fix(connectors): close swallow-into-empty and cursor-taper regressions

Ship-gate pass over the connector audit. Every finding was re-verified
against the provider's live documentation or machine-readable spec before
being acted on; several pass-3 edits were reverted rather than extended.

Correctness fixes:
- fireflies: a 2xx with an unparseable body returned an empty listing
  instead of throwing. fireflies runs a full sync every time, so a fault
  persisting across two syncs would have tombstoned all indexed docs.
- linear: same shape via `data.issues || {}` on a non-nullable connection.
- greenhouse: a 403 from a key without scorecard permission was treated as
  transient, appending `:partial` to the hash. That never matches the list
  stub, forcing full re-hydration of every candidate on every sync forever.
- google-meet: `fetchParticipants` carried a 404 swallow copied from its
  transcript siblings, freezing every speaker as "Unknown".
- airtable, asana, ashby: reverted page-size tapers applied over opaque
  cursor tokens. The cap was already enforced server-side.
- google-docs: response byte cap resolved to 800MB and could never fire.
- google-forms, google-vault, notion, sharepoint, dropbox: `getDocument`
  now throws on transient failure instead of returning null, which the
  engine reads as absence.

Security:
- Retry headers are attached non-enumerably. TypeScript `private` is
  compile-time only, so `SecureFetchHeaders.setCookies` was an own
  enumerable property that the logger serialized into sync logs.

Docs and dead code:
- Corrected six fabricated doc citations (github, jira, jsm, linear,
  google-meet, dropbox) and removed the Evernote integration entirely.

Author: waleedlatif1

apps/sim/connectors/airtable/airtable.ts

@@ -156,14 +156,18 @@ export const airtableConnector: ConnectorConfig = {
     const maxRecords = readMaxRecords(sourceConfig)
 
     const prevFetched = (syncContext?.totalDocsFetched as number) ?? 0
-    /** Shrink the last page so a `maxRecords` cap never over-fetches past it. */
-    const pageSize =
-      maxRecords > 0 ? Math.max(1, Math.min(PAGE_SIZE, maxRecords - prevFetched)) : PAGE_SIZE
 
     const tableId = await resolveTableId(accessToken, baseId, tableIdOrName, syncContext)
 
+    /**
+     * `pageSize` is held at the documented maximum for every request of a sync.
+     * Airtable already stops pagination itself once `maxRecords` is reached, and
+     * its `offset` is an opaque iterator token whose validity across a changed
+     * `pageSize` is undocumented — so shrinking the last page would buy nothing
+     * and risk breaking iteration mid-sync.
+     */
     const params = new URLSearchParams()
-    params.append('pageSize', String(pageSize))
+    params.append('pageSize', String(PAGE_SIZE))
     if (viewId) params.append('view', viewId)
     if (maxRecords > 0) params.append('maxRecords', String(maxRecords))
 
@@ -217,10 +221,12 @@ export const airtableConnector: ConnectorConfig = {
     const nextOffset = data.offset
     const hitLimit = maxRecords > 0 && totalFetched >= maxRecords
     /**
-     * Airtable omits `offset` once `maxRecords` is reached, so an exhausted
-     * source and a capped one are indistinguishable. Flag conservatively: a
-     * capped listing must never let the engine hard-delete the records the cap
-     * hid.
+     * Airtable enforces `maxRecords` itself — "pagination will stop once you've
+     * reached this maximum" — but does not document whether it still returns an
+     * `offset` at that point, so an exhausted source and a capped one cannot be
+     * told apart here. Flagged conservatively: a capped listing must never let
+     * the engine hard-delete the records the cap hid. The cost is that deletion
+     * reconciliation only runs for a capped source on an explicit full resync.
      */
     if (hitLimit && syncContext) syncContext.listingCapped = true
 
