Fix shared agent tool execution and discovery boundaries

Author: Sg312

apps/sim/blocks/blocks/file.test.ts

@@ -1,5 +1,7 @@
 import { describe, expect, it } from 'vitest'
+import { fileManageWriteBodySchema } from '@/lib/api/contracts/tools/file'
 import { FileV4Block, FileV5Block } from '@/blocks/blocks/file'
+import { fileWriteTool } from '@/tools/file/write'
 
 describe('FileV4Block', () => {
   const buildParams = FileV4Block.tools.config.params
@@ -54,6 +56,72 @@ describe('FileV4Block', () => {
 describe('FileV5Block', () => {
   const buildParams = FileV5Block.tools.config.params
 
+  it.each([
+    [null, null],
+    ['', null],
+    [undefined, undefined],
+    ['', 'image/png'],
+  ])(
+    'writes a produced file with blank content %s and MIME override %s',
+    (content, contentType) => {
+      const file = {
+        id: 'file_execution-output',
+        name: 'test-card-160x90.png',
+        url: '/api/files/serve/execution-output.png',
+        key: 'execution/workspace-1/workflow-1/run-1/output.png',
+        context: 'execution',
+        type: 'image/png',
+        size: 514,
+      }
+      const inputs = {
+        operation: 'file_write',
+        fileName: 'test-card-160x90.png',
+        writeFolderRef: '/Media%20Studio%20Tests',
+        writeFileInput: file,
+        content,
+        contentType,
+        overwrite: false,
+        _context: { workspaceId: 'workspace-1' },
+      }
+      // GenericBlockHandler retains raw inputs when applying a block's transform.
+      const params = { ...inputs, ...buildParams(inputs) }
+      const parsed = fileManageWriteBodySchema.parse(fileWriteTool.operation.input(params))
+      expect(parsed.fileInput).toEqual(file)
+      expect(parsed.content).toBeUndefined()
+      expect(parsed.contentType).toBe(contentType ?? undefined)
+      expect(parsed.folderPath).toBe('/Media%20Studio%20Tests')
+    }
+  )
+
+  it('preserves empty text writes and rejects a file combined with nonempty text', () => {
+    const text = { operation: 'file_write', fileName: 'empty.txt', content: '', contentType: null }
+    const parsed = fileManageWriteBodySchema.parse(
+      fileWriteTool.operation.input({ ...text, ...buildParams(text) })
+    )
+    expect(parsed.content).toBe('')
+    expect(parsed.fileInput).toBeUndefined()
+    const both = { ...text, content: 'conflict', writeFileInput: { id: 'file-output' } }
+    expect(
+      fileManageWriteBodySchema.safeParse(
+        fileWriteTool.operation.input({ ...both, ...buildParams(both) })
+      ).success
+    ).toBe(false)
+  })
+
+  it('rejects invalid non-string MIME values at the existing contract', () => {
+    const inputs = {
+      operation: 'file_write',
+      fileName: 'note.txt',
+      content: 'keep this text',
+      contentType: 42,
+    }
+    expect(
+      fileManageWriteBodySchema.safeParse(
+        fileWriteTool.operation.input({ ...inputs, ...buildParams(inputs) })
+      ).success
+    ).toBe(false)
+  })
+
   it('maps each operation directly to its tool', () => {
     expect(FileV5Block.tools.config.tool({ operation: 'file_read' })).toBe('file_read')
     expect(FileV5Block.tools.config.tool({ operation: 'file_get_content' })).toBe(

apps/sim/blocks/blocks/file.ts

@@ -1971,7 +1971,7 @@ export const FileV5Block: BlockConfig<FileParserV3Output> = {
             folderPath: optionalText(params.writeFolderRef),
             content: omitContent ? undefined : params.content,
             ...(fileInput ? { fileInput } : {}),
-            contentType: params.contentType,
+            contentType: params.contentType ?? undefined,
             overwrite: params.overwrite === true || params.overwrite === 'true',
             workspaceId: params._context?.workspaceId,
           }

apps/sim/blocks/blocks/mothership.ts

@@ -19,9 +19,9 @@ interface MothershipResponse extends ToolResponse {
 export const MothershipBlock: BlockConfig<MothershipResponse> = {
   type: 'mothership',
   name: 'Sim Chat',
-  description: 'Talk to Sim',
+  description: 'Run a prompt with integration and MCP tools',
   longDescription:
-    'The Sim Chat block sends a prompt with selected integration tools, files, and skill context for a one-shot response within a workflow.',
+    'Run a one-shot prompt with available workspace integration operations, selected MCP tools, and skill context. Tool access is limited to those operations.',
   bestPractices: `
   - Use for tasks that require multi-step reasoning, tool use, or cross-service coordination.
   - Choose Astra or Opus and a reasoning effort. Astra supports Fast mode.

