fix(bitbucket): stop advanced-field leakage and harden log, status, and selector paths

Splits the `closeSourceBranch` advanced subBlock into per-operation ids. Advanced
fields serialize without evaluating their condition, so a value set on Create Pull
Request reached Merge Pull Request and closed the source branch unprompted.

Also:
- read step logs through the byte-capped server transport and map an empty-log 416
  to an empty result, keeping a genuine 416 an error
- trim a step log's partial leading line after the character cap rather than before,
  and never return an empty log when the retained window held content
- surface Bitbucket's `error.detail` alongside `error.message`
- treat commit-status `key`/`state` as nullable so one malformed row cannot drop a page
- match repository `full_name` case-insensitively and reject dot segments in a
  workspace slug before the outbound request
- type `reviewerAccountIds` as the comma-separated string it is
- trim optional Bitbucket query strings; correct the token lifetime to two hours

Author: waleedlatif1

apps/sim/app/api/tools/bitbucket/repositories/route.test.ts

@@ -276,6 +276,38 @@ describe('POST /api/tools/bitbucket/repositories', () => {
     expect(response.status).toBe(502)
   })
 
+  it('accepts a case-mismatched workspace slug the way Bitbucket itself resolves it', async () => {
+    mockFetch.mockResolvedValueOnce(
+      providerResponse({
+        values: [
+          {
+            slug: 'sdk-core',
+            uuid: '{repo-1}',
+            name: 'SDK Core',
+            full_name: 'acme-platform/sdk-core',
+          },
+        ],
+        next: 'https://api.bitbucket.org/2.0/repositories/acme-platform?page=2',
+      })
+    )
+
+    const response = await POST(request({ ...REQUEST_BODY, workspaceSlug: 'ACME-Platform' }), {})
+
+    expect(response.status).toBe(200)
+    expect(await json(response)).toMatchObject({
+      repositories: [{ slug: 'sdk-core', fullName: 'acme-platform/sdk-core' }],
+    })
+  })
+
+  it('rejects a workspace slug containing dot segments before it reaches Bitbucket', async () => {
+    for (const workspaceSlug of ['.', '..', 'acme.platform']) {
+      const response = await POST(request({ ...REQUEST_BODY, workspaceSlug }), {})
+
+      expect(response.status, workspaceSlug).toBe(400)
+      expect(mockFetch).not.toHaveBeenCalled()
+    }
+  })
+
   it('rejects a provider next link that crosses the selected workspace', async () => {
     mockFetch.mockResolvedValueOnce(
       providerResponse({

apps/sim/app/api/tools/bitbucket/repositories/route.ts

@@ -145,11 +145,14 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
     )
   }
 
+  const expectedFullNamePrefix = workspaceSlug.toLowerCase()
   const page = bitbucketRepositoryProviderPageSchema.safeParse(providerBody)
   if (
     !page.success ||
     (page.data.next && !isBitbucketRepositoriesCursor(page.data.next, workspaceSlug)) ||
-    page.data.values.some((repository) => !repository.full_name.startsWith(`${workspaceSlug}/`))
+    page.data.values.some(
+      (repository) => !repository.full_name.toLowerCase().startsWith(`${expectedFullNamePrefix}/`)
+    )
   ) {
     logger.warn('Bitbucket returned a malformed repository page', { workspaceSlug })
     return NextResponse.json(

apps/sim/blocks/blocks/bitbucket.test.ts

@@ -65,7 +65,8 @@ const SAMPLE_VALUES: Record<string, unknown> = {
   destinationBranch: 'main',
   description: 'Adds bounded log diagnostics.',
   reviewerAccountIds: '{reviewer-a}, {reviewer-b}',
-  closeSourceBranch: 'true',
+  createCloseSourceBranch: 'true',
+  mergeCloseSourceBranch: 'true',
   draft: 'true',
   mergeStrategy: 'squash',
   message: 'Merge pull request 42',
@@ -294,6 +295,20 @@ describe('BitbucketBlock', () => {
     expect(() => buildRequestUrl('bitbucket_decline_pull_request', { prId })).toThrow(/prId/)
   })
 
