refactor: enforce Copilot table application boundary

[TheodoreSpeaks]

Summary

• Replace the Table Copilot admission-only compatibility paths with fixed application commands that own canonical loading, asserted-workspace checks, authorization, mutation, audit, and shared effects.
• Keep the shared in-process Copilot identity (serviceId: copilot) from the merged foundation. Fixed adapters construct that Principal, map boundary input, call exactly one code-defined application command/query, and present the result; there is no generic Table multi-operation executor.
• Replace automatic tool-output persistence with one schema-locked Table command. It validates projected wire rows against the fresh authoritative schema and replaces rows in the same lock/transaction, removing the former read-then-write race.
• Add named Table commands for workflow-group create/update/add-output and enrichment creation. They resolve canonical workflow metadata only after Table authorization, conceal cross-workspace workflow IDs, validate requested coordinates/mappings, construct groups and columns, mutate, audit, and emit shared effects. No authorized use case is nested inside another.
• Make create-from-file, import-file, ordinary workspace-file-backed import creation, and best-effort multi-table deletion top-level application commands. They own their complete compound semantics rather than composing authorized lower-level use cases in the Copilot adapter.
• Return domain import/export records from application code and present unchanged v2 DTOs only at route presenters. Preserve v1 behavior and schemas. No database migration or dependency change is included.

Application operation manifest

Migrated

Table Copilot operations

• Table lifecycle: create, get, get schema, rename, and ordered best-effort multi-table delete. The delete command canonically resolves every requested table in the trusted workspace and records each completed archive even if a later mutation fails.
• Rows: insert, batch insert, get, query, update, delete, filter update/delete, batch update/delete, and automatic tool-output replacement. Each calls a fixed Table use case; projected output replacement validates and writes under one authoritative schema lock.
• Columns: add, rename, single/multi-delete, and constraint/type/options update through fixed Table application use cases.
• Workflow groups: create, update, delete, add output, and delete output. Named create/update/add-output commands own workflow resolution, validation, group/column construction, mutation, audit, schema effects, and auto-run dispatch.
• Enrichment: creation owns enrichment lookup, input/output mapping validation, group/column construction, mutation, audit, and effects.
• Runs: start and cancel enter fixed Table application use cases.
• Workspace files: create table from file and import file into table are top-level cross-resource Table commands. They own canonical file/table resolution and authorization, exact provenance binding, bounded inline parsing, large-file background admission, job claims, abort checks, partial append behavior, and create rollback.

Workflow operation

• list_workflow_outputs calls one exact authorized Workflow resolver using the shared Copilot Principal. Workflow-output resolution used by group mutations is owned inside the top-level authorized Table command and is not a nested Workflow use case.

HTTP Table transfer/group operations

• Internal and v2 import create/read/cancel, multipart part signing, and completion call fixed Table import use cases.
• Internal and v2 export create/read/cancel and download authorization/signing call fixed Table export use cases.
• Ordinary internal workflow-group create/update/delete routes call fixed Table application use cases.
• Import/export application code returns domain records; internal/v2 presenters perform wire DTO conversion.

Deferred

• None. No authorize-only Table shim, compatibility allowlist, generic Table executor, adapter-to-manager mutation, or adapter-composed authorized command remains in the declared PR scope.

Non-goals

• Knowledge operations: this Table domain PR changes no Knowledge route or Copilot operation. The merged shared Knowledge/application adapter foundation is consumed as-is and is not duplicated here.
• Multipart protocol mechanics, signed-part transport, binary download responses, and streaming/large-body transport remain specialized. Their durable resources, authorization, immutable upload binding, and signing decisions are application-owned.
• list_enrichments is a pure code-defined catalog presentation with no durable resource load or mutation; it is intentionally not forced through the Table operation registry.
• Tool argument parsing, response/error presentation, abort polling, and trusted model-response secret-provenance propagation remain surface concerns. They do not authorize or mutate Table resources.
• v1 and unrelated legacy Table routes are unchanged.

Import and internal-auth policy

Durable import resources are workspace-owned: reading an import requires workspace read access, and cancelling an import requires workspace write access. This intentionally allows a currently authorized workspace member or workspace API key to control the durable job independent of the original uploader.

Upload control remains credential-bound. Upload parts, completion, and upload cancellation require the exact creating principal/API-key credential plus the upload token; finalization reasserts that binding. Delegated principals remain rejected from HTTP upload creation, parts, and completion. Copilot workspace-file imports enter delegated-only Table application commands instead of entering or bypassing the HTTP upload lifecycle.

The ordinary first-party transfer and workflow-group routes are session-only. A caller audit found only browser React Query callers and no workflow executor or trusted server caller sending Bearer auth to these contracts. Executor Bearer support is therefore not applicable here: this PR adds neither createInternalSessionOrExecutorAuth nor a dead delegation-token abstraction, and it never derives executor authority from a route workspace, uploader, owner, or billing actor. Any future executor caller must use scoped headers generated from canonical workflow execution context.

