fix(copilot): close fail-open write gates in agent tools (#6132)

* fix(copilot): make tool write gates fail closed

The three handler-map management tools (manage_custom_tool,
manage_mcp_tool, manage_skill) gated writes with
`context.userPermission && perm !== 'write' && perm !== 'admin'`.
userPermission is optional on the execution context, so an absent value
skipped the check entirely and the write proceeded unguarded — while
the server-tool router's equivalent gate is fail-closed. Both paths now
share copilotToolCanWrite, built on the canonical permissionSatisfies
(null/undefined never satisfies).

manage_custom_tool additionally resolved its target as
`params.workspaceId || context.workspaceId`, so a model-supplied
workspace id won while the permission check was resolved for the
context workspace — and upsertCustomTools performs no authz of its own.
It now uses the server-set context only, matching its two siblings.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CiHhAk2R1NryaS3R8n2yFz

* fix(copilot): gate materialize_file writes and enforce the deploy mutation lock

materialize_file's save/extract/import all create workspace resources, but
the handler-map path has no central permission check, so a read-only member
could create files and workflows through the agent. Gate on write access
after param validation.

assertWorkflowMutable moves into performFullDeploy / performFullUndeploy /
performActivateVersion, where performRevertToVersion already had it. The
check previously lived only in the deploy routes, so the copilot deploy
tools — which call the orchestration functions directly — could deploy,
undeploy, and activate versions of a locked workflow.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(copilot): enforce secret-admin on env writes and gate KB indexing on usage

Two more paths where the agent is a weaker route to the same write than the UI.

upsertWorkspaceEnvVars was a weakened copy of the environment route's write:
no per-key secret-admin check, no advisory lock, no audit row. Its only caller
is the set_environment_variables copilot tool, which gates on workspace 'write'
alone — so any write-level member could have the agent overwrite a workspace
secret they do not administer, with nothing in the audit log and a lost-update
race against the route's locked transaction. The gate now lives in the function
so every caller inherits it, reusing getWorkspaceEnvKeyAdminAccess rather than
restating the route's logic.

knowledge_base add_file computed a billing attribution and then indexed without
calling checkAttributedUsageLimits, which every upload route applies before
accepting indexing work — an over-quota workspace could index without limit
through the agent. The same file's query operation already gated correctly.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(copilot): return lock denials and stop bootstrapping a legacy secret's ACL

Two defects in the previous commits, both found by review.

assertWorkflowMutable throws, and the three orchestration entry points awaited
it outside any try/catch, so a locked workflow escaped as an exception instead
of the { success: false } result the callers consume — performChatDeploy and
the copilot deploy tools would have surfaced a generic 500 rather than a lock
denial. performRevertToVersion already converted it; the three now do too,
through a shared helper.

upsertWorkspaceEnvVars derived newKeys for createWorkspaceEnvCredentials from
the credential rows rather than the stored variables. A secret written before
credential rows existed has no ACL, so overwriting it looked like adding a new
key: it minted a credential and made the caller that secret's admin. The
environment route derives newKeys from the locked jsonb read for exactly this
reason, and now so does this.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* style(env): collapse the merged test import onto one line

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PCXbU36FwJBmtJKaH83BUm

* fix(env): give the workspace env denial its own write-access message

WorkspaceEnvAccessError reported "must be an admin of these secrets" for
both denials, so a caller lacking workspace write to ADD a key was told to
get secret-admin on a key that does not exist yet. Carry the reason and
mirror the route's two messages.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PCXbU36FwJBmtJKaH83BUm