apps/sim/lib/internal/file/execute-tool.test.ts

@@ -1,8 +1,10 @@
 /**
  * @vitest-environment node
  */
+import type { PersonalApiKeyPrincipal } from '@sim/auth/principal'
 import { createExecutionContext } from '@sim/testing'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { InvalidInternalDelegationBindingError } from '@/lib/auth/internal-delegation'
 import type { BillingAttributionSnapshot } from '@/lib/billing/core/billing-attribution'
 
 const mocks = vi.hoisted(() => ({
@@ -424,6 +426,69 @@ describe('executeFileTool', () => {
     )
   })
 
+  it.each([undefined, 'user-1'])(
+    'does not derive authority from body fields or userId (%s)',
+    async (userId) => {
+      const response = await executeFileTool(
+        request(
+          'file_read',
+          {
+            operation: 'read',
+            fileId: 'file-1',
+            callerPrincipal: { kind: 'session', userId: 'user-1', sessionId: 'forged' },
+          },
+          {
+            context: { workflowId: '', workspaceId: 'workspace-1', userId },
+          }
+        )
+      )
+      expect(response.status).toBe(401)
+      expect(mocks.createPrincipal).not.toHaveBeenCalled()
+      expect(mocks.executeManage).not.toHaveBeenCalled()
+    }
+  )
+
+  it('keeps executor delegation authoritative when a direct caller is also present', async () => {
+    const callerPrincipal: PersonalApiKeyPrincipal = {
+      kind: 'personal_api_key',
+      userId: 'user-1',
+      keyId: 'key-1',
+    }
+    const call = request('file_read', MANAGE_INPUTS.file_read)
+    call.context.callerPrincipal = callerPrincipal
+    const response = await executeFileTool(call)
+    expect(response.status).toBe(200)
+    expect(mocks.createPrincipal).toHaveBeenCalled()
+    expect(mocks.executeManage.mock.calls[0]?.[1].principal).toMatchObject({
+      kind: 'delegated',
+      serviceId: 'executor',
+    })
+    expect(mocks.executeManage.mock.calls[0]?.[1].principal).not.toBe(callerPrincipal)
+  })
+
+  it('never falls back to a direct caller after invalid executor delegation', async () => {
+    const call = request('file_read', MANAGE_INPUTS.file_read)
+    call.context.callerPrincipal = { kind: 'personal_api_key', userId: 'user-1', keyId: 'key-1' }
+    mocks.createPrincipal.mockRejectedValueOnce(new InvalidInternalDelegationBindingError())
+    const response = await executeFileTool(call)
+    expect(response.status).toBe(401)
+    expect(mocks.createPrincipal).toHaveBeenCalled()
+    expect(mocks.executeManage).not.toHaveBeenCalled()
+  })
+
+  it('rejects a direct caller without trusted workspace scope', async () => {
+    const response = await executeFileTool(
+      request('file_read', MANAGE_INPUTS.file_read, {
+        context: {
+          workflowId: '',
+          callerPrincipal: { kind: 'personal_api_key', userId: 'user-1', keyId: 'key-1' },
+        },
+      })
+    )
+    expect(response.status).toBe(401)
+    expect(mocks.executeManage).not.toHaveBeenCalled()
+  })
+
   it('rejects missing trusted identity during principal construction', async () => {
     const response = await executeFileTool(
       request('file_get', MANAGE_INPUTS.file_get, {

apps/sim/lib/internal/file/execute-tool.ts

@@ -89,7 +89,10 @@ export const executeFileTool: InternalToolOperationHandler = async (request) =>
   }
 
   const workspaceId = request.context.workspaceId
-  if (!workspaceId || !request.context.executorDelegationOrigin) {
+  if (
+    !workspaceId ||
+    (!request.context.executorDelegationOrigin && !request.context.callerPrincipal)
+  ) {
     return Response.json({ success: false, error: 'Authentication required' }, { status: 401 })
   }
 
@@ -112,10 +115,13 @@ export const executeFileTool: InternalToolOperationHandler = async (request) =>
     isParserTool || isSearchTool ? null : parseInternalToolInput(fileManageContract, request.input)
   if (manageInput && !manageInput.success) return manageInput.response
   try {
-    const principal = await createExecutorPrincipalFromExecutionContext({
-      context: request.context,
-      audience: WORKSPACE_FILES_DELEGATION_AUDIENCE,
-    })
+    const principal =
+      request.context.callerPrincipal && !request.context.executorDelegationOrigin
+        ? request.context.callerPrincipal
+        : await createExecutorPrincipalFromExecutionContext({
+            context: request.context,
+            audience: WORKSPACE_FILES_DELEGATION_AUDIENCE,
+          })
     if (searchInput) {
       request.signal?.throwIfAborted()
       const result = await searchWorkspaceFileContent.execute({