Foundation

This branch is rebased on d69224595c and consumes the merged delegated identity, consolidated Copilot adapter, and route-boundary foundations from #6462, #6450, and #6451. No duplicate fallback Principal or workspace executor is included.

Validation

• Focused Vitest: 24 files, 167 tests passed
• Sim and @sim/auth type-check passed
• Biome passed on all 59 PR-changed files
• bun run check:api-validation:strict passed
• git diff --check passed

bun.lock contains unrelated local tool-version drift and is intentionally excluded.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 10, 2026 1:18am

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@cursor review

[cursor]

PR Summary

Medium Risk
Touches authorization boundaries for Copilot table persistence, import/export lifecycle, and workflow-group mutations across many routes; behavior is intended to stay equivalent but errors and locking are centralized in application code.

Overview
Moves internal table transfer, export, and workflow-group HTTP handlers off ad-hoc auth/orchestration onto defineInternalJsonRoute, each wired to a fixed tableOperations use case with shared error/rate-limit policies. Create import/export contracts now declare 201 responses; route tests assert wiring and status preservation.

Copilot no longer uses admission-only paths or a generic table executor. table-commands exposes named wrappers (projected row replacement, workflow groups, enrichment, workspace-file import/create-from-file, multi-table delete) that build the delegated copilot principal and call one registered application command. admitCopilotTableOperation and resolveCopilotTablePrincipal are removed; automatic tool-output and CSV persistence go through executeCopilotReplaceProjectedWireRows so validation and replacement share one schema lock.

V2 import/export routes use shared presentV2TableImport / presentV2TableExport presenters (domain records → existing DTOs). A dedicated executeCopilotResolveWorkflowOutputs path enters the fixed Workflow resolver under Copilot delegation.

^{Reviewed by Cursor Bugbot for commit 6e9c395. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

Greptile Summary

The PR replaces Copilot Table compatibility paths with fixed application commands and moves Table transfer and workflow-group routes onto application-owned authorization boundaries.

• Binds table-targeting Copilot commands to an exact table resource scope.
• Adds workspace-level compound commands for table creation and best-effort deletion.
• Moves import, export, row, column, group, enrichment, and run operations behind named application use cases.
• Keeps wire DTO conversion at route presenters while application code returns domain records.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains; the previously reported unscoped Copilot Table delegation is now bound to exact table scope and checked against the canonically loaded table context.

Important Files Changed

Filename	Overview
apps/sim/lib/copilot/application/execute-table-use-case.ts	Constructs the shared Copilot application principal and projects exact table scope for table-targeting commands.
apps/sim/lib/copilot/application/table-commands.ts	Defines fixed adapters for compound Table commands and deliberately distinguishes table-scoped from workspace-scoped operations.
apps/sim/lib/table/application/authorization.ts	Enforces bidirectional agreement between delegated table scope and the canonical authorization context.
apps/sim/lib/table/application/copilot-table-lifecycle.ts	Implements workspace-authorized table lifecycle commands with canonical per-table containment checks.
apps/sim/lib/table/application/imports.ts	Moves import lifecycle authorization and credential-bound upload control into fixed application use cases.
apps/sim/lib/table/application/exports.ts	Moves export creation, access, cancellation, and download signing behind application authorization.
apps/sim/lib/table/application/groups.ts	Centralizes workflow-group validation, authorization, mutation, auditing, and effects in named Table commands.
apps/sim/lib/copilot/tools/server/table/user-table.ts	Replaces generic or adapter-composed Table execution with explicit application command dispatch.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Model[Copilot model tool call] --> Adapter[Fixed Table adapter]
  Adapter --> Principal[Copilot delegated principal]
  Principal --> Scope{Command scope}
  Scope -->|Existing table| TableScope[Exact tableId scope]
  Scope -->|Workspace command| WorkspaceScope[Workspace scope]
  TableScope --> Command[Named application command]
  WorkspaceScope --> Command
  Command --> Canonical[Canonical resource resolution]
  Canonical --> Auth[Workspace and resource authorization]
  Auth --> Mutation[Locked mutation or query]
  Mutation --> Effects[Audit and shared effects]
  Effects --> Presenter[Surface presenter]

Loading

_{Reviews (8): Last reviewed commit: "fix(tables): complete authorized applica..." | Re-trigger Greptile}

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 2856cd5. Configure here.}

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@cursor review

[TheodoreSpeaks]

@cursor review

[TheodoreSpeaks]

@greptile

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 54e16a0. Configure here.}

[TheodoreSpeaks]

@cursor review

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@cursor review

[TheodoreSpeaks]

@greptile

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit d7df662. Configure here.}

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 6e9c395. Configure here.}