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: TheodoreSpeaks

apps/sim/lib/copilot/tools/handlers/management/manage-custom-tool.ts

@@ -2,6 +2,7 @@ import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
 import { createLogger } from '@sim/logger'
 import { getErrorMessage, toError } from '@sim/utils/errors'
 import type { ExecutionContext, ToolCallResult } from '@/lib/copilot/request/types'
+import { copilotToolCanWrite, copilotWriteDeniedMessage } from '@/lib/copilot/tools/permissions'
 import { captureServerEvent } from '@/lib/posthog/server'
 import {
   deleteCustomTool,
@@ -30,7 +31,6 @@ interface ManageCustomToolParams {
   schema?: ManageCustomToolSchema
   code?: string
   title?: string
-  workspaceId?: string
 }
 
 export async function executeManageCustomTool(
@@ -39,22 +39,25 @@ export async function executeManageCustomTool(
 ): Promise<ToolCallResult> {
   const params = rawParams as ManageCustomToolParams
   const operation = String(params.operation || '').toLowerCase() as ManageCustomToolOperation
-  const workspaceId = params.workspaceId || context.workspaceId
+  /**
+   * Server-set context only. A model-supplied `params.workspaceId` used to win
+   * here, while the permission gate above is resolved for the CONTEXT
+   * workspace — so a caller could name another workspace and have it
+   * authorized against their own. `upsertCustomTools` does no authz of its own
+   * (it only scopes queries by the id it is handed), so nothing downstream
+   * caught it. Matches manage_mcp_tool and manage_skill.
+   */
+  const workspaceId = context.workspaceId
 
   if (!operation) {
     return { success: false, error: "Missing required 'operation' argument" }
   }
 
   const writeOps: string[] = ['add', 'edit', 'delete']
-  if (
-    writeOps.includes(operation) &&
-    context.userPermission &&
-    context.userPermission !== 'write' &&
-    context.userPermission !== 'admin'
-  ) {
+  if (writeOps.includes(operation) && !copilotToolCanWrite(context.userPermission)) {
     return {
       success: false,
-      error: `Permission denied: '${operation}' on manage_custom_tool requires write access. You have '${context.userPermission}' permission.`,
+      error: copilotWriteDeniedMessage('manage_custom_tool', operation, context.userPermission),
     }
   }
 

apps/sim/lib/copilot/tools/handlers/management/manage-mcp-tool.ts

@@ -4,6 +4,7 @@ import { createLogger } from '@sim/logger'
 import { getErrorMessage, toError } from '@sim/utils/errors'
 import { and, eq, isNull } from 'drizzle-orm'
 import type { ExecutionContext, ToolCallResult } from '@/lib/copilot/request/types'
+import { copilotToolCanWrite, copilotWriteDeniedMessage } from '@/lib/copilot/tools/permissions'
 import {
   performCreateMcpServer,
   performDeleteMcpServer,
@@ -46,15 +47,10 @@ export async function executeManageMcpTool(
   }
 
   const writeOps: string[] = ['add', 'edit', 'delete']
-  if (
-    writeOps.includes(operation) &&
-    context.userPermission &&
-    context.userPermission !== 'write' &&
-    context.userPermission !== 'admin'
-  ) {
+  if (writeOps.includes(operation) && !copilotToolCanWrite(context.userPermission)) {
     return {
       success: false,
-      error: `Permission denied: '${operation}' on manage_mcp_tool requires write access. You have '${context.userPermission}' permission.`,
+      error: copilotWriteDeniedMessage('manage_mcp_tool', operation, context.userPermission),
     }
   }
 

apps/sim/lib/copilot/tools/handlers/management/manage-skill.ts

@@ -2,6 +2,7 @@ import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
 import { createLogger } from '@sim/logger'
 import { getErrorMessage, toError } from '@sim/utils/errors'
 import type { ExecutionContext, ToolCallResult } from '@/lib/copilot/request/types'
+import { copilotToolCanWrite, copilotWriteDeniedMessage } from '@/lib/copilot/tools/permissions'
 import { captureServerEvent } from '@/lib/posthog/server'
 import { getSkillActorContext } from '@/lib/skills/access'
 import { isBuiltinSkillId } from '@/lib/workflows/skills/builtin-skills'
@@ -37,15 +38,10 @@ export async function executeManageSkill(
 
