From 3ba0ef7080812f8acf69a118f976772b98a0b4b7 Mon Sep 17 00:00:00 2001
From: Waleed Latif <walif6@gmail.com>
Date: Tue, 10 Nov 2026 15:46:55 -0800
Subject: [PATCH] fix(release): run pinned async versions on their own
 variables, map CLI key-creation errors, show GitLab tokens as the current
 block

---
 apps/sim/app/api/cli/auth/poll/route.ts         | 3 ++-
 apps/sim/background/workflow-execution.ts       | 7 +++++--
 apps/sim/lib/integrations/credential-display.ts | 3 ++-
 docker/pii.Dockerfile                           | 5 +++--
 4 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/apps/sim/app/api/cli/auth/poll/route.ts b/apps/sim/app/api/cli/auth/poll/route.ts
index 19d9646bbb3..50517528091 100644
--- a/apps/sim/app/api/cli/auth/poll/route.ts
+++ b/apps/sim/app/api/cli/auth/poll/route.ts
@@ -3,6 +3,7 @@ import { type NextRequest, NextResponse } from 'next/server'
 import { pollCliAuthContract } from '@/lib/api/contracts'
 import { parseRequest } from '@/lib/api/server'
 import {
+  apiKeyCreationErrorStatus,
   performCreatePersonalApiKey,
   performCreateWorkspaceApiKey,
 } from '@/lib/api-key/orchestration'
@@ -83,7 +84,7 @@ async function mintForGrant(
   if (!result.success || !result.key) {
     return {
       ok: false,
-      status: result.errorCode === 'conflict' ? 409 : 500,
+      status: apiKeyCreationErrorStatus(result.errorCode),
       message: result.error ?? 'Failed to generate API key',
     }
   }
diff --git a/apps/sim/background/workflow-execution.ts b/apps/sim/background/workflow-execution.ts
index 809b9493ec2..567c716eef3 100644
--- a/apps/sim/background/workflow-execution.ts
+++ b/apps/sim/background/workflow-execution.ts
@@ -286,7 +286,8 @@ export async function executeWorkflowJob(
         /**
          * The version this run executes, loaded once: the core runs this same version's
          * blocks, so a deploy landing mid-setup cannot pair one version's variables with
-         * another's graph.
+         * another's graph. A pinned version runs with only its own snapshot, as a sync run
+         * of it does, never the editor's current variables.
          */
         const pinnedDeploymentVersionId = payload.pinnedDeploymentVersionId
         const deployedState = await withDatabaseReadRetry(
@@ -328,7 +329,9 @@ export async function executeWorkflowJob(
           metadata,
           workflow,
           payload.input,
-          resolveDeployedRunVariables(deployedState, workflow.variables),
+          pinnedDeploymentVersionId
+            ? (deployedState.variables ?? {})
+            : resolveDeployedRunVariables(deployedState, workflow.variables),
           []
         )
 
diff --git a/apps/sim/lib/integrations/credential-display.ts b/apps/sim/lib/integrations/credential-display.ts
index f65ef1128c0..d7b4eb3d5a1 100644
--- a/apps/sim/lib/integrations/credential-display.ts
+++ b/apps/sim/lib/integrations/credential-display.ts
@@ -22,6 +22,7 @@ import { CANONICAL_SERVICE_ACCOUNT_SLUGS } from '@/lib/integrations/oauth-servic
 import { OAUTH_PROVIDERS } from '@/lib/oauth/oauth'
 import type { OAuthProvider, OAuthServiceConfig } from '@/lib/oauth/types'
 import { getServiceConfigByProviderId, parseProvider } from '@/lib/oauth/utils'
+import { resolveAccessControlBlockType } from '@/lib/permission-groups/integration-allowlist'
 
 /**
  * Above this many covered integrations the subtitle states a count instead of
@@ -226,7 +227,7 @@ export function resolveCredentialDisplay(credential: DisplayableCredential): Cre
     return {
       service: null,
       integration,
-      blockType: 'gitlab',
+      blockType: resolveAccessControlBlockType('gitlab'),
       icon: GitlabIcon,
       familyName: null,
       coveredIntegrations: integration ? [integration] : [],
diff --git a/docker/pii.Dockerfile b/docker/pii.Dockerfile
index 2c77551919b..de731c96854 100644
--- a/docker/pii.Dockerfile
+++ b/docker/pii.Dockerfile
@@ -47,8 +47,9 @@ COPY --chown=pii:pii --chmod=755 docker/pii-entrypoint.sh ./
 # copies the image's /tmp into a bind volume mounted at a VOLUME path. The
 # VOLUME line stays below the model download, which stages wheels in /tmp.
 # tldextract (pulled in by Presidio) caches the Public Suffix List under
-# $HOME/.cache by default; point it at /tmp so it caches instead of
-# refetching the list on every start.
+# $HOME/.cache by default, which the read-only root cannot write; point it at
+# the writable /tmp volume. That volume is per task, so each task fetches the
+# list once.
 ENV PYTHONDONTWRITEBYTECODE=1 \
     TLDEXTRACT_CACHE=/tmp/tldextract
 RUN chmod 1777 /tmp