@@ -239,7 +245,10 @@ export const airtableConnector: ConnectorConfig = {
   ): Promise<ExternalDocument | null> => {
     const baseId = readConfigString(sourceConfig, 'baseId')
     const tableIdOrName = readConfigString(sourceConfig, 'tableIdOrName')
-    if (!baseId || !tableIdOrName) return null
+    /** A broken config is not evidence the record is gone, so it must not read as absence. */
+    if (!baseId || !tableIdOrName) {
+      throw new Error('Airtable connector is missing baseId or tableIdOrName')
+    }
     const titleField = readConfigString(sourceConfig, 'titleField')
 
     const tableId = await resolveTableId(accessToken, baseId, tableIdOrName, syncContext)

apps/sim/connectors/asana/asana.test.ts

@@ -445,7 +445,7 @@ describe('asanaConnector.listDocuments', () => {
     expect(syncContext.listingCapped).toBeUndefined()
   })
 
-  it('shrinks the requested page size to the remaining cap on the last page', async () => {
+  it('holds the requested page size constant regardless of how much cap is left', async () => {
     mockFetch.mockImplementation(async (url) => {
       if (url.includes('/projects')) {
         return jsonResponse({ data: [{ gid: 'p1', name: 'Live' }], next_page: null })
@@ -460,7 +460,7 @@ describe('asanaConnector.listDocuments', () => {
       totalDocsFetched: 497,
     })
 
-    expect(requestedUrls().find((url) => url.includes('/tasks?'))).toContain('limit=3')
+    expect(requestedUrls().find((url) => url.includes('/tasks?'))).toContain('limit=100')
   })
 
   it('keeps syncing an explicitly pinned project without listing workspace projects', async () => {

apps/sim/connectors/asana/asana.ts

@@ -326,16 +326,12 @@ export const asanaConnector: ConnectorConfig = {
     const previouslyFetched = (syncContext?.totalDocsFetched as number) ?? 0
 
     /**
-     * Last-page precision: once a `maxTasks` cap exists, never ask Asana for
-     * more rows than the cap still has room for.
+     * Held constant across every request of a sync. Asana's `offset` is an
+     * opaque token and the docs do not say it survives a changed `limit`, while
+     * `decideTaskCap` already trims the cap exactly — so varying the page size
+     * per call would buy nothing and risk invalidating a mid-project offset.
      */
-    const remaining = maxTasks > 0 ? Math.max(maxTasks - previouslyFetched, 0) : 0
-    if (maxTasks > 0 && remaining === 0) {
-      if (syncContext) syncContext.listingCapped = true
-      return { documents: [], nextCursor: undefined, hasMore: false }
-    }
-    const pageSize =
-      maxTasks > 0 ? Math.max(Math.min(remaining, ASANA_MAX_PAGE_SIZE), 1) : ASANA_MAX_PAGE_SIZE
+    const pageSize = maxTasks > 0 ? Math.min(maxTasks, ASANA_MAX_PAGE_SIZE) : ASANA_MAX_PAGE_SIZE
 
     /**
      * Cursor format:

apps/sim/connectors/ashby/ashby.ts

@@ -50,11 +50,11 @@ interface AshbyEnvelope {
 }
 
 /**
- * Extracts a human-readable error message from an Ashby error envelope. Ashby documents
- * two shapes and uses both: `errorInfo.message`, and an `errors` array whose entries are
- * either plain strings or `{ message, parameter }` objects. An object entry stringifies
- * to `[object Object]` unless its message is read explicitly, which is the form a 403
- * for a missing module permission arrives in.
+ * Extracts a human-readable error message from an Ashby error envelope. The documented
+ * failure body is `{ success: false, errors: [{ message }] }`, but `errorInfo.message`
+ * and plain-string `errors` entries also occur, so all three are handled. Reading the
+ * object entry's `message` explicitly is what keeps it from stringifying to
+ * `[object Object]`.
  */
 function ashbyErrorMessage(data: AshbyEnvelope, fallback: string): string {
   if (data.errorInfo?.message) return data.errorInfo.message
@@ -550,9 +550,13 @@ export const ashbyConnector: ConnectorConfig = {
       return { documents: [], hasMore: false }
     }
 