   // Workspace write gates only creation; edits and deletes are gated per skill
   // below (skill editor — explicit editor row or derived workspace admin).
-  if (
-    operation === 'add' &&
-    context.userPermission &&
-    context.userPermission !== 'write' &&
-    context.userPermission !== 'admin'
-  ) {
+  if (operation === 'add' && !copilotToolCanWrite(context.userPermission)) {
     return {
       success: false,
-      error: `Permission denied: 'add' on manage_skill requires write access. You have '${context.userPermission}' permission.`,
+      error: copilotWriteDeniedMessage('manage_skill', operation, context.userPermission),
     }
   }
 

apps/sim/lib/copilot/tools/handlers/materialize-file.test.ts

@@ -28,6 +28,10 @@ const {
   mockResolveStorageBillingContext: vi.fn(),
 }))
 
+vi.mock('@/lib/copilot/tools/handlers/access', () => ({
+  ensureWorkspaceAccess: vi.fn(),
+}))
+
 vi.mock('@/lib/copilot/tools/handlers/upload-file-reader', () => ({
   findMothershipUploadRowByChatAndName: mockFindUpload,
 }))
@@ -128,6 +132,36 @@ const mothershipRow = {
   updatedAt: new Date('2026-01-01'),
 }
 
+describe('executeMaterializeFile - workspace write gate', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    resetDbChainMock()
+  })
+
+  it.each(['save', 'import', 'extract'])(
+    'refuses %s without workspace write access and touches no upload',
+    async (operation) => {
+      const { ensureWorkspaceAccess } = await import('@/lib/copilot/tools/handlers/access')
+      vi.mocked(ensureWorkspaceAccess).mockRejectedValueOnce(
+        new Error('Write access required for this workspace')
+      )
+
+      const result = await executeMaterializeFile({ fileNames: ['a.json'], operation }, context)
+
+      expect(result.success).toBe(false)
+      expect(result.error).toContain('Write access required')
+      expect(mockFindUpload).not.toHaveBeenCalled()
+    }
+  )
+
+  it('requires write, not merely read, access', async () => {
+    const { ensureWorkspaceAccess } = await import('@/lib/copilot/tools/handlers/access')
+    await executeMaterializeFile({ fileNames: ['a.json'], operation: 'save' }, context)
+
+    expect(ensureWorkspaceAccess).toHaveBeenCalledWith(context.workspaceId, context.userId, 'write')
+  })
+})
+
 describe('executeMaterializeFile - unsupported operation', () => {
   beforeEach(() => {
     vi.clearAllMocks()

apps/sim/lib/copilot/tools/handlers/materialize-file.ts

@@ -12,6 +12,7 @@ import {
   resolveStorageBillingContext,
 } from '@/lib/billing/storage'
 import type { ExecutionContext, ToolCallResult } from '@/lib/copilot/request/types'
+import { ensureWorkspaceAccess } from '@/lib/copilot/tools/handlers/access'
 import { findMothershipUploadRowByChatAndName } from '@/lib/copilot/tools/handlers/upload-file-reader'
 import { canonicalWorkspaceFilePath, encodeVfsPathSegments } from '@/lib/copilot/vfs/path-utils'
 import { getServePathPrefix } from '@/lib/uploads'
@@ -504,6 +505,15 @@ export async function executeMaterializeFile(
       error: `Unsupported materialize_file operation "${operation}". Use "save", "import", or "extract". For CSV/TSV/JSON → use the table subagent; for documents → use the knowledge subagent.`,
     }
   }
+
+  // Every operation writes: save/extract create files, import creates a workflow.
+  // The handler-map path has no central permission gate.
+  try {
+    await ensureWorkspaceAccess(context.workspaceId, context.userId, 'write')
+  } catch (error) {
+    return { success: false, error: getErrorMessage(error, 'Workspace write access required') }
+  }
+
   const succeeded: string[] = []
   const failed: Array<{ fileName: string; error: string }> = []
   const resources: NonNullable<ToolCallResult['resources']> = []

