refactor(copilot): classify both workspace-scope guard branches and drop call-site boilerplate

requireCopilotWorkspace now accepts an undefined context and throws a
classified OrchestrationError for the missing-workspace branch too, so every
caller drops the 'context ?? {}' and '|| undefined' coercions and one
instanceof covers the guard. query_logs inlines its now-one-line wrapper,
get_credentials drops the workspace-less special case (a workflow with no
workspace asserts nothing), and publish_custom_block handles the guard
locally instead of widening its catch-all — keeping its deliberate
assume-not-published guidance for unrelated failures.

Author: waleedlatif1

apps/sim/lib/copilot/tools/handlers/deployment/custom-block.ts

@@ -12,7 +12,6 @@ import type { ExecutionContext, ToolCallResult } from '@/lib/copilot/request/typ
 import { requireCopilotWorkspace } from '@/lib/copilot/tools/server/workspace-scope'
 import { canonicalizeVfsPath } from '@/lib/copilot/vfs/path-utils'
 import { isFeatureEnabled } from '@/lib/core/config/feature-flags'
-import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { buildStorageKeySegment } from '@/lib/uploads/core/storage-key'
 import { uploadFile } from '@/lib/uploads/core/storage-service'
 import { isImageFileType } from '@/lib/uploads/utils/file-utils'
@@ -149,11 +148,17 @@ export async function executeDeployCustomBlock(
         error: "Managing a custom block requires admin permission on the workflow's workspace",
       }
     }
-    const rawWorkspaceId = workflowRecord.workspaceId
-    if (!rawWorkspaceId) {
+    if (!workflowRecord.workspaceId) {
       return { success: false, error: 'Workflow must belong to a workspace' }
     }
-    const workspaceId = requireCopilotWorkspace(context, rawWorkspaceId)
+    // A model-supplied workflowId may only re-assert the chat's workspace — it
+    // can never publish or unpublish a custom block in another workspace.
+    let workspaceId: string
+    try {
+      workspaceId = requireCopilotWorkspace(context, workflowRecord.workspaceId)
+    } catch (error) {
+      return { success: false, error: toError(error).message }
+    }
 
     const ws = await getWorkspaceWithOwner(workspaceId)
     const organizationId = ws?.organizationId
@@ -306,7 +311,7 @@ export async function executeDeployCustomBlock(
     })
     return { success: true, output: { ...customBlockOutput(block, 'deploy'), updated: false } }
   } catch (error) {
-    if (error instanceof CustomBlockValidationError || error instanceof OrchestrationError) {
+    if (error instanceof CustomBlockValidationError) {
       return { success: false, error: error.message }
     }
     logger.error('Custom block deployment failed', { error })

apps/sim/lib/copilot/tools/handlers/deployment/manage.ts

@@ -139,7 +139,7 @@ export async function executeListWorkspaceMcpServers(
   context: ExecutionContext
 ): Promise<ToolCallResult> {
   try {
-    const workspaceId = requireCopilotWorkspace(context, params.workspaceId || undefined)
+    const workspaceId = requireCopilotWorkspace(context, params.workspaceId)
     const result = await executeCopilotMcpServerUseCase(context, listWorkflowMcpDeployments, {
       workspaceId,
     })
@@ -161,7 +161,7 @@ export async function executeCreateWorkspaceMcpServer(
   context: ExecutionContext
 ): Promise<ToolCallResult> {
   try {
-    const workspaceId = requireCopilotWorkspace(context, params.workspaceId || undefined)
+    const workspaceId = requireCopilotWorkspace(context, params.workspaceId)
 
     const name = params.name?.trim()
     if (!name) {

apps/sim/lib/copilot/tools/handlers/workflow/mutations.ts

@@ -152,7 +152,7 @@ export async function executeCreateWorkflow(
     if (name.length > 200) {
       return { success: false, error: 'Workflow name must be 200 characters or less' }
     }
-    const workspaceId = requireCopilotWorkspace(context, params?.workspaceId || undefined)
+    const workspaceId = requireCopilotWorkspace(context, params?.workspaceId)
 
     const folderPath = typeof params?.folderPath === 'string' ? params.folderPath.trim() : ''
     const folderId =
@@ -362,7 +362,7 @@ export async function executeGenerateApiKey(
       return { success: false, error: 'API key name must be 200 characters or less' }
     }
 