-    /** Remaining budget under `maxCandidates`, so the last page requests only what is needed. */
+    /**
+     * `limit` is held constant for every request of a sync: Ashby's `cursor` is
+     * opaque and the docs do not say it survives a changed `limit`, and the cap
+     * is enforced below by trimming the page instead.
+     */
     const remaining = maxCandidates > 0 ? maxCandidates - prevFetched : Number.POSITIVE_INFINITY
-    const body: UnknownRecord = { limit: Math.min(CANDIDATES_PER_PAGE, remaining) }
+    const body: UnknownRecord = { limit: CANDIDATES_PER_PAGE }
     if (cursor) body.cursor = cursor
     if (createdAfterMs !== undefined) body.createdAfter = createdAfterMs
 
@@ -565,8 +569,10 @@ export const ashbyConnector: ConnectorConfig = {
     const results = Array.isArray(data.results) ? data.results : []
     const candidates = results.map(mapCandidate).filter((c) => c.id)
 
-    let documents = candidates.map(candidateToStub)
-    if (documents.length > remaining) documents = documents.slice(0, remaining)
+    const stubs = candidates.map(candidateToStub)
+    const documents = stubs.length > remaining ? stubs.slice(0, remaining) : stubs
+    /** True when the cap hid candidates Ashby already returned on this very page. */
+    const droppedInPage = documents.length < stubs.length
 
     const totalFetched = prevFetched + documents.length
     if (syncContext) syncContext.totalCandidatesFetched = totalFetched
@@ -576,11 +582,13 @@ export const ashbyConnector: ConnectorConfig = {
     const hitLimit = maxCandidates > 0 && totalFetched >= maxCandidates
     /**
      * `listingCapped` blocks the sync engine's deletion reconciliation, so it is set only
-     * when `maxCandidates` cut the listing short while Ashby still had more candidates —
-     * never when the cap coincides with genuine exhaustion, and never for the intentional
-     * `createdAfter` scope filter.
+     * when `maxCandidates` made the listing knowingly incomplete — candidates dropped from
+     * this page, or pages left unread behind the cap. Never when the cap coincides with
+     * genuine exhaustion, and never for the intentional `createdAfter` scope filter.
      */
-    if (syncContext && hitLimit && sourceHasMore) syncContext.listingCapped = true
+    if (syncContext && (droppedInPage || (hitLimit && sourceHasMore))) {
+      syncContext.listingCapped = true
+    }
 
     const hasMore = !hitLimit && sourceHasMore
 
@@ -616,19 +624,20 @@ export const ashbyConnector: ConnectorConfig = {
         })
       }
 
-      const settled = await Promise.allSettled(
-        applicationIds.map((applicationId) =>
-          fetchFeedbackForApplication(accessToken, applicationId)
-        )
-      )
-      for (let i = 0; i < settled.length; i++) {
-        const outcome = settled[i]
-        if (outcome.status === 'fulfilled') {
-          feedback.push(...outcome.value)
-        } else {
+      /**
+       * Sequential on purpose. The sync engine already hydrates SYNC_BATCH_SIZE
+       * candidates concurrently, so fanning these out would multiply that into
+       * a burst of up to `MAX_APPLICATIONS_FOR_FEEDBACK` × the batch size
+       * simultaneous Ashby requests. A per-application catch keeps one failing
+       * application from losing the rest of the candidate's feedback.
+       */
+      for (const applicationId of applicationIds) {
+        try {
+          feedback.push(...(await fetchFeedbackForApplication(accessToken, applicationId)))
+        } catch (error) {
           logger.warn('Failed to fetch Ashby feedback for application', {
-            applicationId: applicationIds[i],
-            error: toError(outcome.reason).message,
+            applicationId,
+            error: toError(error).message,
           })
         }
       }

