif1 · 2026-07-09T01:41:14Z

@greptile

waleedlatif1 · 2026-07-09T01:41:15Z

@cursor review

…gaps - extract the traversal check out of encodeJupyterPath into a shared assertion, and apply it to body-only path fields (rename newPath, copy copyFromPath, session path) that never flowed through URL encoding and so skipped the check - pass stripAuthOnRedirect to the upload route's secureFetchWithPinnedIP call so a malicious Jupyter server can't redirect the PUT to another origin and receive the caller's token

waleedlatif1 · 2026-07-09T01:50:21Z

@greptile

waleedlatif1 · 2026-07-09T01:50:22Z

@cursor review

A segment like %2e%2e wouldn't match the literal '..' check. Now decodes each segment before comparing, in addition to the literal check, so an already-encoded traversal attempt is caught too.

waleedlatif1 · 2026-07-09T01:58:53Z

@greptile

waleedlatif1 · 2026-07-09T01:58:54Z

@cursor review

…for HTTP/private-host support and no redirects The generic external tool executor blocks plain-HTTP and non-localhost private-IP hosts by default, so every non-upload Jupyter operation could fail against typical self-hosted setups (LAN IP, docker hostname, or even literal localhost on a hosted deployment) even though the upload route worked via its own internal route. Added /api/tools/jupyter/proxy (DNS-pinned, allowHttp, maxRedirects: 0) that mirrors the upstream Jupyter response verbatim, matching the established pattern for self-hosted-arbitrary-host integrations (Grafana, 1Password) instead of the generic executor path. Each tool's request block now posts to the proxy instead of building a direct external URL; transformResponse and outputs are unchanged since the proxy response mirrors upstream status/body exactly. Also switches the upload route from stripAuthOnRedirect to maxRedirects: 0 — stronger, since it stops the uploaded file body (not just the token) from ever reaching a redirect target.

waleedlatif1 · 2026-07-09T02:14:47Z

@greptile

waleedlatif1 · 2026-07-09T02:14:48Z

@cursor review

…separators in upload filename - The proxy route now independently validates the incoming path field for traversal segments instead of only relying on tool-side validation before the request reaches it — the route is a shared internal boundary, not something only our own tool code can call - The upload route's fileName can come from an advanced override or the legacy fileContent path and could itself contain '/' or '\', silently nesting the upload deeper than the directory param specified. Now rejected outright before joining.

waleedlatif1 · 2026-07-09T02:22:41Z

@greptile

waleedlatif1 · 2026-07-09T02:22:42Z

@cursor review

…-split segment A segment like foo%2f..%2fsecret has no literal slash, so splitting on literal '/' first and decoding each piece in isolation treats it as one opaque segment and never notices the '..' hiding behind the encoded slash. Decode the full path once, then split and check every segment the target server's own single URL-decode pass would see.

waleedlatif1 · 2026-07-09T02:30:33Z

@greptile

waleedlatif1 · 2026-07-09T02:30:35Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 280ad02. Configure here.}

cursorBot reviewed Jul 9, 2026
View reviewed changes

Comment threadapps/sim/tools/jupyter/list_contents.ts Outdated
Comment threadapps/sim/tools/jupyter/create_file.ts

greptile-appsBot reviewed Jul 9, 2026
View reviewed changes

Comment threadapps/sim/app/api/tools/jupyter/upload/route.ts Outdated
Comment threadapps/sim/app/api/tools/jupyter/upload/route.ts Outdated
Comment threadapps/sim/tools/jupyter/create_file.ts Outdated
Comment threadapps/sim/tools/jupyter/get_content.ts

waleedlatif1 force-pushed the worktree-add-jupyter-integration branch from 7cdc405 to 55caa9eCompare July 9, 2026 01:23

waleedlatif1 mentioned this pull request Jul 9, 2026
chore(skill): check branch is synced with origin/staging before pushing #5529
Merged
6 tasks

vercelBotdeployed to Preview July 9, 2026 01:28 View deployment

waleedlatif1 added 2 commits July 8, 2026 18:31

fix(jupyter): request content=1 when listing directory contents
d1d326a
Without it, Jupyter Server returns directory metadata with content: null, so jupyter_list_contents always reported an empty items array.