+  it('does not let a create-pull-request close setting reach a merge', () => {
+    const merged = buildRequestBody('bitbucket_merge_pull_request', {
+      createCloseSourceBranch: 'true',
+      mergeCloseSourceBranch: '',
+    }) as Record<string, unknown>
+    expect(merged).not.toHaveProperty('close_source_branch')
+
+    const created = buildRequestBody('bitbucket_create_pull_request', {
+      createCloseSourceBranch: '',
+      mergeCloseSourceBranch: 'true',
+    }) as Record<string, unknown>
+    expect(created).not.toHaveProperty('close_source_branch')
+  })
+
   it('does not turn a malformed optional parent ID into a top-level comment', () => {
     expect(() =>
       buildRequestBody('bitbucket_create_pull_request_comment', { parentId: { id: 7 } })
@@ -303,7 +318,7 @@ describe('BitbucketBlock', () => {
   it('preserves explicit false booleans and rejects other present boolean shapes', () => {
     expect(
       buildRequestBody('bitbucket_create_pull_request', {
-        closeSourceBranch: false,
+        createCloseSourceBranch: false,
         draft: 'false',
       })
     ).toMatchObject({ close_source_branch: false, draft: false })

apps/sim/blocks/blocks/bitbucket.ts

@@ -599,15 +599,25 @@ export const BitbucketBlock: BlockConfig = {
       placeholder: 'Comma-separated Bitbucket user UUIDs',
     },
     {
-      id: 'closeSourceBranch',
+      id: 'createCloseSourceBranch',
       title: 'Close Source Branch',
       type: 'dropdown',
       mode: 'advanced',
-      condition: {
-        field: 'operation',
-        value: ['bitbucket_create_pull_request', 'bitbucket_merge_pull_request'],
-      },
+      condition: { field: 'operation', value: 'bitbucket_create_pull_request' },
       options: [
+        { label: 'Unset', id: '' },
+        { label: 'No', id: 'false' },
+        { label: 'Yes', id: 'true' },
+      ],
+    },
+    {
+      id: 'mergeCloseSourceBranch',
+      title: 'Close Source Branch',
+      type: 'dropdown',
+      mode: 'advanced',
+      condition: { field: 'operation', value: 'bitbucket_merge_pull_request' },
+      options: [
+        { label: 'Unset', id: '' },
         { label: 'No', id: 'false' },
         { label: 'Yes', id: 'true' },
       ],
@@ -955,7 +965,10 @@ export const BitbucketBlock: BlockConfig = {
               destinationBranch: optionalString(params.destinationBranch, 'destinationBranch'),
               description: optionalText(params.description, 'description'),
               reviewerUuids: stringList(params.reviewerAccountIds, 'reviewerAccountIds'),
-              closeSourceBranch: optionalBoolean(params.closeSourceBranch, 'closeSourceBranch'),
+              closeSourceBranch: optionalBoolean(
+                params.createCloseSourceBranch,
+                'createCloseSourceBranch'
+              ),
               draft: optionalBoolean(params.draft, 'draft'),
             }
           case 'bitbucket_merge_pull_request':
@@ -964,7 +977,10 @@ export const BitbucketBlock: BlockConfig = {
               prId: optionalInteger(params.prId, 'prId'),
               mergeStrategy: optionalString(params.mergeStrategy, 'mergeStrategy'),
               message: optionalText(params.message, 'message'),
-              closeSourceBranch: optionalBoolean(params.closeSourceBranch, 'closeSourceBranch'),
+              closeSourceBranch: optionalBoolean(
+                params.mergeCloseSourceBranch,
+                'mergeCloseSourceBranch'
+              ),
             }
           case 'bitbucket_get_pull_request_merge_task_status':
             return {
@@ -1045,8 +1061,18 @@ export const BitbucketBlock: BlockConfig = {
     sourceBranch: { type: 'string', description: 'Pull request source branch' },
     destinationBranch: { type: 'string', description: 'Pull request destination branch' },
     description: { type: 'string', description: 'Pull request description' },
-    reviewerAccountIds: { type: 'array', description: 'Reviewer Bitbucket user UUIDs' },
-    closeSourceBranch: { type: 'boolean', description: 'Whether to close the source branch' },
+    reviewerAccountIds: {
+      type: 'string',
+      description: 'Comma-separated reviewer Bitbucket user UUIDs',
+    },
+    createCloseSourceBranch: {
+      type: 'boolean',
+      description: 'Whether to close the source branch after the pull request merges',
+    },
+    mergeCloseSourceBranch: {
+      type: 'boolean',
+      description: 'Whether to close the source branch as part of this merge',
+    },
     draft: { type: 'boolean', description: 'Whether to create a draft pull request' },
     mergeStrategy: { type: 'string', description: 'Pull request merge strategy' },
     message: { type: 'string', description: 'Merge commit message' },