apps/sim/connectors/azure-devops/azure-devops.ts

@@ -246,10 +246,11 @@ interface GitRepository {
 }
 
 /**
- * Resolves the browsable base URL for a repository. `webUrl` is only present
- * when the repositories listing is requested with `includeAllUrls=true`;
- * `remoteUrl` is always returned and points at the same
- * `.../{project}/_git/{repo}` web route, so it is the fallback.
+ * Resolves the browsable base URL for a repository. `webUrl` is declared on
+ * GitRepository but absent from the documented sample responses, so it cannot be
+ * relied on; `remoteUrl` appears in every sample as
+ * `https://dev.azure.com/{org}/{project}/_git/{repo}`, which is the same web
+ * route, and serves as the fallback.
  */
 function repoBaseUrl(repo: GitRepository | undefined): string | undefined {
   return repo?.webUrl || repo?.remoteUrl
@@ -699,9 +700,10 @@ async function listRepositories(
   syncContext?: Record<string, unknown>
 ): Promise<GitRepository[]> {
   /**
-   * `includeAllUrls=true` is required for the response to carry `webUrl`; without
-   * it the listing returns only `url`/`remoteUrl` and every repository-file
-   * document would be indexed with no `sourceUrl`.
+   * `includeAllUrls=true` — "True to include all remote URLs. The default value
+   * is false." The docs do not say which of GitRepository's URL fields it gates,
+   * and the sample listing omits `webUrl`, so it is requested to maximise the
+   * chance of getting one; `repoBaseUrl` falls back to `remoteUrl` regardless.
    */
   const url = `${ADO_BASE_URL}/${encodeURIComponent(organization)}/${encodeURIComponent(project)}/_apis/git/repositories?includeAllUrls=true&api-version=${GIT_API_VERSION}`
   const response = await fetchWithRetry(

apps/sim/connectors/docusign/docusign.ts

@@ -435,10 +435,14 @@ export const docusignConnector: ConnectorConfig = {
 
     /**
      * Remaining budget under `maxEnvelopes`. The last page requests only what is still
-     * needed instead of a full {@link MAX_PAGE_SIZE} page.
+     * needed instead of a full {@link MAX_PAGE_SIZE} page. Safe to shrink because
+     * `start_position` is an offset the next page resumes from, not a page number.
+     *
+     * Floored to a positive integer: `maxEnvelopes` is free-form user input that
+     * `validateConfig` only checks for sign, and DocuSign rejects a fractional `count`.
      */
     const remaining = maxEnvelopes > 0 ? maxEnvelopes - prevFetched : Number.POSITIVE_INFINITY
-    const pageSize = Math.min(MAX_PAGE_SIZE, remaining)
+    const pageSize = Math.max(1, Math.min(MAX_PAGE_SIZE, Math.floor(remaining)))
 
     const queryParams = new URLSearchParams({
       from_date: formatFromDate(fromDate),

apps/sim/connectors/dropbox/dropbox.ts

@@ -90,9 +90,12 @@ function isDownloadableFile(entry: DropboxEntry): entry is DropboxFileMetadata {
 }
 
 /**
- * Normalizes a user-supplied folder path to what `/2/files/list_folder` expects:
- * the empty string for the Dropbox root, otherwise a leading slash and no trailing
- * slash (a trailing slash is rejected as `malformed_path`).
+ * Normalizes a user-supplied folder path to the `PathROrId` format
+ * `/2/files/list_folder` declares: the empty string for the Dropbox root (the
+ * leading-slash branch of the pattern is optional precisely so `""` matches),
+ * otherwise a leading slash. The trailing slash is stripped as defensive
+ * tidying of free-form input, not because Dropbox documents rejecting it.
+ * A path outside the format fails with `path/malformed_path`.
  */
 function normalizeFolderPath(raw: unknown): string {
   const trimmed = typeof raw === 'string' ? raw.trim() : ''

apps/sim/connectors/fireflies/fireflies.test.ts

@@ -134,6 +134,30 @@ describe('fireflies listDocuments', () => {
     )
   })
 
