From 2f4ca987609837435f6a7b03520c02f3ecbf80c2 Mon Sep 17 00:00:00 2001 From: Vikhyath Mondreti Date: Thu, 3 Sep 2026 16:51:58 -0700 Subject: [PATCH 1/4] fix(docs): describe which surfaces the NEXT_PUBLIC_ flag twins still gate The workspace host context now carries the server-resolved deployment shape, so settings sections and block fields inside a workspace follow the server variable. The NEXT_PUBLIC_ twins still gate the login page's SSO entry point and the Function block's Sandbox selector, and sim-setup doctor checks each pair. Update the sentences that said the twin decides what the settings UI shows. Co-Authored-By: Claude Fable 5.1 --- .../docs/content/docs/platform/enterprise/data-drains.mdx | 2 +- .../docs/content/docs/platform/enterprise/self-hosted.mdx | 8 ++++---- .../content/docs/platform/enterprise/verified-domains.mdx | 2 +- .../docs/platform/self-hosting/environment-variables.mdx | 2 +- .../docs/content/docs/platform/self-hosting/sandboxes.mdx | 4 ++-- apps/docs/content/docs/platform/self-hosting/security.mdx | 2 +- 6 files changed, 10 insertions(+), 10 deletions(-) diff --git a/apps/docs/content/docs/platform/enterprise/data-drains.mdx b/apps/docs/content/docs/platform/enterprise/data-drains.mdx index d8805a9fc40..8601f9173d7 100644 --- a/apps/docs/content/docs/platform/enterprise/data-drains.mdx +++ b/apps/docs/content/docs/platform/enterprise/data-drains.mdx @@ -237,7 +237,7 @@ DATA_DRAINS_ENABLED=true NEXT_PUBLIC_DATA_DRAINS_ENABLED=true ``` -`NEXT_PUBLIC_DATA_DRAINS_ENABLED` shows the **Settings → Organization → Data drains** page in the UI. `DATA_DRAINS_ENABLED` gates the server-side mutating endpoints and the cron dispatcher — when unset on a self-hosted deployment, drain create/update/delete/run requests return `404` and the dispatcher is a no-op. Both should be set to `true` together. +`DATA_DRAINS_ENABLED` shows the **Settings → Organization → Data drains** page and gates the server-side mutating endpoints and the cron dispatcher — when unset on a self-hosted deployment, the page is hidden, drain create/update/delete/run requests return `404`, and the dispatcher is a no-op. Set `NEXT_PUBLIC_DATA_DRAINS_ENABLED` to the same value so the browser's configuration matches the server's; `npx sim-setup doctor` reports the pair disagreeing. ### Scheduling the dispatcher diff --git a/apps/docs/content/docs/platform/enterprise/self-hosted.mdx b/apps/docs/content/docs/platform/enterprise/self-hosted.mdx index 9e5b7dfe74a..4cf5f34fe8b 100644 --- a/apps/docs/content/docs/platform/enterprise/self-hosted.mdx +++ b/apps/docs/content/docs/platform/enterprise/self-hosted.mdx @@ -16,7 +16,7 @@ There are two parts to getting this right, and skipping the second is the most c ## Enable the feature set -Set the master switch and its client twin. Both are required — the server value decides access, and the `NEXT_PUBLIC_` value decides what the settings UI shows. +Set the master switch and its client twin. Both are required. The server value decides access and what a workspace shows: settings sections and block fields read the deployment's server-resolved configuration, so the sidebar and the API answer the same question. The `NEXT_PUBLIC_` value covers what renders before a workspace loads — the SSO entry point on the login page — and `npx sim-setup doctor` reports any pair that disagrees. ```bash ENTERPRISE_ENABLED=true @@ -59,7 +59,7 @@ Three features do not need a flag at all: **custom branding**, **session policie | Sim Mailer inbox — on by default | `INBOX_ENABLED` | `NEXT_PUBLIC_INBOX_ENABLED` | | Sandboxes | `SANDBOXES_ENABLED` | `NEXT_PUBLIC_SANDBOXES_ENABLED` | -Sandboxes also need a remote execution provider and a dedicated Function base image before they can run anything. `SANDBOXES_ENABLED` grants the server-side entitlement; `NEXT_PUBLIC_SANDBOXES_ENABLED` projects provider readiness to the browser and exposes Shell plus custom Sandbox management. Set the public flag only after the selected provider has credentials and a valid immutable Function base configured. +Sandboxes also need a remote execution provider and a dedicated Function base image before they can run anything. `SANDBOXES_ENABLED` grants the server-side entitlement, and Shell and **Settings → Sandboxes** appear only once the server has also verified the provider credentials and an immutable Function base. `NEXT_PUBLIC_SANDBOXES_ENABLED` is the browser's copy of that readiness: it reveals the Function block's Sandbox selector, and `npx sim-setup doctor` checks it against the server. Set it only after the selected provider has credentials and a valid immutable Function base configured. JavaScript without `import` or `require` does not use the remote provider and continues to run in the local isolated VM when all Sandbox flags are off. Python, Shell, JavaScript with external imports, and selected custom Sandboxes fail with an explicit configuration error until the remote Function base is ready. @@ -249,9 +249,9 @@ curl -X DELETE "https://sim.example.com/api/v1/admin/organizations/$ORG_ID?confi If a feature is enabled but nothing appears, check these in order. -**The settings section is missing.** The `NEXT_PUBLIC_` twin is not set, or the app was not restarted after adding it. Client variables are read at boot from the container environment, so a restart is enough — no rebuild. +**The settings section is missing.** The server-side variable is not set, or the app was not restarted after adding it. Variables are read at boot from the container environment, so a restart is enough — no rebuild. -**The section appears but the API returns 403.** The server-side variable is missing while its client twin is set. Set both. +**The section appears but the login page has no SSO option, or the Function block has no Sandbox selector.** The `NEXT_PUBLIC_` twin is missing while the server-side variable is set. A workspace follows the server, but the login page renders before any workspace loads and reads the twin, and the Sandbox selector does too. Set both; `npx sim-setup doctor` reports the pair disagreeing. **The feature is on but has no effect inside a workspace.