apps/sim/lib/copilot/tools/permissions.test.ts

@@ -0,0 +1,41 @@
+/**
+ * @vitest-environment node
+ */
+import { describe, expect, it } from 'vitest'
+import { copilotToolCanWrite, copilotWriteDeniedMessage } from '@/lib/copilot/tools/permissions'
+
+describe('copilotToolCanWrite', () => {
+  it('fails closed when the permission is absent', () => {
+    expect(copilotToolCanWrite(undefined)).toBe(false)
+    expect(copilotToolCanWrite(null)).toBe(false)
+    expect(copilotToolCanWrite('')).toBe(false)
+  })
+
+  it('denies read-only and unrecognized permissions', () => {
+    expect(copilotToolCanWrite('read')).toBe(false)
+    expect(copilotToolCanWrite('nonsense')).toBe(false)
+  })
+
+  it('allows write and admin', () => {
+    expect(copilotToolCanWrite('write')).toBe(true)
+    expect(copilotToolCanWrite('admin')).toBe(true)
+  })
+})
+
+describe('copilotWriteDeniedMessage', () => {
+  it('names the operation and the caller’s actual permission', () => {
+    expect(copilotWriteDeniedMessage('manage_custom_tool', 'delete', 'read')).toBe(
+      "Permission denied: 'delete' on manage_custom_tool requires write access. You have 'read' permission."
+    )
+  })
+
+  it('reports "none" rather than an empty string when permission is absent', () => {
+    expect(copilotWriteDeniedMessage('manage_skill', 'add', undefined)).toContain("You have 'none'")
+  })
+
+  it('omits the operation label when there is no operation', () => {
+    expect(copilotWriteDeniedMessage('knowledge_base', undefined, 'read')).toBe(
+      "Permission denied: knowledge_base requires write access. You have 'read' permission."
+    )
+  })
+})

apps/sim/lib/copilot/tools/permissions.ts

@@ -0,0 +1,20 @@
+import { type PermissionType, permissionSatisfies } from '@sim/platform-authz/workspace'
+
+/**
+ * Whether a copilot tool call may write. Fails closed: `userPermission` is
+ * optional on the execution context, and absent must deny. Shared by the
+ * server-tool router and the handler-map tools.
+ */
+export function copilotToolCanWrite(userPermission: string | null | undefined): boolean {
+  return permissionSatisfies((userPermission ?? null) as PermissionType | null, 'write')
+}
+
+/** Renders the denial message shared by both copilot execution paths. */
+export function copilotWriteDeniedMessage(
+  toolName: string,
+  operation: string | undefined,
+  userPermission: string | null | undefined
+): string {
+  const actionLabel = operation ? `'${operation}' on ` : ''
+  return `Permission denied: ${actionLabel}${toolName} requires write access. You have '${userPermission || 'none'}' permission.`
+}

apps/sim/lib/copilot/tools/server/knowledge/knowledge-base.test.ts

@@ -82,7 +82,11 @@ vi.mock('@/app/api/knowledge/utils', () => ({
   checkKnowledgeBaseWriteAccess: mockCheckKnowledgeBaseWriteAccess,
 }))
 
+import { checkAttributedUsageLimits } from '@/lib/billing/core/billing-attribution'
 import { knowledgeBaseServerTool } from '@/lib/copilot/tools/server/knowledge/knowledge-base'
+import { createSingleDocument } from '@/lib/knowledge/documents/service'
+import { getKnowledgeBaseById } from '@/lib/knowledge/service'
+import { resolveWorkspaceFileReference } from '@/lib/uploads/contexts/workspace/workspace-file-manager'
 