+  it('throws rather than reporting an empty listing when a 200 body is unreadable', async () => {
+    mockFetchWithRetry.mockResolvedValue({
+      ok: true,
+      status: 200,
+      json: async () => {
+        throw new SyntaxError('Unexpected token < in JSON at position 0')
+      },
+      text: async () => '<html>gateway</html>',
+    } as unknown as Response)
+    const syncContext: Record<string, unknown> = {}
+
+    await expect(
+      firefliesConnector.listDocuments('key', {}, undefined, syncContext)
+    ).rejects.toThrow(/malformed/i)
+  })
+
+  it('throws rather than reporting an empty listing when a 200 carries no data', async () => {
+    mockGraphQL([{ body: {} }])
+
+    await expect(firefliesConnector.listDocuments('key', {}, undefined, {})).rejects.toThrow(
+      /malformed/i
+    )
+  })
+
   it('surfaces the errors[] message on a non-2xx response', async () => {
     mockGraphQL([
       { status: 403, body: { errors: [{ message: 'Upgrade required', code: 'paid_required' }] } },

apps/sim/connectors/fireflies/fireflies.ts

@@ -91,7 +91,18 @@ async function firefliesGraphQL(
     throw new Error(`Fireflies API HTTP error: ${response.status}`)
   }
 
-  return data?.data ?? {}
+  /**
+   * A 2xx carrying neither `errors` nor a `data` object is unreadable — an
+   * unparseable body, a truncated response, a proxy interstitial. It must raise
+   * rather than degrade to an empty result: `listDocuments` would otherwise
+   * report a confident empty listing and the sync engine would reconcile every
+   * stored document as deleted.
+   */
+  if (!data || typeof data.data !== 'object' || data.data === null) {
+    throw new Error('Fireflies API returned a malformed response with no data')
+  }
+
+  return data.data
 }
 
 /**
@@ -287,7 +298,13 @@ export const firefliesConnector: ConnectorConfig = {
 
     return {
       documents,
-      nextCursor: hasMore ? String(skip + documents.length) : undefined,
+      /**
+       * `skip` is an offset over the raw API result set, so it must advance by the
+       * rows Fireflies returned — not by the stubs kept. Advancing by the kept
+       * count would re-request any row dropped for a missing `id`. `hasMore` is
+       * only ever true on the uncapped path, where nothing is sliced off.
+       */
+      nextCursor: hasMore ? String(skip + transcripts.length) : undefined,
       hasMore,
     }
   },

apps/sim/connectors/github/github.ts

@@ -176,10 +176,12 @@ async function fetchBlobContent(
     return buf.toString('utf8')
   }
   /**
-   * Per https://docs.github.com/en/rest/git/blobs the Blobs API only ever
-   * returns base64. Refuse to silently persist empty content for an
-   * unexpected encoding so a sync surfaces the error instead.
+   * https://docs.github.com/en/rest/git/blobs documents two encodings —
+   * "Currently, 'utf-8' and 'base64' are supported" — so a utf-8 body is already
+   * plain text and is used as written. Any other encoding would silently persist
+   * empty content, so it throws and surfaces as a failed document instead.
    */
+  if (encoding === 'utf-8') return content
   throw new Error(`Unexpected git blob encoding for ${sha}: ${encoding ?? 'undefined'}`)
 }
 
@@ -378,9 +380,11 @@ export const githubConnector: ConnectorConfig = {
         content = buf.toString('utf8')
       } else if (encoding === 'none' && data.sha && size > 0) {
         /**
-         * The Contents API returns `content: ""` with `encoding: "none"` for files
-         * over 1 MB (verified against a 2.3 MB blob). The Git Blobs API serves the
-         * same blob base64-encoded up to 100 MB.
+         * Per https://docs.github.com/en/rest/repos/contents, for files of 1-100 MB
+         * "the content field will be an empty string and the encoding field will be
+         * `none`". The Contents page points at the raw media type; the Git Blobs API
+         * is used instead because it returns the same blob as JSON and is documented
+         * to support blobs up to 100 MB.
          */
         const blobContent = await fetchBlobContent(accessToken, owner, repo, data.sha as string)
         if (blobContent === null) {