** The workspace is not owned by an organization. Check `workspace_mode` and `organization_id`: diff --git a/apps/docs/content/docs/platform/enterprise/verified-domains.mdx b/apps/docs/content/docs/platform/enterprise/verified-domains.mdx index 938295c2f32..4a4dedcd684 100644 --- a/apps/docs/content/docs/platform/enterprise/verified-domains.mdx +++ b/apps/docs/content/docs/platform/enterprise/verified-domains.mdx @@ -71,6 +71,6 @@ SSO_ENABLED=true NEXT_PUBLIC_SSO_ENABLED=true ``` -`ENTERPRISE_ENABLED` turns both on together, but it needs its own browser twin — set `NEXT_PUBLIC_ENTERPRISE_ENABLED` alongside it, or the server enables SSO while the browser still hides it. See the [self-hosted enterprise guide](/platform/enterprise/self-hosted). +`ENTERPRISE_ENABLED` turns both on together, but it needs its own browser twin — set `NEXT_PUBLIC_ENTERPRISE_ENABLED` alongside it, or the server and the settings page enable SSO while the login page still hides its SSO entry point. See the [self-hosted enterprise guide](/platform/enterprise/self-hosted). Once enabled, verify domains from **Settings → Organization → Single sign-on**, in the **Verified domains** section above the identity provider configuration. The older `/workspace//settings/domains` path still resolves to the same page. diff --git a/apps/docs/content/docs/platform/self-hosting/environment-variables.mdx b/apps/docs/content/docs/platform/self-hosting/environment-variables.mdx index f071e20ce7d..8e76384dcad 100644 --- a/apps/docs/content/docs/platform/self-hosting/environment-variables.mdx +++ b/apps/docs/content/docs/platform/self-hosting/environment-variables.mdx @@ -144,7 +144,7 @@ Who may sign up and sign in — the allowlists, blocklists, `DISABLE_REGISTRATIO | `E2B_FUNCTION_TEMPLATE_GENERATION` | Monotonic release generation printed by the same build. Required for E2B | | `DAYTONA_FUNCTION_SNAPSHOT_ID` | Immutable snapshot **ID** (not a name) for the Function base image. Required for Daytona | | `E2B_PI_TEMPLATE_ID` / `DAYTONA_PI_SNAPSHOT_ID` | The image Pi runs on. Separate from the Function base — configuring the provider and Function image alone leaves Pi failing closed | -| `SANDBOXES_ENABLED` / `NEXT_PUBLIC_SANDBOXES_ENABLED` | Enable custom sandboxes on a self-hosted deployment, bypassing the hosted-plan requirement. Neither is sufficient on its own — a provider key **and** an immutable Function base must also be configured. Set the `NEXT_PUBLIC_` twin only after the server side works; it asserts readiness to the browser rather than enabling anything | +| `SANDBOXES_ENABLED` / `NEXT_PUBLIC_SANDBOXES_ENABLED` | Enable custom sandboxes on a self-hosted deployment, bypassing the hosted-plan requirement. Neither is sufficient on its own — a provider key **and** an immutable Function base must also be configured. Set the `NEXT_PUBLIC_` twin only after the server side works; it enables nothing by itself — it reveals the Function block's Sandbox selector and lets `sim-setup doctor` confirm the two sides agree | | `IVM_MAX_EXECUTIONS_PER_WORKER` | Executions before an isolated-vm worker is recycled | | `IVM_MAX_BROKERS_PER_EXECUTION` | Host-call brokers per execution | | `IVM_MAX_BROKER_ARGS_JSON_CHARS` | Max argument payload size | diff --git a/apps/docs/content/docs/platform/self-hosting/sandboxes.mdx b/apps/docs/content/docs/platform/self-hosting/sandboxes.mdx index 9d8cf3430f8..f7c35ba0f3b 100644 --- a/apps/docs/content/docs/platform/self-hosting/sandboxes.mdx +++ b/apps/docs/content/docs/platform/self-hosting/sandboxes.mdx @@ -15,9 +15,9 @@ Until the base image is configured, those languages fail with an explicit config | Variable | Purpose | | --- | --- | | `SANDBOXES_ENABLED` | Grants the server-side self-hosted entitlement | -| `NEXT_PUBLIC_SANDBOXES_ENABLED` | Projects provider readiness to the browser and exposes Shell plus custom sandbox management | +| `NEXT_PUBLIC_SANDBOXES_ENABLED` | The browser's copy of provider readiness. Reveals the Function block's Sandbox selector; `sim-setup doctor` checks it against the server | -`NEXT_PUBLIC_SANDBOXES_ENABLED` is a browser gate only: it shows or hides Shell, the sandbox picker, and **Settings → Sandboxes**. Whether Python or a selected sandbox actually runs depends on the server-side provider and Function image. Set it only after those work, or you surface controls that cannot. +Shell and **Settings → Sandboxes** follow the server: a workspace shows them only when `SANDBOXES_ENABLED` is set and the server has verified the provider credentials and an immutable Function base. `NEXT_PUBLIC_SANDBOXES_ENABLED` is a browser gate for one control, the Function block's Sandbox selector. Whether Python or a selected sandbox actually runs depends on the server-side provider and Function image, so set it only after those work, or you surface a selector for sandboxes that cannot run. ## Building the Function base diff --git a/apps/docs/content/docs/platform/self-hosting/security.mdx b/apps/docs/content/docs/platform/self-hosting/security.mdx index 8a836a5eb13..109c280043c 100644 --- a/apps/docs/content/docs/platform/self-hosting/security.mdx +++ b/apps/docs/content/docs/platform/self-hosting/security.mdx @@ -151,7 +151,7 @@ Two browser-side variables project server state into the UI, and neither is deri | Variable | Effect when unset | |---|---| -| `NEXT_PUBLIC_SANDBOXES_ENABLED` | The Function block's Shell language, its Sandbox picker, and **Settings → Sandboxes** stay hidden, even with a working provider. Python stays selectable; whether it runs depends on the server-side provider and Function image, not on this flag | +| `NEXT_PUBLIC_SANDBOXES_ENABLED` | The Function block's Sandbox selector stays hidden, even with a working provider. Shell and **Settings → Sandboxes** are unaffected — a workspace shows them from the server's own readiness check. Python stays selectable; whether it runs depends on the server-side provider and Function image, not on this flag | | `NEXT_PUBLIC_E2B_ENABLED` | The E2B-backed Pi block modes stay hidden; `sim-setup doctor` reports it as a mismatch against `E2B_ENABLED`. Revealing them is not enough to make them run — Pi executes on its own image, pinned with `E2B_PI_TEMPLATE_ID` or `DAYTONA_PI_SNAPSHOT_ID`, and fails closed without it | Set the public values only **after** the server-side configuration above is complete — they are assertions about readiness, not switches, and the server-side check has its own conditions beyond them. See [Sandboxes](/platform/self-hosting/sandboxes) for the base-image build and promotion procedure. `npx sim-setup doctor` reports a mismatch in either direction. From adbaa97cacb2dd377a03e809c60e52c4ab0f0b0f Mon Sep 17 00:00:00 2001 From: Vikhyath Mondreti Date: Thu, 3 Sep 2026 17:08:03 -0700 Subject: [PATCH 2/4] fix(docs): correct the Sandboxes settings state and the setup doctor scope The Sandboxes settings entry keeps its sidebar row and shows an upgrade notice until the server's readiness check passes, so say that instead of claiming the section is hidden, and add a troubleshooting bullet for that state. Describe NEXT_PUBLIC_SANDBOXES_ENABLED as an assertion the operator makes rather than a copy of readiness, invoke the setup doctor as npx sim-setup doctor throughout, and qualify its diagnostic mentions to Compose installs and source checkouts. Co-Authored-By: Claude Fable 5.1 --- .../docs/content/docs/platform/enterprise/data-drains.mdx | 2 +- .../docs/content/docs/platform/enterprise/self-hosted.mdx | 8 +++++--- .../docs/platform/self-hosting/environment-variables.mdx | 2 +- .../docs/content/docs/platform/self-hosting/sandboxes.mdx | 4 ++-- apps/docs/content/docs/platform/self-hosting/security.mdx | 7 ++++--- 5 files changed, 13 insertions(+), 10 deletions(-) diff --git a/apps/docs/content/docs/platform/enterprise/data-drains.mdx b/apps/docs/content/docs/platform/enterprise/data-drains.mdx index 8601f9173d7..4e93636bc1f 100644 --- a/apps/docs/content/docs/platform/enterprise/data-drains.mdx +++ b/apps/docs/content/docs/platform/enterprise/data-drains.mdx @@ -237,7 +237,7 @@ DATA_DRAINS_ENABLED=true NEXT_PUBLIC_DATA_DRAINS_ENABLED=true ``` -`DATA_DRAINS_ENABLED` shows the **Settings → Organization → Data drains** page and gates the server-side mutating endpoints and the cron dispatcher — when unset on a self-hosted deployment, the page is hidden, drain create/update/delete/run requests return `404`, and the dispatcher is a no-op. Set `NEXT_PUBLIC_DATA_DRAINS_ENABLED` to the same value so the browser's configuration matches the server's; `npx sim-setup doctor` reports the pair disagreeing. +`DATA_DRAINS_ENABLED` shows the **Settings → Organization → Data drains** page and gates the server-side mutating endpoints and the cron dispatcher — when unset on a self-hosted deployment, the page is hidden, drain create/update/delete/run requests return `404`, and the dispatcher is a no-op. Set `NEXT_PUBLIC_DATA_DRAINS_ENABLED` to the same value so the browser's configuration matches the server's; on a Compose install or source checkout, `npx sim-setup doctor` reports the pair disagreeing. ### Scheduling the dispatcher diff --git a/apps/docs/content/docs/platform/enterprise/self-hosted.mdx b/apps/docs/content/docs/platform/enterprise/self-hosted.mdx index 4cf5f34fe8b..c367901396e 100644 --- a/apps/docs/content/docs/platform/enterprise/self-hosted.mdx +++ b/apps/docs/content/docs/platform/enterprise/self-hosted.mdx @@ -16,7 +16,7 @@ There are two parts to getting this right, and skipping the second is the most c ## Enable the feature set -Set the master switch and its client twin. Both are required. The server value decides access and what a workspace shows: settings sections and block fields read the deployment's server-resolved configuration, so the sidebar and the API answer the same question. The `NEXT_PUBLIC_` value covers what renders before a workspace loads — the SSO entry point on the login page — and `npx sim-setup doctor` reports any pair that disagrees. +Set the master switch and its client twin. Both are required. The server value decides access and what a workspace shows: settings sections and block fields read the deployment's server-resolved configuration, so the sidebar and the API answer the same question. The `NEXT_PUBLIC_` value covers what renders before a workspace loads — the SSO entry point on the login page. On a Compose install or source checkout, `npx sim-setup doctor` reports any pair that disagrees; see [Verify your install](/platform/self-hosting/verify). ```bash ENTERPRISE_ENABLED=true @@ -59,7 +59,7 @@ Three features do not need a flag at all: **custom branding**, **session policie | Sim Mailer inbox — on by default | `INBOX_ENABLED` | `NEXT_PUBLIC_INBOX_ENABLED` | | Sandboxes | `SANDBOXES_ENABLED` | `NEXT_PUBLIC_SANDBOXES_ENABLED` | -Sandboxes also need a remote execution provider and a dedicated Function base image before they can run anything. `SANDBOXES_ENABLED` grants the server-side entitlement, and Shell and **Settings → Sandboxes** appear only once the server has also verified the provider credentials and an immutable Function base. `NEXT_PUBLIC_SANDBOXES_ENABLED` is the browser's copy of that readiness: it reveals the Function block's Sandbox selector, and `npx sim-setup doctor` checks it against the server. Set it only after the selected provider has credentials and a valid immutable Function base configured. +Sandboxes also need a remote execution provider and a dedicated Function base image before they can run anything. `SANDBOXES_ENABLED` grants the server-side entitlement, and the server also verifies the provider credentials and an immutable Function base before it reports Sandboxes as available. Until then a workspace offers no Shell language, and **Settings → Sandboxes** stays in the sidebar but shows an upgrade notice instead of the sandbox list. `NEXT_PUBLIC_SANDBOXES_ENABLED` asserts that readiness to the browser rather than checking it: it reveals the Function block's Sandbox selector, and `npx sim-setup doctor` compares it with the server. Set it only after the selected provider has credentials and a valid immutable Function base configured. JavaScript without `import` or `require` does not use the remote provider and continues to run in the local isolated VM when all Sandbox flags are off. Python, Shell, JavaScript with external imports, and selected custom Sandboxes fail with an explicit configuration error until the remote Function base is ready. @@ -251,7 +251,9 @@ If a feature is enabled but nothing appears, check these in order. **The settings section is missing.