 const BILLING_ATTRIBUTION = {
   actorUserId: 'external-admin',
@@ -173,3 +177,58 @@ describe('knowledge base connector Copilot operations', () => {
     }
   )
 })
+
+describe('knowledge base add_file usage gate', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    resetDbChainMock()
+    mockCheckKnowledgeBaseWriteAccess.mockResolvedValue({
+      hasAccess: true,
+      knowledgeBase: { id: 'knowledge-base-1', workspaceId: 'workspace-paid', name: 'Paid KB' },
+    })
+    vi.mocked(getKnowledgeBaseById).mockResolvedValue({
+      id: 'knowledge-base-1',
+      workspaceId: 'workspace-paid',
+    } as Awaited<ReturnType<typeof getKnowledgeBaseById>>)
+  })
+
+  function addFile() {
+    return knowledgeBaseServerTool.execute(
+      {
+        operation: 'add_file',
+        args: { knowledgeBaseId: 'knowledge-base-1', filePaths: ['files/report.pdf'] },
+      },
+      {
+        userId: 'external-admin',
+        workspaceId: 'workspace-paid',
+        billingAttribution: BILLING_ATTRIBUTION,
+      }
+    )
+  }
+
+  it('refuses to index when the payer is over its usage limit', async () => {
+    vi.mocked(checkAttributedUsageLimits).mockResolvedValue({
+      isExceeded: true,
+      message: 'Usage limit exceeded.',
+    } as Awaited<ReturnType<typeof checkAttributedUsageLimits>>)
+
+    const result = await addFile()
+
+    expect(result.success).toBe(false)
+    expect(result.message).toContain('Usage limit exceeded')
+    // The gate must precede any indexing work, matching the upload routes.
+    expect(resolveWorkspaceFileReference).not.toHaveBeenCalled()
+    expect(createSingleDocument).not.toHaveBeenCalled()
+  })
+
+  it('gates on the knowledge base workspace payer, not the caller', async () => {
+    vi.mocked(checkAttributedUsageLimits).mockResolvedValue({
+      isExceeded: false,
+    } as Awaited<ReturnType<typeof checkAttributedUsageLimits>>)
+    vi.mocked(resolveWorkspaceFileReference).mockResolvedValue(null)
+
+    await addFile()
+
+    expect(checkAttributedUsageLimits).toHaveBeenCalledWith(BILLING_ATTRIBUTION)
+  })
+})

apps/sim/lib/copilot/tools/server/knowledge/knowledge-base.ts

@@ -349,6 +349,17 @@ export const knowledgeBaseServerTool: BaseServerTool<KnowledgeBaseArgs, Knowledg
 
           const kbWorkspaceId: string = targetKb.workspaceId
           const billingAttribution = requireKnowledgeBillingAttribution(context, kbWorkspaceId)
+
+          // Gate the payer before accepting indexing work, same as the upload routes.
+          const usage = await checkAttributedUsageLimits(billingAttribution)
+          if (usage.isExceeded) {
+            return {
+              success: false,
+              message:
+                usage.message || 'Usage limit exceeded. Please upgrade your plan to continue.',
+            }
+          }
+
           const added: Array<{ documentId: string; filename: string }> = []
           const failedFiles: string[] = []
 

apps/sim/lib/copilot/tools/server/router.ts

@@ -16,6 +16,7 @@ import {
   UserTable,
   WorkspaceFile,
 } from '@/lib/copilot/generated/tool-catalog-v1'
+import { copilotToolCanWrite } from '@/lib/copilot/tools/permissions'
 import {
   assertServerToolNotAborted,
   type BaseServerTool,
@@ -139,10 +140,6 @@ const WRITE_ACTIONS: Record<string, string[]> = {
   [enrichmentRunServerTool.name]: ['*'],
 }
 
-function isWritePermission(userPermission: string): boolean {
-  return userPermission === 'write' || userPermission === 'admin'
-}
-
 function isWriteAction(toolName: string, action: string | undefined): boolean {
   const writeActions = WRITE_ACTIONS[toolName]
   if (!writeActions) return false
@@ -211,7 +208,7 @@ export async function routeExecution(
   if (WRITE_ACTIONS[toolName]) {
     const p = payload as Record<string, unknown>
     const action = (p?.operation ?? p?.action) as string | undefined
-    if (isWriteAction(toolName, action) && !isWritePermission(context?.userPermission ?? '')) {
+    if (isWriteAction(toolName, action) && !copilotToolCanWrite(context?.userPermission)) {
       const actionLabel = action ? `'${action}' on ` : ''
       throw new Error(
         `Permission denied: ${actionLabel}${toolName} requires write access. You have '${context?.userPermission ?? 'none'}' permission.`