feat(managed-agent): Claude Platform Managed Agents workflow blocks

[rdematos]

Summary

Ship two workflow blocks that let a workflow author invoke a Claude Platform Managed Agent (cloud or self-hosted) as a first-class node, plus the workspace-scoped connection layer that stores the linked Anthropic API key.

Blocks

• Claude Managed Agents (managed_agent_cloud) — cloud environments. Session-create payload carries agent, environment_id, vault_ids, resources (memory + files) and free-form metadata tags.
• Claude Managed Agents (self-hosted) (managed_agent_self_hosted) — self-hosted environments. Session metadata is forwarded as env vars to the deployer's self-hosted agent sandbox; memory fields are gated behind NEXT_PUBLIC_MANAGED_AGENT_SELF_HOSTED_MEMORY_ENABLED (Claude self-hosted environments do not currently support memory-store resource attach on the session API). Default seed rows for the Session-parameters table come from NEXT_PUBLIC_MANAGED_AGENT_SELF_HOSTED_DEFAULTS (JSON); seeded keys stay out of source so the block is deployment-neutral in the public tree.

Connections

• New managed_agent_connection table (workspace-scoped, encrypted API key). All CRUD paths go through getUserEntityPermissions(userId, 'workspace', workspaceId); admin/write to create, rotate, or delete; any workspace member can list/browse. Plaintext keys never cross the client boundary — list responses return only a masked preview.
• Settings surface under settings/components/managed-agents/ lets admins add / rotate / remove connections with an inline Anthropic-API verify (GET /v1/agents).
• 8 server routes proxy the Claude Platform read endpoints (agents, environments, memory stores, vaults, environment detail) so the block picker resolves options against the linked workspace.

Tool + session client

• tools/managed_agent/run_session.ts (client-safe skeleton) + run_session.server.ts (server-only impl, self-registered on boot via globalThis so the client bundle never pulls postgres / fs / encryption). Reconnect + events.list catch-up loop matches the docs' two-step session lifecycle.
• lib/managed-agents/session-client.ts — reusable HTTP client that shapes the cloud vs. self-hosted request bodies.
• tools/managed_agent/normalizers.ts — pure input normalizers that coerce the block's runtime shapes (table rows, JSON strings, flat objects, comma-lists) into typed values.

Node UX

• Optional BlockConfig.nodeWidth (default 250, MA blocks use 400) threaded through calculateWorkflowBlockDimensions for both the workflow-block hook and autolayout so long Anthropic IDs aren't ellipsis-truncated in the collapsed row.
• Friendly-name hydration on the collapsed row resolves connection / agent / environment / vault / memory-store IDs to human labels via the React Query hooks. New blockType prop on SubBlockRow gates the lookup.
• New optional defaultRows prop on the Table subblock so any block can seed a fresh table with initial rows.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation
• Other: ___________

Testing

Added 86 tests across 5 files, following the repo's patterns (@vitest-environment node, vi.hoisted + vi.mock + static imports, @sim/testing helpers):

• tools/managed_agent/normalizers.test.ts (27) — every shape the block subblocks hand off + bad-input paths.
• lib/managed-agents/session-client.test.ts (17) — cloud vs. self-hosted branch: memory routing (resource vs. metadata), file resources cloud-only, vault_ids only when non-empty, user metadata does not overwrite memory keys, envType-omitted default.
• lib/managed-agents/connections.test.ts (17) — CRUD via captured DB-chain args: encryption on write (plaintext never lands in row), masking on read, workspace-scoped WHERE on every op, verify gate blocks persistence, error truncation to 500 chars.
• app/api/managed-agent-connections/route.test.ts (15) — permission gates on GET/POST/DELETE: 401 unauthenticated, 400 missing params, 403 read-tier callers on create/delete, 404 for missing rows, plaintext never in POST response, both write and admin accepted.
• blocks/blocks/managed_agent_self_hosted.test.ts (10) — env-driven readSessionMetadataDefaults and isSelfHostedMemoryEnabled (truthy/falsy/whitespace forms).

Reviewer focus: (1) the client/server split in run_session*.ts — confirm no server-only deps leak into the client bundle; (2) the workspace-scoped permission checks on every connection CRUD path; (3) that plaintext API keys never cross the client boundary.

Run locally: bun run type-check, bun run test, bun run check:api-validation.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

Screenshots/Videos

Documentation
New env vars documented in apps/sim/.env.example: MANAGED_AGENT_DEBUG_PAYLOAD, NEXT_PUBLIC_MANAGED_AGENT_SELF_HOSTED_DEFAULTS, NEXT_PUBLIC_MANAGED_AGENT_SELF_HOSTED_MEMORY_ENABLED.

[vercel]

Someone is attempting to deploy a commit to the Sim Team on Vercel.

A member of the Team first needs to authorize it.

[cursor]

PR Summary

High Risk
Stores and decrypts third-party API keys, proxies authenticated calls to Anthropic, and runs long-lived agent sessions with vault acknowledgement gates—security-sensitive and operationally complex despite solid permission checks and tests.

Overview
Adds Claude Managed Agents as first-class workflow nodes (cloud and self-hosted variants) backed by workspace-linked Anthropic API keys.

Connections & API — New workspace-scoped connection storage (encrypted keys, masked in list responses) with Settings UI to link, rotate, and remove workspaces after GET /v1/agents verification. CRUD and proxy routes (agents, environments, vaults, memory stores) enforce session auth and workspace permissions; decrypted keys stay server-side.

Execution — Shared session-client builds cloud vs self-hosted POST /v1/sessions bodies (resources/metadata routing). The managed_agent_run_session tool runs sessions via a client/server split so server-only deps stay out of the bundle; direct execution gets workflow abort propagation and richer _context (block id/name).