** The server-side variable is not set, or the app was not restarted after adding it. Variables are read at boot from the container environment, so a restart is enough — no rebuild. -**The section appears but the login page has no SSO option, or the Function block has no Sandbox selector.** The `NEXT_PUBLIC_` twin is missing while the server-side variable is set. A workspace follows the server, but the login page renders before any workspace loads and reads the twin, and the Sandbox selector does too. Set both; `npx sim-setup doctor` reports the pair disagreeing. +**Settings → Sandboxes shows an upgrade notice instead of the sandbox list.** `SANDBOXES_ENABLED` is unset, or the selected provider failed the server's readiness check — missing credentials, or a Function base that is not an immutable reference. The page stays in the sidebar either way. See [Sandboxes](/platform/self-hosting/sandboxes). + +**The section appears but the login page has no SSO option, or the Function block has no Sandbox selector.** The `NEXT_PUBLIC_` twin is missing while the server-side variable is set. A workspace follows the server, but the login page renders before any workspace loads and reads the twin, and the Sandbox selector does too. Set both; on a Compose install or source checkout, `npx sim-setup doctor` reports the pair disagreeing. **The feature is on but has no effect inside a workspace.** The workspace is not owned by an organization. Check `workspace_mode` and `organization_id`: diff --git a/apps/docs/content/docs/platform/self-hosting/environment-variables.mdx b/apps/docs/content/docs/platform/self-hosting/environment-variables.mdx index 8e76384dcad..ff79c7a306a 100644 --- a/apps/docs/content/docs/platform/self-hosting/environment-variables.mdx +++ b/apps/docs/content/docs/platform/self-hosting/environment-variables.mdx @@ -144,7 +144,7 @@ Who may sign up and sign in — the allowlists, blocklists, `DISABLE_REGISTRATIO | `E2B_FUNCTION_TEMPLATE_GENERATION` | Monotonic release generation printed by the same build. Required for E2B | | `DAYTONA_FUNCTION_SNAPSHOT_ID` | Immutable snapshot **ID** (not a name) for the Function base image. Required for Daytona | | `E2B_PI_TEMPLATE_ID` / `DAYTONA_PI_SNAPSHOT_ID` | The image Pi runs on. Separate from the Function base — configuring the provider and Function image alone leaves Pi failing closed | -| `SANDBOXES_ENABLED` / `NEXT_PUBLIC_SANDBOXES_ENABLED` | Enable custom sandboxes on a self-hosted deployment, bypassing the hosted-plan requirement. Neither is sufficient on its own — a provider key **and** an immutable Function base must also be configured. Set the `NEXT_PUBLIC_` twin only after the server side works; it enables nothing by itself — it reveals the Function block's Sandbox selector and lets `sim-setup doctor` confirm the two sides agree | +| `SANDBOXES_ENABLED` / `NEXT_PUBLIC_SANDBOXES_ENABLED` | Enable custom sandboxes on a self-hosted deployment, bypassing the hosted-plan requirement. Neither is sufficient on its own — a provider key **and** an immutable Function base must also be configured. Set the `NEXT_PUBLIC_` twin only after the server side works; it enables nothing by itself — it reveals the Function block's Sandbox selector and lets `npx sim-setup doctor` confirm the two sides agree | | `IVM_MAX_EXECUTIONS_PER_WORKER` | Executions before an isolated-vm worker is recycled | | `IVM_MAX_BROKERS_PER_EXECUTION` | Host-call brokers per execution | | `IVM_MAX_BROKER_ARGS_JSON_CHARS` | Max argument payload size | diff --git a/apps/docs/content/docs/platform/self-hosting/sandboxes.mdx b/apps/docs/content/docs/platform/self-hosting/sandboxes.mdx index f7c35ba0f3b..08257cadb4d 100644 --- a/apps/docs/content/docs/platform/self-hosting/sandboxes.mdx +++ b/apps/docs/content/docs/platform/self-hosting/sandboxes.mdx @@ -15,9 +15,9 @@ Until the base image is configured, those languages fail with an explicit config | Variable | Purpose | | --- | --- | | `SANDBOXES_ENABLED` | Grants the server-side self-hosted entitlement | -| `NEXT_PUBLIC_SANDBOXES_ENABLED` | The browser's copy of provider readiness. Reveals the Function block's Sandbox selector; `sim-setup doctor` checks it against the server | +| `NEXT_PUBLIC_SANDBOXES_ENABLED` | Browser gate for the Function block's Sandbox selector. An assertion of provider readiness, not a check; `npx sim-setup doctor` compares it with the server | -Shell and **Settings → Sandboxes** follow the server: a workspace shows them only when `SANDBOXES_ENABLED` is set and the server has verified the provider credentials and an immutable Function base. `NEXT_PUBLIC_SANDBOXES_ENABLED` is a browser gate for one control, the Function block's Sandbox selector. Whether Python or a selected sandbox actually runs depends on the server-side provider and Function image, so set it only after those work, or you surface a selector for sandboxes that cannot run. +Shell follows the server: a workspace offers it only when `SANDBOXES_ENABLED` is set and the server has verified the provider credentials and an immutable Function base. **Settings → Sandboxes** stays in the sidebar either way, but shows an upgrade notice instead of the sandbox list until that check passes. `NEXT_PUBLIC_SANDBOXES_ENABLED` is a browser gate for one control, the Function block's Sandbox selector. Whether Python or a selected sandbox actually runs depends on the server-side provider and Function image, so set it only after those work, or you surface a selector for sandboxes that cannot