GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — fix(tools): bind schema-enrichment reads to executor delegations by waleedlatif1 · Pull Request #6593 · simstudioai/sim

Conversation

@waleedlatif1

@waleedlatif1 waleedlatif1 commented Aug 12, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • tools/params.ts still called the deprecated buildAuthHeaders() (no subject) to read a child workflow, so /api/workflows/[id] — now on internalWorkflowReadAuth — rejected the legacy type: 'internal' token with a 401. The Agent block's workflow_executor inputMapping was left as an untyped { type: 'object' }, so the model guessed the child's field names and lazyCleanupInputMapping silently dropped the wrong keys.
  • tools/schema-enrichers.ts had the same break against /api/knowledge/[id]/tag-definitions. Worse blast radius: when an enricher returns null the parameter is dropped from the schema entirely, so knowledge_search / create_document / upsert_document lost tag filtering altogether.
  • Both now use buildExecutorDelegationHeaders, bound to the acting execution subject.
  • Extracted the executionId binding rule into executor/utils/delegation.ts — it was hand-rolled in three places. A child workflow binds on its own id, so forwarding the parent's executionId would assert a run that doesn't cover it.

Regression from #5273, which migrated the routes and the sibling call sites but missed these two. git diff origin/main -- apps/sim/tools/params.ts was empty. Audited every remaining buildAuthHeaders caller — the rest target routes still on legacy auth, so no other mismatch remains.

Type of Change

  • Bug fix

Testing

  • New tests assert the delegation binding and the resulting properties/required schema. Verified they fail against the pre-fix code (2 failures in params.test.ts, 3 in schema-enrichers.test.ts) — the existing inputMapping always included test sat on this path but asserted only type === 'object', which holds in the broken state, so it could not fail.
  • bunx vitest run tools/ providers/ executor/ — 5,981 passing.
  • Repo-wide lint:check and type-check (23/23 each), plus check:api-validation, monorepo-boundary and realtime-prune gates.
  • Not exercised against a live workspace: this path only runs server-side during a real agent run with a child workflow.

Checklist

  • Code follows project style guidelines
  • Self-reviewed my changes
  • Tests added/updated and passing
  • No new warnings introduced
  • I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
greptile-apps[bot] reacted with thumbs up emoji
All reactions
  • 👍 1 reaction
@waleedlatif1
fix(tools): bind schema-enrichment reads to executor delegations
4ebefe9 
Two schema-enrichment callers still sent the deprecated legacy internal JWT
to routes that moved onto delegation-only auth, so both 401'd and swallowed
the failure:

- tools/params.ts fetched a child workflow's input fields with an unsubjected
  buildAuthHeaders(), leaving the Agent block's workflow_executor inputMapping
  untyped so the model guessed the child's field names.
- tools/schema-enrichers.ts fetched KB tag definitions the same way, which
  dropped the tags/tagFilters parameter from the knowledge tools entirely.

Extract the executionId binding rule into executionScopeForTarget so the three
enrichment call sites share one definition.
@vercel

vercel Bot commented Aug 12, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment
Project Deployment Actions Updated (UTC)
docs Skipped Skipped Aug 12, 2026 4:20am

Request Review
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@cursor

cursor Bot commented Aug 12, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown

PR Summary

Medium Risk
Touches internal auth token binding for schema-enrichment API reads during agent runs. Incorrect executionId scoping could break enrichment or fail route authorization, though the change restores the intended delegation model with focused tests.

Overview
Restores LLM schema enrichment for child workflows and knowledge-base tags after those routes started rejecting legacy internal tokens.

fetchWorkflowInputFields and KB tag-definition reads now authenticate with buildExecutorDelegationHeaders bound to the acting subject, so workflow_executor inputMapping and KB tag filters populate again instead of silently degrading.

Extracts shared executionScopeForTarget so executionId is only forwarded when the target is the running workflow — child workflows bind on their own id. providers/utils adopts the same helper.

