improvement(tools): widen the internal-route audit and fix its guidance path

The line-scoped matcher missed a builder whose body the formatter wrapped onto the
next line. The audit now collapses each url builder before matching. Also points
the diagnostic and docs at the primitive's actual module path.

Author: waleedlatif1

.agents/skills/add-integration/SKILL.md

@@ -873,7 +873,7 @@ export const {service}UploadTool: ToolConfig<Params, Response> = {
   },
   request: {
     // Internal route. A static string is a source literal, so the transport trusts it. When the
-    // path is dynamic, use `internalRoute` from '@/tools/internal-route' instead of a template
+    // path is dynamic, use `internalRoute` from '@/lib/core/utils/internal-route' instead of a template
     // string — a builder's plain `/api/...` string is treated as external, because a caller- or
     // model-supplied param can produce one:
     //   url: (params) => internalRoute`/api/tools/{service}/upload/${params.folderId}`

.agents/skills/add-tools/SKILL.md

@@ -157,7 +157,7 @@ can make any tool emit `/api/...` (the HTTP Request tool passes its `url` throug
 self-hosted integration with a blank host param collapses `${host}/api/v2/x` to `/api/v2/x`).
 
 ```typescript
-import { internalRoute } from '@/tools/internal-route'
+import { internalRoute } from '@/lib/core/utils/internal-route'
 
 // ✓ Static route — a source literal no param can influence
 url: '/api/tools/{service}/{action}',

.agents/skills/validate-integration/SKILL.md

@@ -74,7 +74,7 @@ For **every** tool file, check:
 ### Request URL
 - [ ] A tool calling a third-party service returns an ABSOLUTE `https://...` URL
 - [ ] A tool calling Sim's own API declares it: a static `/api/...` string, or `internalRoute` from
-      `@/tools/internal-route` when the path is dynamic (query params via `.withQuery({...})`)
+      `@/lib/core/utils/internal-route` when the path is dynamic (query params via `.withQuery({...})`)
 - [ ] No builder returns a bare `` `/api/...` `` template string — that is treated as external and
       will fail, because a `user-or-llm` param can produce the same string
 - [ ] No `encodeURIComponent` inside an `internalRoute` template (the tag already encodes, so this

.claude/commands/add-integration.md

@@ -872,7 +872,7 @@ export const {service}UploadTool: ToolConfig<Params, Response> = {
   },
   request: {
     // Internal route. A static string is a source literal, so the transport trusts it. When the
-    // path is dynamic, use `internalRoute` from '@/tools/internal-route' instead of a template
+    // path is dynamic, use `internalRoute` from '@/lib/core/utils/internal-route' instead of a template
     // string — a builder's plain `/api/...` string is treated as external, because a caller- or
     // model-supplied param can produce one:
     //   url: (params) => internalRoute`/api/tools/{service}/upload/${params.folderId}`

.claude/commands/add-tools.md

@@ -156,7 +156,7 @@ can make any tool emit `/api/...` (the HTTP Request tool passes its `url` throug
 self-hosted integration with a blank host param collapses `${host}/api/v2/x` to `/api/v2/x`).
 
 ```typescript
-import { internalRoute } from '@/tools/internal-route'
+import { internalRoute } from '@/lib/core/utils/internal-route'
 
 // ✓ Static route — a source literal no param can influence
 url: '/api/tools/{service}/{action}',

.claude/commands/validate-integration.md

@@ -73,7 +73,7 @@ For **every** tool file, check:
 ### Request URL
 - [ ] A tool calling a third-party service returns an ABSOLUTE `https://...` URL
 - [ ] A tool calling Sim's own API declares it: a static `/api/...` string, or `internalRoute` from
-      `@/tools/internal-route` when the path is dynamic (query params via `.withQuery({...})`)
+      `@/lib/core/utils/internal-route` when the path is dynamic (query params via `.withQuery({...})`)
 - [ ] No builder returns a bare `` `/api/...` `` template string — that is treated as external and
       will fail, because a `user-or-llm` param can produce the same string
 - [ ] No `encodeURIComponent` inside an `internalRoute` template (the tag already encodes, so this

.claude/rules/sim-integrations.md

@@ -14,7 +14,7 @@ The full authoring instructions — tool/block/icon/trigger scaffolding, SubBloc
 ## Hard rules (don't get these wrong)
 