apps/sim/lib/api/contracts/selectors/bitbucket.ts

@@ -22,8 +22,11 @@ const bitbucketSlugSchema = z
 const bitbucketWorkspaceUuidPattern =
   /^(?:\{[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\}|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/i
 
+/** Bitbucket workspace ids are alphanumeric with hyphens and underscores only. */
+const bitbucketWorkspaceSlugPattern = /^[a-z0-9][a-z0-9_-]*$/i
+
 const bitbucketWorkspaceSlugSchema = bitbucketSlugSchema.refine(
-  (slug) => !slug.includes('/') && !bitbucketWorkspaceUuidPattern.test(slug),
+  (slug) => bitbucketWorkspaceSlugPattern.test(slug) && !bitbucketWorkspaceUuidPattern.test(slug),
   'Bitbucket workspace must be identified by its slug, not a UUID or path'
 )
 
@@ -66,7 +69,8 @@ export function isBitbucketWorkspacesCursor(value: string): boolean {
  */
 export function isBitbucketRepositoriesCursor(value: string, workspaceSlug: string): boolean {
   const url = parseBitbucketApiCursor(value)
-  return url?.pathname === `${BITBUCKET_REPOSITORIES_PATH}/${encodeURIComponent(workspaceSlug)}`
+  const expected = `${BITBUCKET_REPOSITORIES_PATH}/${encodeURIComponent(workspaceSlug)}`
+  return url?.pathname.toLowerCase() === expected.toLowerCase()
 }
 
 const bitbucketCursorSchema = z

apps/sim/lib/auth/connectors/providers.ts

@@ -1485,7 +1485,7 @@ export function buildConnectorProviders(): GenericOAuthConfig[] {
       responseType: 'code',
       pkce: false,
       authentication: 'basic',
-      accessTokenExpiresIn: 3600,
+      accessTokenExpiresIn: 7200,
       redirectURI: `${getBaseUrl()}/api/auth/oauth2/callback/bitbucket`,
       getToken: async ({ code, redirectURI }) => {
         const basicAuth = Buffer.from(

apps/sim/lib/oauth/oauth.test.ts

@@ -114,7 +114,7 @@ function getBitbucketConnector() {
 }
 
 describe('Bitbucket OAuth Connector', () => {
-  it('uses the canonical endpoints, scopes, Basic auth, and one-hour expiry', () => {
+  it('uses the canonical endpoints, scopes, Basic auth, and two-hour expiry', () => {
     expect(getBitbucketConnector()).toMatchObject({
       providerId: 'bitbucket',
       authorizationUrl: 'https://bitbucket.org/site/oauth2/authorize',
@@ -132,7 +132,7 @@ describe('Bitbucket OAuth Connector', () => {
       responseType: 'code',
       pkce: false,
       authentication: 'basic',
-      accessTokenExpiresIn: 3600,
+      accessTokenExpiresIn: 7200,
       redirectURI: 'http://localhost:3000/api/auth/oauth2/callback/bitbucket',
     })
   })

apps/sim/tools/bitbucket/get_merge_task_status.ts

@@ -61,9 +61,11 @@ export const bitbucketGetMergeTaskStatusTool: ToolConfig<
   transformResponse: async (response) => {
     const data = await bitbucketJson(response)
     if (data.type === 'error') {
-      const message = stringField(record(data.error)?.message)
-      if (!message?.trim()) throw new Error('Bitbucket returned a malformed merge task error')
-      throw new Error(message)
+      const error = record(data.error)
+      const message = stringField(error?.message)?.trim()
+      if (!message) throw new Error('Bitbucket returned a malformed merge task error')
+      const detail = stringField(error?.detail)?.trim()
+      throw new Error(detail && detail !== message ? `${message}: ${detail}` : message)
     }
 