run. ## Building the Function base diff --git a/apps/docs/content/docs/platform/self-hosting/security.mdx b/apps/docs/content/docs/platform/self-hosting/security.mdx index 109c280043c..2f452d88049 100644 --- a/apps/docs/content/docs/platform/self-hosting/security.mdx +++ b/apps/docs/content/docs/platform/self-hosting/security.mdx @@ -133,8 +133,9 @@ Workflows can execute user-authored JavaScript and Python. Know which sandbox yo Python, Shell, JavaScript with external imports, and tooling-dependent blocks require a remote sandbox provider. On a billing-free self-host the provider and Function base are not sufficient on their own: `SANDBOXES_ENABLED` grants the -server-side entitlement, and without it Shell and the Sandboxes settings stay -hidden even when the provider is configured correctly. JavaScript without `import` or `require` +server-side entitlement, and without it a workspace offers no Shell language and the +Sandboxes settings page shows an upgrade notice even when the provider is configured +correctly. JavaScript without `import` or `require` continues to run in the in-process isolate when no remote provider is configured. @@ -151,7 +152,7 @@ Two browser-side variables project server state into the UI, and neither is deri | Variable | Effect when unset | |---|---| -| `NEXT_PUBLIC_SANDBOXES_ENABLED` | The Function block's Sandbox selector stays hidden, even with a working provider. Shell and **Settings → Sandboxes** are unaffected — a workspace shows them from the server's own readiness check. Python stays selectable; whether it runs depends on the server-side provider and Function image, not on this flag | +| `NEXT_PUBLIC_SANDBOXES_ENABLED` | The Function block's Sandbox selector stays hidden, even with a working provider. Shell and **Settings → Sandboxes** are unaffected — Shell appears, and the settings page swaps its upgrade notice for the sandbox list, from the server's own readiness check. Python stays selectable; whether it runs depends on the server-side provider and Function image, not on this flag | | `NEXT_PUBLIC_E2B_ENABLED` | The E2B-backed Pi block modes stay hidden; `sim-setup doctor` reports it as a mismatch against `E2B_ENABLED`. Revealing them is not enough to make them run — Pi executes on its own image, pinned with `E2B_PI_TEMPLATE_ID` or `DAYTONA_PI_SNAPSHOT_ID`, and fails closed without it | Set the public values only **after** the server-side configuration above is complete — they are assertions about readiness, not switches, and the server-side check has its own conditions beyond them. See [Sandboxes](/platform/self-hosting/sandboxes) for the base-image build and promotion procedure. `npx sim-setup doctor` reports a mismatch in either direction. From 8a1eb834a2b9f8c17398d7c6bfdca5d3e7103d62 Mon Sep 17 00:00:00 2001 From: Vikhyath Mondreti Date: Thu, 3 Sep 2026 17:20:44 -0700 Subject: [PATCH 3/4] fix(docs): account for the enterprise master switch and the doctor's Sandbox check ENTERPRISE_ENABLED resolves data drains and the Sandbox entitlement on without the per-feature flag, so describe the off state as the feature resolving off rather than the flag being unset. The setup doctor compares NEXT_PUBLIC_SANDBOXES_ENABLED with the selected provider's readiness rather than with SANDBOXES_ENABLED, so say that instead of promising a pair check. Co-Authored-By: Claude Fable 5.1 --- apps/docs/content/docs/platform/enterprise/data-drains.mdx | 2 +- apps/docs/content/docs/platform/enterprise/self-hosted.mdx | 6 +++--- apps/docs/content/docs/platform/self-hosting/sandboxes.mdx | 4 ++-- apps/docs/content/docs/platform/self-hosting/security.mdx | 6 +++--- 4 files changed, 9 insertions(+), 9 deletions(-) diff --git a/apps/docs/content/docs/platform/enterprise/data-drains.mdx b/apps/docs/content/docs/platform/enterprise/data-drains.mdx index 4e93636bc1f..60160570fa0 100644 --- a/apps/docs/content/docs/platform/enterprise/data-drains.mdx +++ b/apps/docs/content/docs/platform/enterprise/data-drains.mdx @@ -237,7 +237,7 @@ DATA_DRAINS_ENABLED=true NEXT_PUBLIC_DATA_DRAINS_ENABLED=true ``` -`DATA_DRAINS_ENABLED` shows the **Settings → Organization → Data drains** page and gates the server-side mutating endpoints and the cron dispatcher — when unset on a self-hosted deployment, the page is hidden, drain create/update/delete/run requests return `404`, and the dispatcher is a no-op. Set `NEXT_PUBLIC_DATA_DRAINS_ENABLED` to the same value so the browser's configuration matches the server's; on a Compose install or source checkout, `npx sim-setup doctor` reports the pair disagreeing. +`DATA_DRAINS_ENABLED` shows the **Settings → Organization → Data drains** page and gates the server-side mutating endpoints and the cron dispatcher. When the feature resolves off on a self-hosted deployment — neither it nor `ENTERPRISE_ENABLED` is set, or it is set to `false` — the page is hidden, drain create/update/delete/run requests return `404`, and the dispatcher is a no-op. Set `NEXT_PUBLIC_DATA_DRAINS_ENABLED` to the same value so the browser's configuration matches the server's; on a Compose install or source checkout, `npx sim-setup doctor` reports the pair disagreeing. ### Scheduling the dispatcher diff --git a/apps/docs/content/docs/platform/enterprise/self-hosted.mdx b/apps/docs/content/docs/platform/enterprise/self-hosted.mdx index c367901396e..775b9a61f66 100644 --- a/apps/docs/content/docs/platform/enterprise/self-hosted.mdx +++ b/apps/docs/content/docs/platform/enterprise/self-hosted.mdx @@ -59,7 +59,7 @@ Three features do not need a flag at all: **custom branding**, **session policie | Sim Mailer inbox — on by default | `INBOX_ENABLED` | `NEXT_PUBLIC_INBOX_ENABLED` | | Sandboxes | `SANDBOXES_ENABLED` | `NEXT_PUBLIC_SANDBOXES_ENABLED` | -Sandboxes also need a remote execution provider and a dedicated Function base image before they can run anything. `SANDBOXES_ENABLED` grants the server-side entitlement, and the server also verifies the provider credentials and an immutable Function base before it reports Sandboxes as available. Until then a