Reviewed by Cursor Bugbot for commit a939738. Configure here.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@waleedlatif1
improvement(tools): surface tag-definition read failures at error level
a939738 
Enrichment degrades silently by design, so the log line is the only signal a
credential break leaves. Drain the body on the failure path too.
@vercel
vercel Bot temporarily deployed to Preview August 12, 2026 04:20 Inactive
@greptile-apps

greptile-apps Bot commented Aug 12, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor

Greptile Summary

The PR replaces legacy internal authentication on workflow and knowledge schema-enrichment reads with executor delegations bound to the acting subject. It also centralizes execution-scope selection and adds regression coverage for same-workflow, child-workflow, missing-context, and rejected-read behavior.

  • Adds executionScopeForTarget to include a run ID only when it belongs to the delegation’s target workflow.
  • Uses scoped delegation headers for child-workflow input schemas and knowledge-base tag schemas.
  • Adds tests covering delegation claims and resulting enriched schema properties.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed
Filename Overview
apps/sim/executor/utils/delegation.ts Introduces a focused helper that prevents a parent run ID from being asserted against a child-workflow delegation.
apps/sim/providers/utils.ts Reuses the centralized execution-scope rule when fetching workflow metadata.
apps/sim/tools/params.ts Uses the acting execution subject for delegated workflow reads and enriches workflow-executor input mappings with child input fields.
apps/sim/tools/schema-enrichers.ts Migrates knowledge tag-definition enrichment to workflow-scoped executor delegation while retaining graceful fallback behavior.
apps/sim/executor/utils/delegation.test.ts Covers same-workflow, child-workflow, inactive-run, and missing-workflow delegation scopes.
apps/sim/tools/params.test.ts Verifies delegation claims and workflow input schema enrichment, including missing-subject and authorization-failure fallbacks.
apps/sim/tools/schema-enrichers.test.ts Verifies knowledge tag enrichment uses the acting subject and appropriate workflow execution binding.

Sequence Diagram

 
sequenceDiagram
  participant Exec as Workflow Executor
  participant Tool as Tool Schema Enricher
  participant Auth as Delegation Builder
  participant API as Internal API
  Exec->>Tool: Build schema with execution context
  Tool->>Auth: subjectUserId + target workflow
  alt Target is running workflow
    Tool->>Auth: Include executionId
  else Target is child workflow
    Tool->>Auth: Omit parent executionId
  end
  Auth-->>Tool: Scoped delegation headers
  Tool->>API: Read workflow or tag definitions
  API-->>Tool: Authorized enrichment data
  Tool-->>Exec: Enriched tool schema
Loading

Reviews (2): Last reviewed commit: "improvement(tools): surface tag-definiti..." | Re-trigger Greptile
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@waleedlatif1

waleedlatif1 commented Aug 12, 2026

Copy link
Copy Markdown
Collaborator Author

@greptile
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@waleedlatif1

waleedlatif1 commented Aug 12, 2026

Copy link
Copy Markdown
Collaborator Author

@cursor review
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@waleedlatif1
waleedlatif1 merged commit a61cbf7 into staging Aug 12, 2026
22 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@waleedlatif1
waleedlatif1 deleted the investigate/delegation-headers branch August 12, 2026 04:22
@waleedlatif1

waleedlatif1 commented Aug 12, 2026

Copy link
Copy Markdown
Collaborator Author

@greptile
greptile-apps[bot] reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@waleedlatif1

waleedlatif1 commented Aug 12, 2026

Copy link
Copy Markdown
Collaborator Author

@cursor review
cursor[bot] reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
cursor[bot]
cursor Bot reviewed Aug 12, 2026
View reviewed changes

@cursor cursor Bot left a comment

Copy link
Copy Markdown

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

Reviewed by Cursor Bugbot for commit a939738. Configure here.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
This was referenced Aug 12, 2026
test(table): pin the executor auth pairing on the table read route #6603
Merged
v0.8.0: desktop app, workflow UI, v2 endpoints #6606
Merged
@BillLeoutsakosvl346 BillLeoutsakosvl346 mentioned this pull request Sep 11, 2026
feat: add deterministic visual-change detection for PRs. #7742
Closed
6 of 10 tasks

This branch was previously deployed

1 inactive deployment
Preview — a939738c Deployed Aug 12, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cursor cursor[bot] cursor[bot] left review comments

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

1 participant

@waleedlatif1
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.