fix(cbinsights): bound a numeric organization ID to the safe-integer range

The string path already required a safe integer; the numeric path still used
Number.isInteger, which accepts a value past the precision limit. JSON parsing
has already rounded such a value, so the request would target a different
organization than the caller supplied.

Author: waleedlatif1

apps/sim/tools/cbinsights/cbinsights.test.ts

@@ -328,6 +328,21 @@ describe('cbinsights request building', () => {
     }
   )
 
+  it('rejects a numeric ID past the precision limit on both input shapes', async () => {
+    mockFetch([AUTH_OK])
+    await expect(
+      cbinsightsGetOrgOutlookTool.directExecution!({ ...CREDS, orgId: 1e20 } as never)
+    ).rejects.toThrow(/"orgId" must be a positive integer/)
+
+    mockFetch([AUTH_OK])
+    await expect(
+      cbinsightsGetOrgOutlookTool.directExecution!({
+        ...CREDS,
+        orgId: '12345678901234567890',
+      } as never)
+    ).rejects.toThrow(/"orgId" must be a positive integer/)
+  })
+
   it('still accepts a plain decimal ID, with or without padding', async () => {
     mockFetch([AUTH_OK, { body: {} }, { body: {} }])
     await cbinsightsGetOrgOutlookTool.directExecution!({ ...CREDS, orgId: '  129410  ' } as never)

apps/sim/tools/cbinsights/utils.ts

@@ -252,8 +252,11 @@ const DECIMAL_ID = /^\d+$/
 
 /** Coerces one entry to a positive integer ID, or returns null if it is not one. */
 function toOrgId(value: unknown): number | null {
+  /* Safe, not merely integral: JSON parsing has already rounded anything past
+     the precision limit, so accepting it would target a different ID than the
+     one supplied. The string branch below applies the same bound. */
   if (typeof value === 'number') {
-    return Number.isInteger(value) && value > 0 ? value : null
+    return Number.isSafeInteger(value) && value > 0 ? value : null
   }
   if (typeof value !== 'string') return null