     const taskStatus = data.task_status

apps/sim/tools/bitbucket/get_pipeline_step_log.ts

@@ -3,12 +3,15 @@ import type {
   BitbucketToolResponse,
 } from '@/tools/bitbucket/types'
 import {
+  assertBitbucketResponseOk,
   BITBUCKET_API_BASE,
   BITBUCKET_DEFAULT_LOG_CHARACTERS,
   BITBUCKET_ERROR_EXTRACTOR,
+  BITBUCKET_LOG_TRANSFER_MAX_BYTES,
   BITBUCKET_READ_RETRY,
   BITBUCKET_REPOSITORY_PARAMS,
   bitbucketHeaders,
+  bitbucketMaxCharacters,
   bitbucketRawTail,
   bitbucketRepositoryPath,
   bitbucketTailRange,
@@ -22,6 +25,15 @@ interface BitbucketPipelineLogOutput {
   totalBytes: number | null
 }
 
+/** A suffix range against an empty log is unsatisfiable; Bitbucket answers 416 rather than 200. */
+const BITBUCKET_RANGE_NOT_SATISFIABLE = 416
+/** RFC 7233 unsatisfied-range header for a zero-length log; any other 416 is a genuine failure. */
+const EMPTY_CONTENT_RANGE_PATTERN = /^bytes \*\/0$/
+
+function stepLogUrl(params: BitbucketGetPipelineStepLogParams): string {
+  return `${BITBUCKET_API_BASE}${bitbucketRepositoryPath(params.workspaceSlug, params.repoSlug)}/pipelines/${encodeBitbucketSegment(params.pipelineUuid, 'pipelineUuid')}/steps/${encodeBitbucketSegment(params.stepUuid, 'stepUuid')}/log`
+}
+
 export const bitbucketGetPipelineStepLogTool: ToolConfig<
   BitbucketGetPipelineStepLogParams,
   BitbucketToolResponse<BitbucketPipelineLogOutput>
@@ -53,9 +65,30 @@ export const bitbucketGetPipelineStepLogTool: ToolConfig<
       default: BITBUCKET_DEFAULT_LOG_CHARACTERS,
     },
   },
+  directExecution: async (params, signal) => {
+    bitbucketMaxCharacters(params.maxCharacters, true)
+    const { secureBitbucketRead } = await import('@/tools/bitbucket/utils.server')
+    const response = await secureBitbucketRead(
+      stepLogUrl(params),
+      bitbucketHeaders(params.accessToken, {
+        json: false,
+        range: bitbucketTailRange(params.maxCharacters),
+      }),
+      BITBUCKET_LOG_TRANSFER_MAX_BYTES,
+      { stripAuthOnRedirect: true, signal }
+    )
+    if (
+      response.status === BITBUCKET_RANGE_NOT_SATISFIABLE &&
+      EMPTY_CONTENT_RANGE_PATTERN.test(response.headers.get('content-range') ?? '')
+    ) {
+      await response.body?.cancel()
+      return { success: true, output: { log: '', truncated: false, totalBytes: 0 } }
+    }
+    await assertBitbucketResponseOk(response)
+    return { success: true, output: await bitbucketRawTail(response, params.maxCharacters) }
+  },
   request: {
-    url: (params) =>
-      `${BITBUCKET_API_BASE}${bitbucketRepositoryPath(params.workspaceSlug, params.repoSlug)}/pipelines/${encodeBitbucketSegment(params.pipelineUuid, 'pipelineUuid')}/steps/${encodeBitbucketSegment(params.stepUuid, 'stepUuid')}/log`,
+    url: stepLogUrl,
     method: 'GET',
     headers: (params) =>
       bitbucketHeaders(params.accessToken, {
@@ -65,10 +98,9 @@ export const bitbucketGetPipelineStepLogTool: ToolConfig<
     retry: BITBUCKET_READ_RETRY,
     stripAuthOnRedirect: true,
   },
-  transformResponse: async (response, params) => ({
-    success: true,
-    output: await bitbucketRawTail(response, params?.maxCharacters),
-  }),
+  transformResponse: async () => {
+    throw new Error('Bitbucket step-log reads require the byte-capped direct execution path')
+  },
   outputs: {
     log: { type: 'string', description: 'Bounded trailing UTF-8 log text' },
     truncated: { type: 'boolean', description: 'Whether earlier log output was omitted' },