-    const workspaceId = requireCopilotWorkspace(context, params.workspaceId || undefined)
+    const workspaceId = requireCopilotWorkspace(context, params.workspaceId)
     assertWorkflowMutationNotAborted(context)
 
     const result = await executeCopilotApiKeyUseCase(context, createCopilotWorkspaceApiKey, {

apps/sim/lib/copilot/tools/server/user/get-credentials.ts

@@ -56,9 +56,8 @@ export const getCredentialsServerTool: BaseServerTool<GetCredentialsParams, any>
       }
 
       // A model-supplied workflowId may only re-assert the chat's workspace —
-      // it can never steer the credential listing to another workspace. A
-      // legacy workflow with no workspace contributes no workspace scope.
-      workspaceId = wId ? requireCopilotWorkspace(context, wId) : undefined
+      // it can never steer the credential listing to another workspace.
+      workspaceId = requireCopilotWorkspace(context, wId)
     }
 
     const userId = authenticatedUserId

apps/sim/lib/copilot/tools/server/user/set-environment-variables.ts

@@ -169,10 +169,10 @@ async function resolveWorkspaceId(
         `Workflow ${params.workflowId} is not associated with a workspace`
       )
     }
-    return requireCopilotWorkspace(context ?? {}, workflow.workspaceId)
+    return requireCopilotWorkspace(context, workflow.workspaceId)
   }
 
-  const workspaceId = requireCopilotWorkspace(context ?? {}, params.workspaceId)
+  const workspaceId = requireCopilotWorkspace(context, params.workspaceId)
   await ensureWorkspaceAccess(workspaceId, userId, 'write')
   return workspaceId
 }

apps/sim/lib/copilot/tools/server/workflow/query-logs.ts

@@ -118,15 +118,6 @@ const queryLogsArgsSchema = z.preprocess((value) => {
 
 type QueryLogsArgs = z.infer<typeof queryLogsArgsSchema>
 
-/**
- * Logs are always read from the chat's delegated workspace. A model-supplied
- * `workspaceId` may only re-assert that workspace — it can never select a
- * different one, even one the acting user could otherwise access.
- */
-function resolveWorkspaceId(args: QueryLogsArgs, context?: ServerToolContext): string {
-  return requireCopilotWorkspace(context ?? {}, args.workspaceId)
-}
-
 function buildLogViewContext(
   detail: {
     workflowId: string | null
@@ -177,7 +168,10 @@ export const queryLogsServerTool: BaseServerTool<QueryLogsArgs, unknown> = {
       throw new Error('Unauthorized access')
     }
     const userId = context.userId
-    const workspaceId = resolveWorkspaceId(args, context)
+    // Logs are always read from the chat's delegated workspace. A model-supplied
+    // `workspaceId` may only re-assert that workspace — it can never select a
+    // different one, even one the acting user could otherwise access.
+    const workspaceId = requireCopilotWorkspace(context, args.workspaceId)
 
     if (args.view === 'list') {
       const { view: _view, title: _title, ...rest } = args

apps/sim/lib/copilot/tools/server/workspace-scope.ts

@@ -9,10 +9,12 @@ interface CopilotWorkspaceScopeContext {
  * but can never select a different workspace or trigger a default-workspace fallback.
  */
 export function requireCopilotWorkspace(
-  context: CopilotWorkspaceScopeContext,
+  context: CopilotWorkspaceScopeContext | undefined,
   assertedWorkspaceId?: string
 ): string {
-  if (!context.workspaceId) throw new Error('Copilot execution workspace is required')
+  if (!context?.workspaceId) {
+    throw new OrchestrationError('validation', 'Copilot execution workspace is required')
+  }
   if (assertedWorkspaceId && assertedWorkspaceId !== context.workspaceId) {
     throw new OrchestrationError(
       'validation',