workspace offers no Shell language, and **Settings → Sandboxes** stays in the sidebar but shows an upgrade notice instead of the sandbox list. `NEXT_PUBLIC_SANDBOXES_ENABLED` asserts that readiness to the browser rather than checking it: it reveals the Function block's Sandbox selector, and `npx sim-setup doctor` compares it with the server. Set it only after the selected provider has credentials and a valid immutable Function base configured. +Sandboxes also need a remote execution provider and a dedicated Function base image before they can run anything. `SANDBOXES_ENABLED` grants the server-side entitlement, and the server also verifies the provider credentials and an immutable Function base before it reports Sandboxes as available. Until then a workspace offers no Shell language, and **Settings → Sandboxes** stays in the sidebar but shows an upgrade notice instead of the sandbox list. `NEXT_PUBLIC_SANDBOXES_ENABLED` asserts that readiness to the browser rather than checking it: it reveals the Function block's Sandbox selector, and `npx sim-setup doctor` compares it with the selected provider's readiness. Set it only after the selected provider has credentials and a valid immutable Function base configured. JavaScript without `import` or `require` does not use the remote provider and continues to run in the local isolated VM when all Sandbox flags are off. Python, Shell, JavaScript with external imports, and selected custom Sandboxes fail with an explicit configuration error until the remote Function base is ready. @@ -251,9 +251,9 @@ If a feature is enabled but nothing appears, check these in order. **The settings section is missing.** The server-side variable is not set, or the app was not restarted after adding it. Variables are read at boot from the container environment, so a restart is enough — no rebuild. -**Settings → Sandboxes shows an upgrade notice instead of the sandbox list.** `SANDBOXES_ENABLED` is unset, or the selected provider failed the server's readiness check — missing credentials, or a Function base that is not an immutable reference. The page stays in the sidebar either way. See [Sandboxes](/platform/self-hosting/sandboxes). +**Settings → Sandboxes shows an upgrade notice instead of the sandbox list.** The deployment has no Sandbox entitlement (neither `SANDBOXES_ENABLED` nor the `ENTERPRISE_ENABLED` master switch is set), or the selected provider failed the server's readiness check — missing credentials, or a Function base that is not an immutable reference. The page stays in the sidebar either way. See [Sandboxes](/platform/self-hosting/sandboxes). -**The section appears but the login page has no SSO option, or the Function block has no Sandbox selector.** The `NEXT_PUBLIC_` twin is missing while the server-side variable is set. A workspace follows the server, but the login page renders before any workspace loads and reads the twin, and the Sandbox selector does too. Set both; on a Compose install or source checkout, `npx sim-setup doctor` reports the pair disagreeing. +**The section appears but the login page has no SSO option, or the Function block has no Sandbox selector.** The `NEXT_PUBLIC_` twin is missing while the server-side variable is set. A workspace follows the server, but the login page renders before any workspace loads and reads the twin, and the Sandbox selector does too. Set both. On a Compose install or source checkout, `npx sim-setup doctor` reports a twin that disagrees with its server flag; for Sandboxes it compares `NEXT_PUBLIC_SANDBOXES_ENABLED` with the selected provider's readiness instead. **The feature is on but has no effect inside a workspace.** The workspace is not owned by an organization. Check `workspace_mode` and `organization_id`: diff --git a/apps/docs/content/docs/platform/self-hosting/sandboxes.mdx b/apps/docs/content/docs/platform/self-hosting/sandboxes.mdx index 08257cadb4d..6efdbc1e5f1 100644 --- a/apps/docs/content/docs/platform/self-hosting/sandboxes.mdx +++ b/apps/docs/content/docs/platform/self-hosting/sandboxes.mdx @@ -15,9 +15,9 @@ Until the base image is configured, those languages fail with an explicit config | Variable | Purpose | | --- | --- | | `SANDBOXES_ENABLED` | Grants the server-side self-hosted entitlement | -| `NEXT_PUBLIC_SANDBOXES_ENABLED` | Browser gate for the Function block's Sandbox selector. An assertion of provider readiness, not a check; `npx sim-setup doctor` compares it with the server | +| `NEXT_PUBLIC_SANDBOXES_ENABLED` | Browser gate for the Function block's Sandbox selector. An assertion of provider readiness, not a check; `npx sim-setup doctor` compares it with the selected provider's readiness | -Shell follows the server: a workspace offers it only when `SANDBOXES_ENABLED` is set and the server has verified the provider credentials and an immutable Function base. **Settings → Sandboxes** stays in the sidebar either way, but shows an upgrade notice instead of the sandbox list until that check passes. `NEXT_PUBLIC_SANDBOXES_ENABLED` is a browser gate for one control, the Function block's Sandbox selector. Whether Python or a selected sandbox actually runs depends on the server-side provider and Function image, so set it only after those work, or you surface a selector for sandboxes that cannot run. +Shell follows the server: a workspace offers it only when the deployment is entitled — `SANDBOXES_ENABLED`, or the `ENTERPRISE_ENABLED` master switch — and the server has verified the provider credentials and an immutable Function base. **Settings → Sandboxes** stays in the sidebar either way, but shows an upgrade notice instead of the sandbox list until that check passes. `NEXT_PUBLIC_SANDBOXES_ENABLED` is a browser gate for one control, the Function block's Sandbox selector. Whether Python or a selected sandbox actually runs depends on the server-side provider and Function image, so set it only after those work, or you surface a selector for sandboxes that cannot run. ## Building the Function base diff --git a/apps/docs/content/docs/platform/self-hosting/security.mdx