fix(executor): restore delegated workflow execution

[TheodoreSpeaks]

Summary

• preserve trusted delegation context across agent tools and nested workflows
• run custom blocks under their source-owned execution context, trust only server-authored invocation scope, and fail fast when logging cannot start
• resolve model-exposed workspace variables in custom tool arguments without leaking plaintext secrets

Type of Change

• Bug fix

Testing

• 641 focused tests passing, including the 150-test tool executor suite after custom-block hardening
• Sim/auth type checks passing
• Lint and all 24 CI audits passing

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 11, 2026 11:05am

[cursor]

PR Summary

High Risk
Changes span signed executor delegation, workflow read authorization, nested/custom-block execution identity, and secret rebinding for model-emitted tool args—security- and billing-sensitive surfaces with broad test coverage but non-trivial blast radius.

Overview
Restores trusted executor delegation across nested workflows, agent tools, and internal API reads by introducing ExecutorDelegationOrigin (canonical parent log identity) on execution context extensions. Regular child workflows keep that origin through deeper nesting; custom blocks switch delegation to the publisher-owned child execution after their log row starts, and fail before running if that logging session cannot open.

Workflow authorization now lets an active executor delegation read any workflow in the same workspace, not only the workflow id embedded in the token—aligned with loading child workflow definitions.

Agent / provider tool path gains safer handling when models echo {{ENV}} placeholders from the prompt into tool arguments: model-visible secret registries are attached per tool, resolveModelExposedEnvReferences rebinds only placeholders that were actually projected to the model, and provider runtime forwards the trusted executionContext into executeTool. Custom-block and workflow executor tools ignore forged _context and use server-resolved scope for invocation.

Executor-delegation protected tools mint tokens from executorDelegationOrigin when present (so nested runs still authenticate as the parent workflow).

^{Reviewed by Cursor Bugbot for commit c7ef54c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[TheodoreSpeaks]

@cursor review

[TheodoreSpeaks]

@greptile

[greptile-apps]

Greptile Summary

The PR restores delegated execution across nested workflows and agent tools while preserving trusted execution identity and secret provenance.

• Propagates canonical delegation origins through nested workflows and custom blocks.
• Fails closed when custom-block execution logging cannot start.
• Rebinds only model-exposed environment placeholders for tool execution.
• Replaces the newly introduced Record<string, any> merge assertions with inferred Record<string, unknown> results.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
apps/sim/providers/utils.ts	Safely resolves model-exposed environment references and fixes the previously reported merge-result typing issue.
apps/sim/executor/handlers/workflow/workflow-handler.ts	Preserves canonical delegation identity for regular children and establishes source-owned identity for custom-block executions.
apps/sim/tools/index.ts	Uses trusted execution scope for protected tools and overwrites model-supplied custom-block context fields.
apps/sim/executor/utils/resolved-secret-trace-registry.ts	Adds scoped placeholder rebinding with collision detection and per-tool provenance tracking.
apps/sim/lib/workflows/application/authorization.ts	Permits delegated workflow reads across workflows while retaining workspace and canonical-origin checks.

_{Reviews (3): Last reviewed commit: "fix(providers): keep tool parameters typ..." | Re-trigger Greptile}

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit c7ef54c. Configure here.}