improvement(copilot): consolidate application adapters

[TheodoreSpeaks]

Summary

• consolidate trusted Copilot context validation, bounded principal creation, exact operation identity checks, and trusted file/table scope projection
• consume each domain operation registry and delegated service policy while calling the same domain application use cases
• remove unused table and knowledge principal constructors and centralize safe Copilot application error projection
• keep executor JWT/header delegation outside this in-process adapter; the merged scoped-header issuer remains authoritative
• keep v1 unchanged; domain PRs may need to rebase onto this foundation PR before final merge

Type of Change

• Improvement

Testing

• 97 focused Vitest tests across 18 files
• Sim and @sim/auth type-checks
• Biome on touched files
• strict API validation, full lint, block-registry check, and all 19 CI audits
• git diff --check

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 9, 2026 12:40am

[cursor]

PR Summary

High Risk
Changes authentication and authorization boundaries for Copilot tool execution across multiple domains; incorrect delegation or scope handling could allow privilege escalation or cross-workspace access.

Overview
Consolidates Copilot’s path into domain application use cases by replacing per-domain executors and scattered principal builders with createCopilotApplicationAdapter and shared application-delegation helpers (requireTrustedCopilotExecutionContext, createCopilotApplicationPrincipal).

The adapter enforces immutable operation registry membership (rejecting forged operation objects), delegated-service policy (e.g. copilot vs executor), trusted file/table scope projection (model tool input stays non-authoritative for resource scope), and principal identity/TTL/scope checks before requireAllowedWorkspacePrincipal runs.

Removes execute-workspace-use-case, workspace-application-delegation, and domain delegated-principal factories for knowledge/table; file/table/knowledge/MCP/skill/custom-tool entrypoints now wire through the adapter and domain delegation policies.

Centralizes Copilot-visible errors via messageForCopilotApplicationError (internal failures map to a generic retry message); the server tool handler logs full errors but returns only safe messages to the model.

^{Reviewed by Cursor Bugbot for commit 3532852. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

Greptile Summary

The PR consolidates Copilot domain execution behind a shared application adapter and centralizes trusted context validation, delegated-principal construction, operation registration, resource-scope projection, and safe caller-visible error handling.

• Introduces a common adapter for file, table, knowledge, skill, custom-tool, and MCP application use cases.
• Validates delegated identity, audience, lifetime, service policy, and projected file/table scope before execution.
• Replaces domain-specific principal constructors and error projection with shared implementations.

Confidence Score: 5/5

The PR appears safe to merge because no blocking failure remains within the scope of this follow-up review.

No blocking failure remains.

Important Files Changed

Filename	Overview
apps/sim/lib/copilot/application/application-adapter.ts	Adds the shared adapter that validates operation identity, trusted context, delegated-principal configuration, policy, and projected resource scope before invoking domain use cases.
apps/sim/lib/copilot/auth/application-delegation.ts	Centralizes validation of server-authored Copilot execution context and creation of bounded, short-lived delegated principals.
apps/sim/lib/copilot/tools/registry/server-tool-adapter.ts	Centralizes caller-visible application-error projection while preserving structured logging for unexpected tool failures.
apps/sim/lib/copilot/application/execute-file-use-case.ts	Migrates file use-case execution to the shared adapter and projects trusted file scope into delegated principals.
apps/sim/lib/copilot/application/execute-table-use-case.ts	Migrates table execution and admission to the shared adapter with trusted table-scope projection.
apps/sim/lib/copilot/application/execute-knowledge-use-case.ts	Migrates knowledge execution, principal construction, and safe error projection to the consolidated application infrastructure.

Sequence Diagram

sequenceDiagram
  participant Tool as Copilot tool handler
  participant Adapter as Copilot application adapter
  participant Auth as Delegation validation
  participant UseCase as Domain application use case
  Tool->>Adapter: trusted context, use case, input, trusted scope
  Adapter->>Auth: validate context and construct principal
  Auth-->>Adapter: bounded delegated principal
  Adapter->>Adapter: verify operation identity, policy, and scope
  Adapter->>UseCase: "execute({ principal, input })"
  UseCase-->>Adapter: result or application error
  Adapter-->>Tool: result

Loading

_{Reviews (2): Last reviewed commit: "improvement(copilot): consolidate applic..." | Re-trigger Greptile}

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 3532852. Configure here.}