b/apps/docs/content/docs/platform/self-hosting/security.mdx index 2f452d88049..e743135d222 100644 --- a/apps/docs/content/docs/platform/self-hosting/security.mdx +++ b/apps/docs/content/docs/platform/self-hosting/security.mdx @@ -133,9 +133,9 @@ Workflows can execute user-authored JavaScript and Python. Know which sandbox yo Python, Shell, JavaScript with external imports, and tooling-dependent blocks require a remote sandbox provider. On a billing-free self-host the provider and Function base are not sufficient on their own: `SANDBOXES_ENABLED` grants the -server-side entitlement, and without it a workspace offers no Shell language and the -Sandboxes settings page shows an upgrade notice even when the provider is configured -correctly. JavaScript without `import` or `require` +server-side entitlement (so does the `ENTERPRISE_ENABLED` master switch), and without that +entitlement a workspace offers no Shell language and the Sandboxes settings page shows an +upgrade notice even when the provider is configured correctly. JavaScript without `import` or `require` continues to run in the in-process isolate when no remote provider is configured. From 645f1c6a0a1f47bc241d740c4fcd44e53303e408 Mon Sep 17 00:00:00 2001 From: Vikhyath Mondreti Date: Thu, 3 Sep 2026 17:32:10 -0700 Subject: [PATCH 4/4] fix(docs): state the resolved flag conditions and the Sandbox selector exception Describe the Sandbox entitlement by how the flags resolve, since an explicit SANDBOXES_ENABLED=false overrides the master switch. Say an unset or false twin hides the login page's SSO entry point and the Sandbox selector, name that selector as the one block field that still reads the browser's own configuration, and scope the remaining setup doctor mentions to Compose installs and source checkouts. Co-Authored-By: Claude Fable 5.1 --- apps/docs/content/docs/platform/enterprise/self-hosted.mdx | 6 +++--- .../docs/platform/self-hosting/environment-variables.mdx | 2 +- apps/docs/content/docs/platform/self-hosting/sandboxes.mdx | 4 ++-- apps/docs/content/docs/platform/self-hosting/security.mdx | 6 +++--- 4 files changed, 9 insertions(+), 9 deletions(-) diff --git a/apps/docs/content/docs/platform/enterprise/self-hosted.mdx b/apps/docs/content/docs/platform/enterprise/self-hosted.mdx index 775b9a61f66..bd809138a9e 100644 --- a/apps/docs/content/docs/platform/enterprise/self-hosted.mdx +++ b/apps/docs/content/docs/platform/enterprise/self-hosted.mdx @@ -16,7 +16,7 @@ There are two parts to getting this right, and skipping the second is the most c ## Enable the feature set -Set the master switch and its client twin. Both are required. The server value decides access and what a workspace shows: settings sections and block fields read the deployment's server-resolved configuration, so the sidebar and the API answer the same question. The `NEXT_PUBLIC_` value covers what renders before a workspace loads — the SSO entry point on the login page. On a Compose install or source checkout, `npx sim-setup doctor` reports any pair that disagrees; see [Verify your install](/platform/self-hosting/verify). +Set the master switch and its client twin. Both are required. The server value decides access and most of what a workspace shows: settings sections and nearly all block fields read the deployment's server-resolved configuration, so the sidebar and the API answer the same question. The `NEXT_PUBLIC_` value covers what still reads the browser's own configuration: the SSO entry point on the login page, which renders before any workspace loads, and the Function block's Sandbox selector. On a Compose install or source checkout, `npx sim-setup doctor` reports a twin that disagrees with its server flag; see [Verify your install](/platform/self-hosting/verify). ```bash ENTERPRISE_ENABLED=true @@ -251,9 +251,9 @@ If a feature is enabled but nothing appears, check these in order. **The settings section is missing.** The server-side variable is not set, or the app was not restarted after adding it. Variables are read at boot from the container environment, so a restart is enough — no rebuild. -**Settings → Sandboxes shows an upgrade notice instead of the sandbox list.** The deployment has no Sandbox entitlement (neither `SANDBOXES_ENABLED` nor the `ENTERPRISE_ENABLED` master switch is set), or the selected provider failed the server's readiness check — missing credentials, or a Function base that is not an immutable reference. The page stays in the sidebar either way. See [Sandboxes](/platform/self-hosting/sandboxes). +**Settings → Sandboxes shows an upgrade notice instead of the sandbox list.** The Sandbox entitlement resolves off — `SANDBOXES_ENABLED=false`, or `SANDBOXES_ENABLED` unset without the `ENTERPRISE_ENABLED` master switch — or the selected provider failed the server's readiness check: missing credentials, or a Function base that is not an immutable reference. The page stays in the sidebar either way. See [Sandboxes](/platform/self-hosting/sandboxes). -**The section appears but the login page has no SSO option, or the Function block has no Sandbox selector.** The `NEXT_PUBLIC_` twin is missing while the server-side variable is set. A workspace follows the server, but the login page renders before any workspace loads and reads the twin, and the Sandbox selector does too. Set both. On a Compose install or source checkout, `npx sim-setup doctor` reports a twin that disagrees with its server flag; for Sandboxes it compares `NEXT_PUBLIC_SANDBOXES_ENABLED` with the selected provider's readiness instead. +**The section appears but the login page has no SSO option, or the Function block has no Sandbox selector.** The `NEXT_PUBLIC_` twin is unset or `false` while the server-side feature resolves on. A workspace follows the server, but the login page renders before any workspace loads and reads the twin, and the Sandbox selector does too. Set both. On a Compose install or source checkout, `npx sim-setup doctor` reports a twin that disagrees with its server flag; for Sandboxes it compares `NEXT_PUBLIC_SANDBOXES_ENABLED` with the selected provider's readiness instead. **The feature is on but has no effect inside a workspace.