refactor: enforce Copilot table application boundary

[TheodoreSpeaks]

Summary

• Replace the Table Copilot admission-only compatibility paths with fixed application commands that own canonical loading, asserted-workspace checks, authorization, mutation, audit, and shared effects.
• Keep the shared in-process Copilot identity (serviceId: copilot) from the merged foundation. Fixed adapters construct that Principal, map boundary input, call exactly one code-defined application command/query, and present the result; there is no generic Table multi-operation executor.
• Replace automatic tool-output persistence with one schema-locked Table command. It validates projected wire rows against the fresh authoritative schema and replaces rows in the same lock/transaction, removing the former read-then-write race.
• Add named Table commands for workflow-group create/update/add-output and enrichment creation. They resolve canonical workflow metadata only after Table authorization, conceal cross-workspace workflow IDs, validate requested coordinates/mappings, construct groups and columns, mutate, audit, and emit shared effects. No authorized use case is nested inside another.
• Make create-from-file, import-file, ordinary workspace-file-backed import creation, and best-effort multi-table deletion top-level application commands. They own their complete compound semantics rather than composing authorized lower-level use cases in the Copilot adapter.
• Return domain import/export records from application code and present unchanged v2 DTOs only at route presenters. Preserve v1 behavior and schemas. No database migration or dependency change is included.

Application operation manifest

Migrated

Table Copilot operations

• Table lifecycle: create, get, get schema, rename, and ordered best-effort multi-table delete. The delete command canonically resolves every requested table in the trusted workspace and records each completed archive even if a later mutation fails.
• Rows: insert, batch insert, get, query, update, delete, filter update/delete, batch update/delete, and automatic tool-output replacement. Each calls a fixed Table use case; projected output replacement validates and writes under one authoritative schema lock.
• Columns: add, rename, single/multi-delete, and constraint/type/options update through fixed Table application use cases.
• Workflow groups: create, update, delete, add output, and delete output. Named create/update/add-output commands own workflow resolution, validation, group/column construction, mutation, audit, schema effects, and auto-run dispatch.
• Enrichment: creation owns enrichment lookup, input/output mapping validation, group/column construction, mutation, audit, and effects.
• Runs: start and cancel enter fixed Table application use cases.
• Workspace files: create table from file and import file into table are top-level cross-resource Table commands. They own canonical file/table resolution and authorization, exact provenance binding, bounded inline parsing, large-file background admission, job claims, abort checks, partial append behavior, and create rollback.

Workflow operation

• list_workflow_outputs calls one exact authorized Workflow resolver using the shared Copilot Principal. Workflow-output resolution used by group mutations is owned inside the top-level authorized Table command and is not a nested Workflow use case.

HTTP Table transfer/group operations

• Internal and v2 import create/read/cancel, multipart part signing, and completion call fixed Table import use cases.
• Internal and v2 export create/read/cancel and download authorization/signing call fixed Table export use cases.
• Ordinary internal workflow-group create/update/delete routes call fixed Table application use cases.
• Import/export application code returns domain records; internal/v2 presenters perform wire DTO conversion.

Deferred

• None. No authorize-only Table shim, compatibility allowlist, generic Table executor, adapter-to-manager mutation, or adapter-composed authorized command remains in the declared PR scope.

Non-goals

• Knowledge operations: this Table domain PR changes no Knowledge route or Copilot operation. The merged shared Knowledge/application adapter foundation is consumed as-is and is not duplicated here.
• Multipart protocol mechanics, signed-part transport, binary download responses, and streaming/large-body transport remain specialized. Their durable resources, authorization, immutable upload binding, and signing decisions are application-owned.
• list_enrichments is a pure code-defined catalog presentation with no durable resource load or mutation; it is intentionally not forced through the Table operation registry.
• Tool argument parsing, response/error presentation, abort polling, and trusted model-response secret-provenance propagation remain surface concerns. They do not authorize or mutate Table resources.
• v1 and unrelated legacy Table routes are unchanged.

Import and internal-auth policy

Durable import resources are workspace-owned: reading an import requires workspace read access, and cancelling an import requires workspace write access. This intentionally allows a currently authorized workspace member or workspace API key to control the durable job independent of the original uploader.

Upload control remains credential-bound. Upload parts, completion, and upload cancellation require the exact creating principal/API-key credential plus the upload token; finalization reasserts that binding. Delegated principals remain rejected from HTTP upload creation, parts, and completion. Copilot workspace-file imports enter delegated-only Table application commands instead of entering or bypassing the HTTP upload lifecycle.

The ordinary first-party transfer and workflow-group routes are session-only. A caller audit found only browser React Query callers and no workflow executor or trusted server caller sending Bearer auth to these contracts. Executor Bearer support is therefore not applicable here: this PR adds neither createInternalSessionOrExecutorAuth nor a dead delegation-token abstraction, and it never derives executor authority from a route workspace, uploader, owner, or billing actor. Any future executor caller must use scoped headers generated from canonical workflow execution context.

