fix(workflows): preserve VFS validation errors

Author: TheodoreSpeaks

apps/sim/lib/copilot/application/execute-workflow-use-case.test.ts

@@ -80,7 +80,7 @@ describe('executeCopilotWorkflowUseCase', () => {
         },
         { workflowId: 'workflow-1' }
       )
-    ).toThrow('Unregistered Copilot workspace operation')
+    ).toThrow('Unregistered Copilot workflow operation')
     expect(execute).not.toHaveBeenCalled()
   })
 

apps/sim/lib/copilot/application/execute-workflow-use-case.ts

@@ -1,24 +1,36 @@
-import { createLogger } from '@sim/logger'
-import { createCopilotWorkspaceUseCaseExecutor } from '@/lib/copilot/application/execute-workspace-use-case'
-import { asOrchestrationError } from '@/lib/core/orchestration/types'
+import { createCopilotApplicationAdapter } from '@/lib/copilot/application/application-adapter'
+import { messageForCopilotApplicationError } from '@/lib/copilot/application/error'
+import {
+  COPILOT_APPLICATION_DELEGATION_TTL_MS,
+  type CopilotExecutionContext,
+} from '@/lib/copilot/auth/application-delegation'
+import type { OperationUseCase } from '@/lib/core/application'
 import { WORKFLOW_DELEGATION_AUDIENCE } from '@/lib/workflows/application/authorization'
-import { workflowOperations } from '@/lib/workflows/application/operations'
+import { type WorkflowOperation, workflowOperations } from '@/lib/workflows/application/operations'
 
-const logger = createLogger('CopilotWorkflowApplication')
-
-/** Enters a registered workflow use case with identity derived only from trusted tool context. */
-export const executeCopilotWorkflowUseCase = createCopilotWorkspaceUseCaseExecutor({
-  audience: WORKFLOW_DELEGATION_AUDIENCE,
+const executeWorkflowUseCase = createCopilotApplicationAdapter({
+  domain: 'workflow',
+  delegation: {
+    audience: WORKFLOW_DELEGATION_AUDIENCE,
+    ttlMs: COPILOT_APPLICATION_DELEGATION_TTL_MS,
+    createDelegationId: (context) => `copilot-tool:${context.toolCallId}`,
+  },
   operations: workflowOperations,
 })
 
+/** Enters a registered workflow use case with identity derived only from trusted tool context. */
+export function executeCopilotWorkflowUseCase<O extends WorkflowOperation, I, R>(
+  context: CopilotExecutionContext | undefined,
+  useCase: OperationUseCase<O, I, R>,
+  input: I
+): Promise<R> {
+  return executeWorkflowUseCase(context, useCase, input)
+}
+
 /** Projects actionable application errors without exposing infrastructure details to the model. */
 export function messageForCopilotWorkflowError(
   error: unknown,
   fallback = 'Workflow operation failed'
 ): string {
-  const classified = asOrchestrationError(error)
-  if (classified && classified.code !== 'internal') return classified.message
-  logger.error('Workflow application operation failed', { error })
-  return fallback
+  return messageForCopilotApplicationError(error, fallback)
 }

apps/sim/lib/copilot/tools/handlers/vfs-mutate.test.ts

@@ -3,6 +3,9 @@
  */
 import { dbChainMock, resetDbChainMock, schemaMock, workflowAuthzMockFns } from '@sim/testing'
 import { afterAll, beforeEach, describe, expect, it, vi } from 'vitest'
+import { knowledgeOperations } from '@/lib/knowledge/application/operations'
+import { workflowOperations } from '@/lib/workflows/application/operations'
+import { fileOperations } from '@/lib/workspace-files/application/operations'
 
 const mocks = vi.hoisted(() => ({
   ensureWorkspaceAccess: vi.fn(),
@@ -74,41 +77,28 @@ vi.mock('@/lib/copilot/tools/server/files/file-folder-application', () => ({
 
 vi.mock('@/lib/workspace-files/application/move-workspace-file-items', () => ({
   moveWorkspaceFileItemsOperation: {
-    operation: { id: 'files.move', minimumRole: 'write', workspaceApiKey: 'allow' },
+    operation: fileOperations.move,
     execute: mocks.moveWorkspaceFileItems,
   },
 }))
 
-vi.mock('@/lib/workspace-files/application/operations', () => ({
-  fileOperations: {
-    move: { id: 'files.move', minimumRole: 'write', workspaceApiKey: 'allow' },
-    rename: { id: 'files.rename', minimumRole: 'write', workspaceApiKey: 'allow' },
-    delete: { id: 'files.delete', minimumRole: 'write', workspaceApiKey: 'allow' },
-    updateFolder: {
-      id: 'files.folders.update',
-      minimumRole: 'write',
-      workspaceApiKey: 'allow',
-    },
-  },
-}))
-
 vi.mock('@/lib/workspace-files/application/workspace-file-folders', () => ({
   updateWorkspaceFileFolderOperation: {
-    operation: { id: 'files.folders.update', minimumRole: 'write', workspaceApiKey: 'allow' },
+    operation: fileOperations.updateFolder,
     execute: mocks.updateWorkspaceFileFolder,
   },
 }))
 
