PR Summary

Medium Risk
Adds a new third-party AI integration plus an internal API route that downloads/encodes user-provided media and forwards requests to VoyageAI; failures could impact workflows and the proxy route increases exposure to input-validation/SSRF and payload-size edge cases.

Overview
Adds a new Voyage AI block with an operation selector to run text embeddings, multimodal embeddings (text + image/video via uploads or URLs), or rerank, mapping block inputs to the appropriate tool params.

Registers three new tools (voyageai_embeddings, voyageai_multimodal_embeddings, voyageai_rerank) and implements their request/response shaping, including a new internal Next.js route (/api/tools/voyageai/multimodal-embeddings) that authenticates internal calls, validates URLs, downloads uploaded media when needed, base64-encodes it, and forwards to VoyageAI’s multimodalembeddings API.

Adds a new VoyageAIIcon, extensive unit tests for the block/tool param mapping, and optional live integration tests gated by VOYAGEAI_API_KEY; also updates .gitignore to ignore .playwright-mcp/.

^{Reviewed by Cursor Bugbot for commit 6394764. Bugbot is set up for automated code reviews on this repo. Configure here.}

@fzowl is attempting to deploy a commit to the Sim Team on Vercel.

A member of the Team first needs to authorize it.

️✅ There are no secrets present in this pull request anymore.

If these secrets were true positive and are still valid, we highly recommend you to revoke them.
While these secrets were previously flagged, we no longer have a reference to the
specific commits where they were detected. Once a secret has been leaked into a git
repository, you should consider it compromised, even if it was deleted immediately.
Find here more information about risks.

^{_{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}}

Greptile Summary

This PR adds a VoyageAI integration covering text embeddings, multimodal embeddings (images + video via an internal proxy route), and document reranking, with matching block, registry entries, and a comprehensive test suite.

Two issues need attention before merge:

• canonicalParamId equals the subblock's own id for both imageFiles and videoFile subblocks in voyageai.ts, violating the documented critical constraint that could cause params to be dropped during canonical transformation.
• transformResponse in embeddings.ts and rerank.ts does not check response.ok, so non-2xx API responses (e.g. 401, 429) produce a cryptic TypeError: Cannot read properties of undefined instead of surfacing the actual VoyageAI error message.

Confidence Score: 3/5

Two P1 issues — canonicalParamId constraint violation and missing response.ok guards — should be fixed before merging.

The canonicalParamId === id violation is a documented critical rule that may cause the canonical param transformation layer to drop file input values at runtime. The missing response.ok check means real API errors (invalid key, rate limit) produce opaque TypeErrors rather than actionable messages. Both are present on the changed code paths and need resolution.

apps/sim/blocks/blocks/voyageai.ts (canonicalParamId constraint), apps/sim/tools/voyageai/embeddings.ts and rerank.ts (response error handling)

Important Files Changed

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[VoyageAI Block] --> B{Operation}
    B -->|embeddings| C[embeddingsTool]
    B -->|rerank| D[rerankTool]
    B -->|multimodal| E[multimodalEmbeddingsTool]
    C -->|POST direct| F[VoyageAI Embeddings API]
    D -->|POST direct| G[VoyageAI Rerank API]
    E -->|POST proxy| H[Internal Multimodal Route]
    H --> I{Content type}
    I -->|Text| J[content: text]
    I -->|imageFiles| K[base64 encode via storage]
    I -->|imageUrls| L[validateUrlWithDNS]
    I -->|videoFile| M[base64 encode via storage]
    I -->|videoUrl| N[validateUrlWithDNS]
    J & K & L & M & N --> O[VoyageAI Multimodal API]
    F & G & O --> P[embeddings / results / usage]

_{Reviews (1): Last reviewed commit: "revert: drop all MongoDB connection stri..." | Re-trigger Greptile}