feat(workflows): add IDE-style reference viewer for workflows

[mzxchandra]

Summary

Adds an IDE-style "Show references" viewer for workflows. Complex workflows increasingly call helper/child workflows (via the workflow / workflow_input blocks and published custom blocks), but there was no way to see how they connect. This adds a modal with two recursive, clickable trees:

• Used by — every workflow that calls this one (inbound / callers)
• Uses — every workflow this one calls (outbound / callees)

Nodes navigate to the referenced workflow on click.

Triggers: Cmd/Ctrl+click a sidebar workflow row, or the new "Show references" context-menu item.

Type of Change

• New feature

How it works

• Builds the whole workspace reference graph once from live workflow_blocks state (what the sidebar/editor show).
• Resolves references through both direct workflow blocks (workflow + workflow_input, via the existing isWorkflowBlockType) and published custom blocks (custom_block_* -> bound source workflow), scoped to the workspace.
• Cycle-safe DFS: A -> B -> A renders as a (cycle) leaf and stops recursing (depth-capped as a backstop).
• Contract-bound GET /api/workflows/[id]/references with workspace-level authz (auth before validation). React Query hook fetches only when the modal opens.
• Repurposes Cmd/Ctrl+click (previously native open-in-new-tab, still available via the context menu); multi-select is shift-only so no conflict.

Testing

• bun run check:api-validation and check:react-query pass (contract-bound route + hook, no route-local Zod).
• tsc --noEmit: 0 errors.
• Unit tests for the pure graph/tree logic: cycles, self-references, dangling/out-of-workspace drop, custom-block resolution, workflow_input resolution, name sorting. Route tests: 401 / 400 / 403 / 200.
• QA'd live against a sid -> child 1 -> child 2 chain.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

@mzxchandra is attempting to deploy a commit to the Sim Team on Vercel.

A member of the Team first needs to authorize it.

[cursor]

PR Summary

Low Risk
Read-only feature with standard workspace authz on a new endpoint; Cmd/Ctrl+click behavior change is the main UX risk, mitigated by keeping open-in-new-tab in the context menu.

Overview
Adds an IDE-style workflow reference viewer so users can see inbound and outbound workflow call relationships from the sidebar.

A new GET /api/workflows/[id]/references endpoint (session + workspace permission checks, contract-bound) returns recursive callers (“Used by”) and callees (“Uses”) trees. Graph resolution reads live draft workflow_blocks, including workflow / workflow_input blocks (active basic vs advanced workflowId), published custom blocks, cycle-safe expansion, and depth limits.

The sidebar wires Show references in the workflow context menu and a ReferencesModal with tabbed ReferenceTree navigation to other workflows. Cmd/Ctrl+click on a workflow row now opens references instead of the browser’s default new-tab behavior; Open in new tab remains in the menu.

Includes useWorkflowReferences (fetch when modal opens, staleTime: 0), shared workflow-references API contract/types, unit tests for graph logic and the route, and bumps the API validation route baseline to 967.

^{Reviewed by Cursor Bugbot for commit 1888e62. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

Greptile Summary

This PR adds an IDE-style workflow reference viewer. The main changes are:

• Recursive caller and callee trees with cycle and convergence handling.
• Reference resolution for workflow, workflow-input, and published custom blocks.
• An authenticated references API with a shared request and response contract.
• A React Query hook and modal opened from workflow rows or their context menu.
• Tests for graph resolution, cycles, sorting, authorization, and validation.

Confidence Score: 5/5

This looks safe to merge.

• Self-references now render as cycle leaves in both directions.
• Active workflow values are selected from the configured canonical mode.
• Converging paths no longer expand the same subtree repeatedly.
• Reopening the modal triggers a fresh references request.

Important Files Changed

Filename	Overview
apps/sim/lib/workflows/references/operations.ts	Builds workspace reference graphs, resolves active workflow targets, and bounds recursive tree expansion.
apps/sim/hooks/queries/workflow-references.ts	Fetches contract-validated reference data and marks it stale immediately for refresh on reopen.
apps/sim/app/api/workflows/[id]/references/route.ts	Adds an authenticated, workspace-authorized endpoint for workflow references.
apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/workflow-list/components/references-modal/references-modal.tsx	Adds the caller and callee modal with recursive navigation.
apps/sim/lib/workflows/references/operations.test.ts	Covers direct, custom, cyclic, self-referential, converging, and mode-aware graph cases.

_{Reviews (2): Last reviewed commit: "fix(workflows): correct reference resolu..." | Re-trigger Greptile}

[mzxchandra]

@greptile

[mzxchandra]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 1888e62. Configure here.}

[mzxchandra]

@waleedlatif1

[waleedlatif1]

Thanks so much for building this, @mzxchandra — the feature is great and both of your commits are preserved verbatim as the base of #5854, which layers an alignment pass on top (sibling-route authz via authorizeWorkflowByWorkspacePermission, tool-input call edges, native cmd+click restored, on-demand modal mounting, and design-token alignment). Closing this one in favor of #5854 so review lands in one place.