 vi.mock('@/lib/workspace-files/application/delete-workspace-file', () => ({
   deleteWorkspaceFileOperation: {
-    operation: { id: 'files.delete', minimumRole: 'write', workspaceApiKey: 'allow' },
+    operation: fileOperations.delete,
     execute: mocks.deleteWorkspaceFile,
   },
 }))
 
 vi.mock('@/lib/workspace-files/application/archive-workspace-file-items', () => ({
   archiveWorkspaceFileItemsOperation: {
-    operation: { id: 'files.delete', minimumRole: 'write', workspaceApiKey: 'allow' },
+    operation: fileOperations.delete,
     execute: mocks.deleteWorkspaceFile,
   },
 }))
@@ -117,26 +107,26 @@ vi.mock('@/lib/workspace-files/orchestration', () => ({}))
 
 vi.mock('@/lib/workspace-files/application/rename-workspace-file', () => ({
   renameWorkspaceFile: {
-    operation: { id: 'files.rename', minimumRole: 'write', workspaceApiKey: 'allow' },
+    operation: fileOperations.rename,
     execute: mocks.renameWorkspaceFile,
   },
 }))
 
 vi.mock('@/lib/workflows/application/workflow-vfs', () => ({
   moveWorkflowVfsItems: {
-    operation: { id: 'workflows.vfs.move' },
+    operation: workflowOperations.moveVfsItems,
     execute: mocks.moveWorkflowVfs,
   },
   copyWorkflowVfsItems: {
-    operation: { id: 'workflows.vfs.copy' },
+    operation: workflowOperations.copyVfsItems,
     execute: mocks.copyWorkflowVfs,
   },
   createWorkflowVfsFolders: {
-    operation: { id: 'workflows.vfs.folders.create' },
+    operation: workflowOperations.createVfsFolders,
     execute: mocks.createWorkflowVfsFolders,
   },
   deleteWorkflowVfsItems: {
-    operation: { id: 'workflows.vfs.delete' },
+    operation: workflowOperations.deleteVfsItems,
     execute: mocks.deleteWorkflowVfs,
   },
 }))
@@ -148,15 +138,15 @@ vi.mock('@/lib/table/service', () => ({
 
 vi.mock('@/lib/knowledge/application/knowledge-bases', () => ({
   listKnowledgeBases: {
-    operation: { id: 'knowledge.list' },
+    operation: knowledgeOperations.list,
     execute: mocks.listKnowledgeBases,
   },
   updateKnowledgeBaseOperation: {
-    operation: { id: 'knowledge.update' },
+    operation: knowledgeOperations.update,
     execute: mocks.updateKnowledgeBase,
   },
   deleteKnowledgeBaseOperation: {
-    operation: { id: 'knowledge.delete' },
+    operation: knowledgeOperations.delete,
     execute: mocks.deleteKnowledgeBase,
   },
 }))
@@ -473,6 +463,25 @@ describe('vfs mv/cp', () => {
       expect(result.success).toBe(true)
     })
 
+    it('preserves safe workflow application validation errors', async () => {
+      mocks.moveWorkflowVfs.mockRejectedValueOnce(
+        new OrchestrationError(
+          'validation',
+          'With multiple sources the destination must be a folder'
+        )
+      )
+
+      const result = await executeVfsMv(
+        { sources: ['workflows/One', 'workflows/Two'], destination: 'workflows/Renamed' },
+        context
+      )
+
+      expect(result).toEqual({
+        success: false,
+        error: 'With multiple sources the destination must be a folder',
+      })
+    })
+
     it('surfaces locked-workflow rejections per item', async () => {
       mocks.moveWorkflowVfs.mockResolvedValue({
         outcomes: [

apps/sim/lib/copilot/tools/handlers/vfs-mutate.ts

@@ -601,11 +601,19 @@ async function mutateWorkflows(
       trailingSlash: hasTrailingSlash(destination),
     },
   }
-  const result =
-    verb === 'cp'
-      ? await executeCopilotWorkflowUseCase(context, copyWorkflowVfsItems, input)
-      : await executeCopilotWorkflowUseCase(context, moveWorkflowVfsItems, input)
-  return buildResult(verb, result.outcomes.map(presentWorkflowVfsOutcome))
+  try {
+    const result =
+      verb === 'cp'
+        ? await executeCopilotWorkflowUseCase(context, copyWorkflowVfsItems, input)
+        : await executeCopilotWorkflowUseCase(context, moveWorkflowVfsItems, input)
+    return buildResult(verb, result.outcomes.map(presentWorkflowVfsOutcome))
+  } catch (error) {
+    if (context.abortSignal?.aborted) throw error
+    return {
+      success: false,
+      error: messageForCopilotWorkflowError(error, 'Workflow mutation failed'),
+    }
+  }
 }
 
 async function renameFlatResource(