 - Tool IDs are `snake_case` (`service_action`). Register tools in `tools/registry.ts`, blocks in `blocks/registry-maps.ts` (the `BLOCK_REGISTRY` config map + `BLOCK_META_REGISTRY` catalog-meta map, alphabetically — `blocks/registry.ts` holds only the accessor functions), triggers in `triggers/registry.ts`.
-- A tool that calls Sim's own API declares it: a static `request.url` string (`'/api/tools/{service}/{action}'`), or `` internalRoute`/api/table/${params.tableId}/rows` `` from `@/tools/internal-route` when the path is dynamic (query params via `.withQuery({...})`). The transport signs internal requests with the executing user's token, so that decision follows the tool's source, never the resolved string — a builder returning a bare `/api/...` string is treated as EXTERNAL, because a `user-or-llm` param can produce one. `internalRoute` encodes every `${...}`; never add `encodeURIComponent` inside the template.
+- A tool that calls Sim's own API declares it: a static `request.url` string (`'/api/tools/{service}/{action}'`), or `` internalRoute`/api/table/${params.tableId}/rows` `` from `@/lib/core/utils/internal-route` when the path is dynamic (query params via `.withQuery({...})`). The transport signs internal requests with the executing user's token, so that decision follows the tool's source, never the resolved string — a builder returning a bare `/api/...` string is treated as EXTERNAL, because a `user-or-llm` param can produce one. `internalRoute` encodes every `${...}`; never add `encodeURIComponent` inside the template.
 - Type coercions (`Number()`, etc.) belong in `tools.config.params` (runs at execution, after variable resolution) — never in `tools.config.tool` (runs at serialization; coercing there destroys dynamic `<Block.output>` references).
 - `canonicalParamId` must NOT match any subblock's `id`, must be unique **block-wide** (groups are keyed by canonical id across every subblock and hold exactly one `basicId`, so two operations that each need a pair need two different canonical ids), and all subblocks in a canonical group must share the same `required` status. The `inputs` section and the params function reference canonical IDs, not raw subblock IDs — the serializer deletes the subblock IDs and republishes the active member's value under the canonical ID.
 - A canonical pair carries ONE concept. For files that is upload (basic) + file reference (advanced), as in Gmail attachments (`blocks/blocks/gmail.ts`). Never overload the advanced side with alternate identifiers (URL, provider asset ID) — give those their own subblocks, mark mutually exclusive sources `required: false`, and enforce "exactly one" at execution.

.cursor/commands/add-integration.md

@@ -867,7 +867,7 @@ export const {service}UploadTool: ToolConfig<Params, Response> = {
   },
   request: {
     // Internal route. A static string is a source literal, so the transport trusts it. When the
-    // path is dynamic, use `internalRoute` from '@/tools/internal-route' instead of a template
+    // path is dynamic, use `internalRoute` from '@/lib/core/utils/internal-route' instead of a template
     // string — a builder's plain `/api/...` string is treated as external, because a caller- or
     // model-supplied param can produce one:
     //   url: (params) => internalRoute`/api/tools/{service}/upload/${params.folderId}`

.cursor/commands/add-tools.md

@@ -151,7 +151,7 @@ can make any tool emit `/api/...` (the HTTP Request tool passes its `url` throug
 self-hosted integration with a blank host param collapses `${host}/api/v2/x` to `/api/v2/x`).
 
 ```typescript
-import { internalRoute } from '@/tools/internal-route'
+import { internalRoute } from '@/lib/core/utils/internal-route'
 
 // ✓ Static route — a source literal no param can influence
 url: '/api/tools/{service}/{action}',

.cursor/commands/validate-integration.md

@@ -68,7 +68,7 @@ For **every** tool file, check:
 ### Request URL
 - [ ] A tool calling a third-party service returns an ABSOLUTE `https://...` URL
 - [ ] A tool calling Sim's own API declares it: a static `/api/...` string, or `internalRoute` from
-      `@/tools/internal-route` when the path is dynamic (query params via `.withQuery({...})`)
+      `@/lib/core/utils/internal-route` when the path is dynamic (query params via `.withQuery({...})`)
 - [ ] No builder returns a bare `` `/api/...` `` template string — that is treated as external and
       will fail, because a `user-or-llm` param can produce the same string
 - [ ] No `encodeURIComponent` inside an `internalRoute` template (the tag already encodes, so this