Foundation

This branch is rebased on d69224595c and consumes the merged delegated identity, consolidated Copilot adapter, and route-boundary foundations from #6462, #6450, and #6451. No duplicate fallback Principal or workspace executor is included.

Validation

• Focused Vitest: 24 files, 167 tests passed
• Sim and @sim/auth type-check passed
• Biome passed on all 59 PR-changed files
• bun run check:api-validation:strict passed
• git diff --check passed

bun.lock contains unrelated local tool-version drift and is intentionally excluded.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 10, 2026 1:18am

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@cursor review

[cursor]

PR Summary

Medium Risk
Touches authorization boundaries for Copilot table persistence, import/export lifecycle, and workflow-group mutations across many routes; behavior is intended to stay equivalent but errors and locking are centralized in application code.

Overview
Moves internal table transfer, export, and workflow-group HTTP handlers off ad-hoc auth/orchestration onto defineInternalJsonRoute, each wired to a fixed tableOperations use case with shared error/rate-limit policies. Create import/export contracts now declare 201 responses; route tests assert wiring and status preservation.

Copilot no longer uses admission-only paths or a generic table executor. table-commands exposes named wrappers (projected row replacement, workflow groups, enrichment, workspace-file import/create-from-file, multi-table delete) that build the delegated copilot principal and call one registered application command. admitCopilotTableOperation and resolveCopilotTablePrincipal are removed; automatic tool-output and CSV persistence go through executeCopilotReplaceProjectedWireRows so validation and replacement share one schema lock.

V2 import/export routes use shared presentV2TableImport / presentV2TableExport presenters (domain records → existing DTOs). A dedicated executeCopilotResolveWorkflowOutputs path enters the fixed Workflow resolver under Copilot delegation.

^{Reviewed by Cursor Bugbot for commit 6e9c395. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

Greptile Summary

This PR moves Copilot and HTTP Table operations behind fixed application commands that own canonical loading, authorization, mutation, audit, and shared effects.

• Replaces the generic Copilot Table executor and compatibility admission paths with operation-specific adapters and use cases.
• Binds single-table Copilot principals to the requested table while keeping creation and multi-table deletion workspace-scoped.
• Moves import, export, workflow-group, enrichment, row, column, lifecycle, and workspace-file operations into the Table application boundary.
• Keeps route handlers focused on authentication, input mapping, error policy, and DTO presentation.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
apps/sim/lib/copilot/application/table-commands.ts	Introduces fixed Copilot adapters that dispatch each operation to one application command and bind single-table principals to the target table.
apps/sim/lib/copilot/auth/table-delegation.ts	Rejects blank table scopes and constructs delegated Table principals with the requested resource scope.
apps/sim/lib/table/application/authorization.ts	Enforces exact delegated table-scope matching whenever the canonical authorization context contains a table ID.
apps/sim/lib/table/application/copilot-table-lifecycle.ts	Implements workspace-scoped lifecycle commands, including per-table canonical workspace checks for best-effort deletion.
apps/sim/lib/table/application/rows.ts	Moves projected-row replacement into an authorized, schema-validated, locked application command.
apps/sim/lib/table/application/imports.ts	Centralizes durable import authorization and credential-bound upload control in fixed application use cases.
apps/sim/lib/table/application/exports.ts	Centralizes export creation, access, cancellation, and download authorization in application use cases.
apps/sim/lib/table/application/groups.ts	Moves workflow-group and enrichment mutations behind canonical Table authorization and application-owned effects.
apps/sim/lib/copilot/tools/server/table/user-table.ts	Routes Table tools through fixed application use cases with table-scoped principals for single-table operations.
apps/sim/app/api/table/[tableId]/groups/route.ts	Reduces group routes to session-authenticated boundary mapping, application dispatch, error policy, and presentation.

Sequence Diagram

sequenceDiagram
participant Model as Copilot model
participant Adapter as Fixed Table adapter
participant Command as Table application command
participant Auth as Authorization policy
participant Store as Canonical Table storage
Model->>Adapter: Tool call with tableId
Adapter->>Adapter: Construct delegated principal scoped to tableId
Adapter->>Command: Execute one code-defined command
Command->>Store: Load canonical table and workspace
Command->>Auth: Authorize principal against canonical context
Auth-->>Command: Scope and permission decision
Command->>Store: Locked mutation or query
Command-->>Adapter: Domain result
Adapter-->>Model: Presented tool result

Loading

_{Reviews (7): Last reviewed commit: "fix(tables): reject enrichment output mu..." | Re-trigger Greptile}

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 2856cd5. Configure here.}

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@cursor review

[TheodoreSpeaks]

@cursor review

[TheodoreSpeaks]

@greptile

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 54e16a0. Configure here.}

[TheodoreSpeaks]

@cursor review

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@cursor review

[TheodoreSpeaks]

@greptile

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit d7df662. Configure here.}

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 6e9c395. Configure here.}