fix(tools): bind schema-enrichment reads to executor delegations

[waleedlatif1]

Summary

• tools/params.ts still called the deprecated buildAuthHeaders() (no subject) to read a child workflow, so /api/workflows/[id] — now on internalWorkflowReadAuth — rejected the legacy type: 'internal' token with a 401. The Agent block's workflow_executor inputMapping was left as an untyped { type: 'object' }, so the model guessed the child's field names and lazyCleanupInputMapping silently dropped the wrong keys.
• tools/schema-enrichers.ts had the same break against /api/knowledge/[id]/tag-definitions. Worse blast radius: when an enricher returns null the parameter is dropped from the schema entirely, so knowledge_search / create_document / upsert_document lost tag filtering altogether.
• Both now use buildExecutorDelegationHeaders, bound to the acting execution subject.
• Extracted the executionId binding rule into executor/utils/delegation.ts — it was hand-rolled in three places. A child workflow binds on its own id, so forwarding the parent's executionId would assert a run that doesn't cover it.

Regression from #5273, which migrated the routes and the sibling call sites but missed these two. git diff origin/main -- apps/sim/tools/params.ts was empty. Audited every remaining buildAuthHeaders caller — the rest target routes still on legacy auth, so no other mismatch remains.

Type of Change

• Bug fix

Testing

• New tests assert the delegation binding and the resulting properties/required schema. Verified they fail against the pre-fix code (2 failures in params.test.ts, 3 in schema-enrichers.test.ts) — the existing inputMapping always included test sat on this path but asserted only type === 'object', which holds in the broken state, so it could not fail.
• bunx vitest run tools/ providers/ executor/ — 5,981 passing.
• Repo-wide lint:check and type-check (23/23 each), plus check:api-validation, monorepo-boundary and realtime-prune gates.
• Not exercised against a live workspace: this path only runs server-side during a real agent run with a child workflow.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 12, 2026 4:20am

[cursor]

PR Summary

Medium Risk
Touches internal auth token binding for schema-enrichment API reads during agent runs. Incorrect executionId scoping could break enrichment or fail route authorization, though the change restores the intended delegation model with focused tests.

Overview
Restores LLM schema enrichment for child workflows and knowledge-base tags after those routes started rejecting legacy internal tokens.

fetchWorkflowInputFields and KB tag-definition reads now authenticate with buildExecutorDelegationHeaders bound to the acting subject, so workflow_executor inputMapping and KB tag filters populate again instead of silently degrading.

Extracts shared executionScopeForTarget so executionId is only forwarded when the target is the running workflow — child workflows bind on their own id. providers/utils adopts the same helper.

^{Reviewed by Cursor Bugbot for commit a939738. Configure here.}

[greptile-apps]

Greptile Summary

The PR replaces legacy internal authentication on workflow and knowledge schema-enrichment reads with executor delegations bound to the acting subject. It also centralizes execution-scope selection and adds regression coverage for same-workflow, child-workflow, missing-context, and rejected-read behavior.

• Adds executionScopeForTarget to include a run ID only when it belongs to the delegation’s target workflow.
• Uses scoped delegation headers for child-workflow input schemas and knowledge-base tag schemas.
• Adds tests covering delegation claims and resulting enriched schema properties.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
apps/sim/executor/utils/delegation.ts	Introduces a focused helper that prevents a parent run ID from being asserted against a child-workflow delegation.
apps/sim/providers/utils.ts	Reuses the centralized execution-scope rule when fetching workflow metadata.
apps/sim/tools/params.ts	Uses the acting execution subject for delegated workflow reads and enriches workflow-executor input mappings with child input fields.
apps/sim/tools/schema-enrichers.ts	Migrates knowledge tag-definition enrichment to workflow-scoped executor delegation while retaining graceful fallback behavior.
apps/sim/executor/utils/delegation.test.ts	Covers same-workflow, child-workflow, inactive-run, and missing-workflow delegation scopes.
apps/sim/tools/params.test.ts	Verifies delegation claims and workflow input schema enrichment, including missing-subject and authorization-failure fallbacks.
apps/sim/tools/schema-enrichers.test.ts	Verifies knowledge tag enrichment uses the acting subject and appropriate workflow execution binding.

Sequence Diagram

sequenceDiagram
  participant Exec as Workflow Executor
  participant Tool as Tool Schema Enricher
  participant Auth as Delegation Builder
  participant API as Internal API
  Exec->>Tool: Build schema with execution context
  Tool->>Auth: subjectUserId + target workflow
  alt Target is running workflow
    Tool->>Auth: Include executionId
  else Target is child workflow
    Tool->>Auth: Omit parent executionId
  end
  Auth-->>Tool: Scoped delegation headers
  Tool->>API: Read workflow or tag definitions
  API-->>Tool: Authorized enrichment data
  Tool-->>Exec: Enriched tool schema

Loading

_{Reviews (2): Last reviewed commit: "improvement(tools): surface tag-definiti..." | Re-trigger Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit a939738. Configure here.}