vercelBottemporarily deployed to Preview July 9, 2026 01:32 Inactive

cursorBot reviewed Jul 9, 2026
View reviewed changes

Comment threadapps/sim/app/api/tools/jupyter/upload/route.ts Outdated

greptile-appsBot reviewed Jul 9, 2026
View reviewed changes

Comment threadapps/sim/app/api/tools/jupyter/upload/route.ts
Comment threadapps/sim/blocks/blocks/jupyter.ts

fix(jupyter): reject path-traversal segments in Jupyter content paths
c27da33
encodeJupyterPath now rejects '.'/'..' segments across the whole path (shared by all 16 tools, not just upload); the upload route returns a clean 400 when it's hit.

vercelBottemporarily deployed to Preview July 9, 2026 01:41 Inactive

cursorBot reviewed Jul 9, 2026
View reviewed changes

Comment threadapps/sim/tools/jupyter/rename_content.ts Outdated

greptile-appsBot reviewed Jul 9, 2026
View reviewed changes

Comment threadapps/sim/app/api/tools/jupyter/upload/route.ts

vercelBottemporarily deployed to Preview July 9, 2026 01:48 Inactive

cursorBot reviewed Jul 9, 2026
View reviewed changes

Comment threadapps/sim/tools/jupyter/utils.ts

fix(jupyter): also reject percent-encoded traversal segments
c6afd79
A segment like %2e%2e wouldn't match the literal '..' check. Now decodes each segment before comparing, in addition to the literal check, so an already-encoded traversal attempt is caught too.

vercelBottemporarily deployed to Preview July 9, 2026 01:56 Inactive

greptile-appsBot reviewed Jul 9, 2026
View reviewed changes

Comment threadapps/sim/app/api/tools/jupyter/upload/route.ts

cursorBot reviewed Jul 9, 2026
View reviewed changes

Comment threadapps/sim/tools/jupyter/list_contents.ts Outdated
Comment threadapps/sim/tools/jupyter/get_content.ts Outdated

vercelBotdeployed to Preview July 9, 2026 02:16 View deployment

cursorBot reviewed Jul 9, 2026
View reviewed changes

Comment threadapps/sim/app/api/tools/jupyter/proxy/route.ts

greptile-appsBot reviewed Jul 9, 2026
View reviewed changes

Comment threadapps/sim/app/api/tools/jupyter/upload/route.ts

vercelBottemporarily deployed to Preview July 9, 2026 02:20 Inactive

cursorBot reviewed Jul 9, 2026
View reviewed changes

Comment threadapps/sim/tools/jupyter/utils.ts

vercelBottemporarily deployed to Preview July 9, 2026 02:29 Inactive

cursorBot reviewed Jul 9, 2026
View reviewed changes

waleedlatif1 merged commit 6e87d74 into stagingJul 9, 2026
18 checks passed

waleedlatif1 deleted the worktree-add-jupyter-integration branch July 9, 2026 02:35

waleedlatif1 mentioned this pull request Jul 9, 2026
v0.7.27: document tags improvements, grok 4.5, forking, custom blocks, library, typescript 7, jupyter notebook, o11y, meta muse, gpt 5.6 #5531
Merged

Uh oh!

Conversation

waleedlatif1 commented Jul 9, 2026

Summary

Type of Change

Testing

Checklist

Uh oh!

vercelBot commented Jul 9, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursorBot commented Jul 9, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

Uh oh!

Uh oh!

greptile-appsBot commented Jul 9, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Jul 9, 2026

Uh oh!

waleedlatif1 commented Jul 9, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Jul 9, 2026

Uh oh!

waleedlatif1 commented Jul 9, 2026

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Jul 9, 2026

Uh oh!

waleedlatif1 commented Jul 9, 2026

Uh oh!

Uh oh!

waleedlatif1 commented Jul 9, 2026

Uh oh!

waleedlatif1 commented Jul 9, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Jul 9, 2026

Uh oh!

waleedlatif1 commented Jul 9, 2026

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Jul 9, 2026

Uh oh!

waleedlatif1 commented Jul 9, 2026

Uh oh!

Uh oh!

waleedlatif1 commented Jul 9, 2026

Uh oh!

waleedlatif1 commented Jul 9, 2026

Uh oh!

cursorBot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vercelBot commented Jul 9, 2026•
edited
Loading

cursorBot commented Jul 9, 2026•
edited
Loading

greptile-appsBot commented Jul 9, 2026•
edited
Loading