** The workspace is not owned by an organization. Check `workspace_mode` and `organization_id`: diff --git a/apps/docs/content/docs/platform/self-hosting/environment-variables.mdx b/apps/docs/content/docs/platform/self-hosting/environment-variables.mdx index ff79c7a306a..53a241d7d41 100644 --- a/apps/docs/content/docs/platform/self-hosting/environment-variables.mdx +++ b/apps/docs/content/docs/platform/self-hosting/environment-variables.mdx @@ -144,7 +144,7 @@ Who may sign up and sign in — the allowlists, blocklists, `DISABLE_REGISTRATIO | `E2B_FUNCTION_TEMPLATE_GENERATION` | Monotonic release generation printed by the same build. Required for E2B | | `DAYTONA_FUNCTION_SNAPSHOT_ID` | Immutable snapshot **ID** (not a name) for the Function base image. Required for Daytona | | `E2B_PI_TEMPLATE_ID` / `DAYTONA_PI_SNAPSHOT_ID` | The image Pi runs on. Separate from the Function base — configuring the provider and Function image alone leaves Pi failing closed | -| `SANDBOXES_ENABLED` / `NEXT_PUBLIC_SANDBOXES_ENABLED` | Enable custom sandboxes on a self-hosted deployment, bypassing the hosted-plan requirement. Neither is sufficient on its own — a provider key **and** an immutable Function base must also be configured. Set the `NEXT_PUBLIC_` twin only after the server side works; it enables nothing by itself — it reveals the Function block's Sandbox selector and lets `npx sim-setup doctor` confirm the two sides agree | +| `SANDBOXES_ENABLED` / `NEXT_PUBLIC_SANDBOXES_ENABLED` | Enable custom sandboxes on a self-hosted deployment, bypassing the hosted-plan requirement. Neither is sufficient on its own — a provider key **and** an immutable Function base must also be configured. Set the `NEXT_PUBLIC_` twin only after the server side works; it enables nothing by itself — it reveals the Function block's Sandbox selector, and on a Compose install or source checkout `npx sim-setup doctor` confirms it agrees with the selected provider's readiness | | `IVM_MAX_EXECUTIONS_PER_WORKER` | Executions before an isolated-vm worker is recycled | | `IVM_MAX_BROKERS_PER_EXECUTION` | Host-call brokers per execution | | `IVM_MAX_BROKER_ARGS_JSON_CHARS` | Max argument payload size | diff --git a/apps/docs/content/docs/platform/self-hosting/sandboxes.mdx b/apps/docs/content/docs/platform/self-hosting/sandboxes.mdx index 6efdbc1e5f1..753a23120c6 100644 --- a/apps/docs/content/docs/platform/self-hosting/sandboxes.mdx +++ b/apps/docs/content/docs/platform/self-hosting/sandboxes.mdx @@ -15,9 +15,9 @@ Until the base image is configured, those languages fail with an explicit config | Variable | Purpose | | --- | --- | | `SANDBOXES_ENABLED` | Grants the server-side self-hosted entitlement | -| `NEXT_PUBLIC_SANDBOXES_ENABLED` | Browser gate for the Function block's Sandbox selector. An assertion of provider readiness, not a check; `npx sim-setup doctor` compares it with the selected provider's readiness | +| `NEXT_PUBLIC_SANDBOXES_ENABLED` | Browser gate for the Function block's Sandbox selector. An assertion of provider readiness, not a check; on a Compose install or source checkout, `npx sim-setup doctor` compares it with the selected provider's readiness | -Shell follows the server: a workspace offers it only when the deployment is entitled — `SANDBOXES_ENABLED`, or the `ENTERPRISE_ENABLED` master switch — and the server has verified the provider credentials and an immutable Function base. **Settings → Sandboxes** stays in the sidebar either way, but shows an upgrade notice instead of the sandbox list until that check passes. `NEXT_PUBLIC_SANDBOXES_ENABLED` is a browser gate for one control, the Function block's Sandbox selector. Whether Python or a selected sandbox actually runs depends on the server-side provider and Function image, so set it only after those work, or you surface a selector for sandboxes that cannot run. +Shell follows the server: a workspace offers it only when the Sandbox entitlement resolves on — `SANDBOXES_ENABLED=true`, or the `ENTERPRISE_ENABLED` master switch with `SANDBOXES_ENABLED` left unset — and the server has verified the provider credentials and an immutable Function base. **Settings → Sandboxes** stays in the sidebar either way, but shows an upgrade notice instead of the sandbox list until that check passes. `NEXT_PUBLIC_SANDBOXES_ENABLED` is a browser gate for one control, the Function block's Sandbox selector. Whether Python or a selected sandbox actually runs depends on the server-side provider and Function image, so set it only after those work, or you surface a selector for sandboxes that cannot run. ## Building the Function base diff --git a/apps/docs/content/docs/platform/self-hosting/security.mdx b/apps/docs/content/docs/platform/self-hosting/security.mdx index e743135d222..eab3843b548 100644 --- a/apps/docs/content/docs/platform/self-hosting/security.mdx +++ b/apps/docs/content/docs/platform/self-hosting/security.mdx @@ -133,9 +133,9 @@ Workflows can execute user-authored JavaScript and Python. Know which sandbox yo Python, Shell, JavaScript with external imports, and tooling-dependent blocks require a remote sandbox provider. On a billing-free self-host the provider and Function base are not sufficient on their own: `SANDBOXES_ENABLED` grants the -server-side entitlement (so does the `ENTERPRISE_ENABLED` master switch), and without that -entitlement a workspace offers no Shell language and the Sandboxes settings page shows an -upgrade notice even when the provider is configured correctly. JavaScript without `import` or `require` +server-side entitlement (so does the `ENTERPRISE_ENABLED` master switch when `SANDBOXES_ENABLED` +is left unset), and without that entitlement a workspace offers no Shell language and the +Sandboxes settings page shows an upgrade notice even when the provider is configured correctly. JavaScript without `import` or `require` continues to run in the in-process isolate when no remote provider is configured.