Editor UX — Optional nodeWidth on blocks (400px for MA tiles), collapsed-row friendly-name hydration for connection/agent/env/vault/memory selectors, and Managed Agents in workspace settings navigation.

^{Reviewed by Cursor Bugbot for commit 8e9f8a1. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

Greptile Summary

This PR adds Claude Platform Managed Agents as workflow blocks. The main changes are:

• Workspace-scoped, encrypted Managed Agent connections and proxy APIs.
• Cloud and self-hosted session blocks with resource and metadata normalization.
• Session creation, SSE streaming, reconnect, and event catch-up support.
• Settings UI, option hydration, wider nodes, and seeded table rows.
• Database schema, environment configuration, and test coverage.

Confidence Score: 4/5

Active Anthropic streams can outlive cancelled workflows, and connection decryption can bypass the normal tool response path. Public self-hosted defaults can also disclose sensitive values.

• Workspace authorization and database scoping are consistently applied.
• Cancellation is not forwarded to the SSE request or reader.
• Undecryptable connection rows cause an unhandled tool rejection.
• Public session defaults are visible in browser bundles.

apps/sim/tools/managed_agent/run_session.server.ts; apps/sim/blocks/blocks/managed_agent_self_hosted.ts

Security Review

Self-hosted session defaults come from a NEXT_PUBLIC_* variable, so every configured value is shipped in the client bundle. Credentials or other secrets placed there are exposed to browser clients.

Important Files Changed

Filename	Overview
apps/sim/tools/managed_agent/run_session.server.ts	Adds server-side session execution and reconnect handling, but cancellation is dropped and decryption can reject outside the tool response path.
apps/sim/lib/managed-agents/connections.ts	Adds encrypted, workspace-scoped persistence with composite workspace predicates and masked client responses.
apps/sim/lib/managed-agents/session-client.ts	Adds Managed Agents HTTP and payload handling for cloud and self-hosted sessions.
apps/sim/blocks/blocks/managed_agent_self_hosted.ts	Adds the self-hosted block and deployment defaults, whose public environment source can expose sensitive values.
apps/sim/app/api/managed-agent-connections/route.ts	Adds authenticated connection listing, creation, and deletion with workspace permission checks.

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
  participant W as Workflow executor
  participant T as Managed Agent tool
  participant DB as Connection store
  participant A as Anthropic API
  W->>T: Run block with workspace context
  T->>DB: Load and decrypt connection
  DB-->>T: API key
  T->>A: Create session
  T->>A: Send user message
  T->>A: Open SSE stream
  loop Reconnect and catch up
    A-->>T: Session events
    T->>A: List events after cursor
  end
  T-->>W: Content and session status

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
  participant W as Workflow executor
  participant T as Managed Agent tool
  participant DB as Connection store
  participant A as Anthropic API
  W->>T: Run block with workspace context
  T->>DB: Load and decrypt connection
  DB-->>T: API key
  T->>A: Create session
  T->>A: Send user message
  T->>A: Open SSE stream
  loop Reconnect and catch up
    A-->>T: Session events
    T->>A: List events after cursor
  end
  T-->>W: Content and session status

Loading

_{Reviews (1): Last reviewed commit: "feat(managed-agent): Claude Platform Man..." | Re-trigger Greptile}

[greptile-apps]

Cancellation Leaves Stream Running

The workflow abort signal is not passed to openSessionStream or readSSEEvents. When a workflow is cancelled or times out while Anthropic keeps the stream open, this invocation continues reading and processing events in the background instead of releasing the HTTP connection.

[greptile-apps]

Decryption Error Escapes Tool Contract

getDecryptedApiKey throws when stored ciphertext cannot be decrypted, such as after an encryption-key rotation, and this call occurs before the session error-handling block. The tool promise rejects instead of returning its declared success: false response, so the workflow receives an unhandled execution failure rather than an actionable connection error.

[cursor]

Empty table shows phantom row

Medium Severity

The mount effect no longer seeds when the subblock store is [], but the rows memo still synthesizes a default row whenever the value array is empty. After an author clears every row, the UI can show an editable row that is not persisted in the store, which conflicts with the new “empty array is intentional” rule and can confuse session-parameter input.

 

^{Reviewed by Cursor Bugbot for commit b8e5039. Configure here.}

[cursor]

Rotate connection hook unused

Low Severity

useRotateManagedAgentConnection is exported and wired to the PATCH rotate route, but nothing in the settings UI or elsewhere imports or calls it, so key rotation is only partially shipped.

 

^{Reviewed by Cursor Bugbot for commit b8e5039. Configure here.}

[cursor]

Async seed race on save

Low Severity

When fetchDefaultRows is async, a quick save or navigation after opening the block can persist workflow state before defaults land in the subblock store, leaving Session parameters empty even though the author opened the table once.

 

^{Reviewed by Cursor Bugbot for commit 2766139. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

There are 4 total unresolved issues (including 3 from previous reviews).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 8e9f8a1. Configure here.}

[cursor]

Wrong beta for memory stores

High Severity

proxyManagedAgentsGet always sends anthropic-beta: managed-agents-2026-04-01, including for GET /v1/memory_stores. Anthropic’s Memory Stores API requires agent-memory-2026-07-22, so the Memory Store combobox proxy fails and the cloud block cannot list stores.

Additional Locations (1)

• apps/sim/app/api/managed-agent-connections/[id]/memory-stores/route.ts#L77-L80

 

^{Reviewed by Cursor Bugbot for commit 8e9f8a1. Configure here.}